kayg commented

Owner

Owner report 2026-10-17 ~14:00 IST: removed minipc01 (10.69.69.217) from the canvas, re-added it to test mesh path switching; add-host fails at "Connect to the host" with "Remote command returned a failure status; raw output was withheld. The SSH command channel failed." (screenshot in chat).

Evidence (read-only checks):

Server log: host bootstrap failed target_id=kayg_10.69.69.217 step="connect" failure_kind="channel" exit_status=1 mode="rootless" (08:24:34Z, 08:24:49Z), after a first failure_kind="host-key" at 08:24:24Z (key confirmation).
Port 22 on minipc01 is NetBird's built-in SSH server (remote software version NetBird-SSH-Server-0.80.0), not OpenSSH.
From the server, netbird ssh root@10.69.69.217 works (exec and stdin piping fine); netbird ssh kayg@10.69.69.217 → "User authentication failed".
minipc01 has no kayg account (getent passwd kayg empty). The earlier install was rootful: /var/lib/infraternal, infraternal-agent.service (system) still active, a live root session scope, and an infraternal0 device — i.e. removing the host from the canvas left the old agent running.

Product problems:

Wrong message: a sign-in refused because the account does not exist is reported as a generic "SSH command channel failed". It must say plainly: "There's no account named kayg on minipc01. Sign in as an account that exists there (for example root)." — classify NetBird SSH auth refusals (and OpenSSH "Permission denied") as sign-in failures, not channel failures.
Default account: re-adding a host that was added before should default to the account used last time (root here), not the person's own username.
Removing a host leaves its infraternal agent running on the machine (rootful service, sessions, mesh device). Decide/verify per the removal decisions what removal should do on the host; re-adding must take the replace path (#231) cleanly.

Owner report 2026-10-17 ~14:00 IST: removed minipc01 (10.69.69.217) from the canvas, re-added it to test mesh path switching; add-host fails at "Connect to the host" with "Remote command returned a failure status; raw output was withheld. The SSH command channel failed." (screenshot in chat). Evidence (read-only checks): - Server log: `host bootstrap failed target_id=kayg_10.69.69.217 step="connect" failure_kind="channel" exit_status=1 mode="rootless"` (08:24:34Z, 08:24:49Z), after a first `failure_kind="host-key"` at 08:24:24Z (key confirmation). - Port 22 on minipc01 is NetBird's built-in SSH server (`remote software version NetBird-SSH-Server-0.80.0`), not OpenSSH. - From the server, `netbird ssh root@10.69.69.217` works (exec and stdin piping fine); `netbird ssh kayg@10.69.69.217` → "User authentication failed". - minipc01 has **no `kayg` account** (`getent passwd kayg` empty). The earlier install was rootful: /var/lib/infraternal, infraternal-agent.service (system) still active, a live root session scope, and an `infraternal0` device — i.e. removing the host from the canvas left the old agent running. Product problems: 1. Wrong message: a sign-in refused because the account does not exist is reported as a generic "SSH command channel failed". It must say plainly: "There's no account named kayg on minipc01. Sign in as an account that exists there (for example root)." — classify NetBird SSH auth refusals (and OpenSSH "Permission denied") as sign-in failures, not channel failures. 2. Default account: re-adding a host that was added before should default to the account used last time (root here), not the person's own username. 3. Removing a host leaves its infraternal agent running on the machine (rootful service, sessions, mesh device). Decide/verify per the removal decisions what removal should do on the host; re-adding must take the replace path (#231) cleanly.

account-red.log

1,021 B

removed-red.log

2 KiB

ui-red.log

3.3 KiB

account-green.log

2.3 KiB

removed-green.log

719 B

v16b-manifest-state-red-green.json

1.3 KiB

retirement-delete-cuts-after-custody-fixes.json

1.9 KiB

private-copy-lineage-native-red3.log

1.4 KiB

private-workspace-native-red.log

1 KiB

private-commit-native-diagnostic2.log

543 B

handoff-syscall-matrices.log

1.6 KiB

recovery-fixture-current.log

2 KiB

observer-vm-v13-staging-plan.json

9.5 KiB

activation-literal-writer-source-ready.json

3 KiB

activation-literal-writer-before.log

1.3 KiB

activation-literal-writer-after5.log

1.2 KiB

activation-product-accounting-five-variant-unit.json

372 B

observer-vm-v13-stage-control-v2.json

3.6 KiB

retirement-custody-source15-ready.json

1.4 KiB

proof-only-pending-red.json

1.9 KiB

proof-only-pending-green-complete.json

1.8 KiB

fresh-base-fence-red3.json

3.2 KiB

fresh-base-fence-green-complete.json

3.2 KiB

retirement-proof-order-red.json

2 KiB

retirement-proof-order-green.json

2 KiB

v16b-manifest-state-red.log

1.7 KiB

v16b-manifest-state-green.log

100 B

retention-transport-source21-red-v3-finding.md

1.9 KiB

retention-transport-source21-red-v3-gate.log

2.6 KiB

retention-transport-source21-red-v3-results.json

696 B

retention-transport-source21-red-v3-source.json

222 KiB

retention-transport-source21-red-v3-test.txt

10 KiB

runtime-lock-genesis-v21-direct.json

2.3 KiB

runtime-lock-unit-v22.json

1.4 KiB

runtime-lock-unit-v22-red.log

536 B

runtime-lock-unit-v22-green.log

178 B

worker-retention-source23-red-v2-finding.md

3.1 KiB

worker-retention-source23-red-v2-gate.log

3.3 KiB

worker-retention-source23-small-producer.txt

157 B

worker-retention-source23-long-producer.txt

8.1 KiB

worker-retention-source23-red-v2-results.json

634 B

worker-retention-source23-red-v2-test.txt

19 KiB

bounded-retention-catalog-audit-v2.md

19 KiB

bounded-retention-source23-callsites.json

19 KiB

bounded-retention-catalog-audit-v3.md

20 KiB

kayg commented

2026-10-17 08:45:00 +00:00

Author

Owner

Starting #235 inside the #231 lane (branch addhost-readd, head 53b4eeafab, base 34d9d5e4a). minipc01 is not touched; everything is reproduced in containers/fixtures.

Reproduced item 1 with the real NetBird SSH server fixture (docs/verification/addhost-breakit2/netbird-fixture.go, owned container): public-key auth succeeds, then the session prints User authentication failed and exits 1 for a user that does not exist. The client therefore sees a failed command, not a failed sign-in; classify only looks for auth text when the SSH connection itself failed, and attaches the channel boundary before the exit status is set, hence "The SSH command channel failed".

Item 3 cause from the code: inspection finds the complete install of the removed host (e7cea95c…); the installer's owner/unit checks require the new host id and exit 71, which is classified as a channel failure with no Start fresh. Plan: a complete install whose host id is a revoked record of the same owner/mode/uid is "left from an earlier add" → paused with Replace (the existing start-fresh challenge), then the normal staged transaction swaps it to the new identity (old identity.json dropped, sessions/state kept); an id this server never issued is refused plainly, never removed. Item 2: default the account to the last one used for that address.

Starting #235 inside the #231 lane (branch addhost-readd, head 53b4eeafaba86e333a548055b15a140a9807e90c, base 34d9d5e4a). minipc01 is not touched; everything is reproduced in containers/fixtures. Reproduced item 1 with the real NetBird SSH server fixture (docs/verification/addhost-breakit2/netbird-fixture.go, owned container): public-key auth succeeds, then the session prints `User authentication failed` and exits 1 for a user that does not exist. The client therefore sees a failed *command*, not a failed sign-in; `classify` only looks for auth text when the SSH connection itself failed, and attaches the channel boundary before the exit status is set, hence "The SSH command channel failed". Item 3 cause from the code: inspection finds the complete install of the removed host (e7cea95c…); the installer's owner/unit checks require the *new* host id and exit 71, which is classified as a channel failure with no Start fresh. Plan: a complete install whose host id is a revoked record of the same owner/mode/uid is "left from an earlier add" → paused with Replace (the existing start-fresh challenge), then the normal staged transaction swaps it to the new identity (old identity.json dropped, sessions/state kept); an id this server never issued is refused plainly, never removed. Item 2: default the account to the last one used for that address.

kayg commented

2026-10-17 08:49:47 +00:00

Author

Owner

Owner-approved manual cleanup of minipc01 (2026-10-17 ~14:30 IST) so they can test mesh path switching today; infraternal-dev stays untouched as the acceptance test for #231. Done via monitor01 → NetBird SSH root@minipc01: stopped+disabled infraternal-agent.service, stopped its session scope, removed /etc/systemd/system/infraternal-agent.service, deleted device infraternal0 and nft table inet infraternal_mesh, removed /var/lib/infraternal. After: agent inactive, no dir, no device, no infraternal processes, 0 nft tables.

kayg commented

2026-10-17 09:13:53 +00:00

Author

Owner

Progress (uncommitted, gates running):

No account — failing first: missing_account_after_key_acceptance_is_a_sign_in_failure and missing_account_stops_before_any_local_secret_is_loaded (red: the refusal was an install/channel failure and every other credential would have been tried). Fix: only a whole stderr of exactly User authentication failed after a channel opened becomes auth with unknown_account; any other command output keeps its classification. Auto sign-in stops instead of trying server key / user key / password. The wizard names it: "There's no account named kayg on minipc01. Sign in as an account that exists there, for example root." (no retry button: every credential would hit the same missing account). OpenSSH's "Permission denied" was already a sign-in failure at connection setup; it cannot tell a missing account from a wrong key, so it keeps its existing wording.
Default account — finding, not fixed yet: in this tree the wizard sends only an explicit user@ or the discovery row's user, and the server has no discovery route, so no product code here picks "kayg". The server does keep the last account in remote_host_bootstrap.address of the removed record. Proposal: the bootstrap check returns that account for a bare host and the wizard pre-fills it. Waiting for where the "kayg" default actually comes from in the owner's flow before building it.
Install left by a removed host (rootful, unit # infraternal bootstrap e7cea95c…, agent still running) — failing first: install_left_by_a_removed_host_pauses_for_replace_then_takes_a_new_identity (red: "The installed host identity does not match this server and execution account.", both modes) and install_with_an_identity_this_server_never_issued_is_refused_untouched. Fix: inspection already finds the complete install; the server classifies its id: live record → same-identity replacement (#231); revoked record of the same owner/mode/account → paused with "minipc01 still has infraternal from when it was added before. Replace it to continue." and a Replace button; unknown id → plain refusal, nothing touched. After Replace, the owner marker and the unit marker line are rewritten from the removed id to the new one (both must match exactly, no setup in flight), then the ordinary staged upgrade stops the old service, keeps sessions/state, drops only the revoked identity.json, enrolls the new identity and restarts. The removed record stays revoked. The real SSH/systemd oracle gains this phase (live root PTY kept, one live record, unit marker = new id) for both modes.

Not covered: why removal from the canvas did not uninstall (D273); that is the removal path, separate from re-add.

account-red.log
removed-red.log
ui-red.log
account-green.log
removed-green.log

Progress (uncommitted, gates running): 1. **No account** — failing first: `missing_account_after_key_acceptance_is_a_sign_in_failure` and `missing_account_stops_before_any_local_secret_is_loaded` (red: the refusal was an install/channel failure and every other credential would have been tried). Fix: only a whole stderr of exactly `User authentication failed` after a channel opened becomes `auth` with `unknown_account`; any other command output keeps its classification. Auto sign-in stops instead of trying server key / user key / password. The wizard names it: "There's no account named kayg on minipc01. Sign in as an account that exists there, for example root." (no retry button: every credential would hit the same missing account). OpenSSH's "Permission denied" was already a sign-in failure at connection setup; it cannot tell a missing account from a wrong key, so it keeps its existing wording. 2. **Default account** — finding, not fixed yet: in this tree the wizard sends only an explicit `user@` or the discovery row's `user`, and the server has no discovery route, so no product code here picks "kayg". The server does keep the last account in `remote_host_bootstrap.address` of the removed record. Proposal: the bootstrap check returns that account for a bare host and the wizard pre-fills it. Waiting for where the "kayg" default actually comes from in the owner's flow before building it. 3. **Install left by a removed host** (rootful, unit `# infraternal bootstrap e7cea95c…`, agent still running) — failing first: `install_left_by_a_removed_host_pauses_for_replace_then_takes_a_new_identity` (red: "The installed host identity does not match this server and execution account.", both modes) and `install_with_an_identity_this_server_never_issued_is_refused_untouched`. Fix: inspection already finds the complete install; the server classifies its id: live record → same-identity replacement (#231); **revoked record of the same owner/mode/account → paused with "minipc01 still has infraternal from when it was added before. Replace it to continue." and a Replace button**; unknown id → plain refusal, nothing touched. After Replace, the owner marker and the unit marker line are rewritten from the removed id to the new one (both must match exactly, no setup in flight), then the ordinary staged upgrade stops the old service, keeps sessions/state, drops only the revoked identity.json, enrolls the new identity and restarts. The removed record stays revoked. The real SSH/systemd oracle gains this phase (live root PTY kept, one live record, unit marker = new id) for both modes. Not covered: why removal from the canvas did not uninstall (D273); that is the removal path, separate from re-add. [account-red.log](https://git.kayg.org/attachments/edff6d2c-f4d1-482a-b4cd-2f4cae8cfab0) [removed-red.log](https://git.kayg.org/attachments/1eae7089-b585-41a6-abee-d279a840f9fb) [ui-red.log](https://git.kayg.org/attachments/67d9cc17-d921-43dc-bf47-13cbc6eb4ed6) [account-green.log](https://git.kayg.org/attachments/b990b020-25c6-4ec3-ae8e-25a5ea4a0001) [removed-green.log](https://git.kayg.org/attachments/a8d8e0d3-f789-46a3-abdc-9805ebafe351)

kayg referenced this issue

2026-10-17 11:58:33 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg referenced this issue

2026-10-17 12:39:48 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-17 13:10:19 +00:00

Author

Owner

Committed and pushed on addhost-readd:

b84f2205f fix(ssh): a missing account after the key is accepted is a sign-in failure
93d71ae5d fix(bootstrap): replace an install left by a removed host under a new identity
0a7a2a5a7 fix(ui): name the missing account, and offer Replace for an earlier install
8616bf3c6 docs(verification): the re-add oracle also covers a removed host's leftover install

Real SSH/systemd evidence for item 3 (owned containers; perf VM, bench lock): after removal revoked the record while the agent, unit and a live PTY stayed, re-add paused with earlier_install, Replace finished with a new host id, owner and unit markers naming it, one live record, original shim PID kept. Root 1,737 ms and 1,647 ms; rootless 1,450 ms (logs on #231). Locally the same phase passed in both modes.

Not done: item 2 (default account) needs the source of the "kayg" default first (see above). Removal not uninstalling (D273) is the removal path, not investigated here. The mesh device left by the old rootful agent on minipc01 is adopted by the replacement only if the kept mesh state is bound to that device's key (#231 rule); otherwise mesh reports Blocked instead of reusing it. No browser screenshots of the new wording yet.

Committed and pushed on addhost-readd: - b84f2205f fix(ssh): a missing account after the key is accepted is a sign-in failure - 93d71ae5d fix(bootstrap): replace an install left by a removed host under a new identity - 0a7a2a5a7 fix(ui): name the missing account, and offer Replace for an earlier install - 8616bf3c6 docs(verification): the re-add oracle also covers a removed host's leftover install Real SSH/systemd evidence for item 3 (owned containers; perf VM, bench lock): after removal revoked the record while the agent, unit and a live PTY stayed, re-add paused with `earlier_install`, Replace finished with a new host id, owner and unit markers naming it, one live record, original shim PID kept. Root 1,737 ms and 1,647 ms; rootless 1,450 ms (logs on #231). Locally the same phase passed in both modes. Not done: item 2 (default account) needs the source of the "kayg" default first (see above). Removal not uninstalling (D273) is the removal path, not investigated here. The mesh device left by the old rootful agent on minipc01 is adopted by the replacement only if the kept mesh state is bound to that device's key (#231 rule); otherwise mesh reports Blocked instead of reusing it. No browser screenshots of the new wording yet.

kayg commented

2026-10-17 14:43:08 +00:00

Author

Owner

Starting the removal-does-not-uninstall part (D273) as a production fix. Branch remove-uninstall, base origin/release-prod-live 3048580c1.

Plan: failing test first for the panic path (uninstall action called from the plain node-plugins OS thread, which has no async runtime), fix so the handoff never needs an ambient runtime, add the missing mesh teardown (kernel interface + owned nft table outlive the agent process), make the server report the removal outcome plainly, and a real-binary removal/re-add run in an owned disposable systemd container for rootless and rootful. minipc01 and production are not touched.

Starting the removal-does-not-uninstall part (D273) as a production fix. Branch `remove-uninstall`, base `origin/release-prod-live` 3048580c1. Plan: failing test first for the panic path (uninstall action called from the plain `node-plugins` OS thread, which has no async runtime), fix so the handoff never needs an ambient runtime, add the missing mesh teardown (kernel interface + owned nft table outlive the agent process), make the server report the removal outcome plainly, and a real-binary removal/re-add run in an owned disposable systemd container for rootless and rootful. minipc01 and production are not touched.

kayg commented

2026-10-17 15:18:10 +00:00

Author

Owner

Findings (branch remove-uninstall):

Root cause of the panic. remote.host.uninstall runs on the synchronous node-plugins OS thread (no async runtime) and started systemd-run with the runtime's process type. Spawn registers the child with the runtime's process driver and panics after the OS process already started. So the launcher ran with its plan pipe closed, the helper read no plan and exited 1, the plugin worker thread died, and the server got a failed call. Red test uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime:

thread '<unnamed>' panicked at /cargo/tokio-1.53.2/src/process/unix/mod.rs:373:5:
there is no reactor running, must be called from the context of a Tokio 1.x runtime
test uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime ... FAILED

Second blocker, found by the real-binary run (rootless, owned systemd container). With the panic fixed, the host accepted (REMOVAL breakit2 host_cleanup=requested) but nothing was removed. systemd-run --user --pipe and --wait both need the per-user bus. Hosts without a user bus (no dbus-user-session, as in the fixture image and many minimal servers) refuse with Failed to connect to user scope bus via local transport. Plain systemd-run --user works over the manager's private socket. Fix: the plan goes into a private 0600 file inside the installation, and the launcher starts without --pipe/--wait. A dropped reply removes the plan.
Mesh leftovers. Uninstall never removed infraternal0 or inet infraternal_mesh. Both are kernel state that outlives the daemon by design (this matches minipc01). Uninstall now removes both after the service stops and before any file is removed.
Server wording. A failed uninstall showed a 12 s neutral toast that did not name the host. It now says " was removed here, but infraternal is still installed on it." as a dismissible caution toast with a "Copy commands" action. The CLI message includes the exact commands.
Follow-up, not fixed here: any panic in a node plugin call kills the node-plugins worker for the rest of the process. After that, every node action on that host fails until restart.

Findings (branch `remove-uninstall`): 1. **Root cause of the panic.** `remote.host.uninstall` runs on the synchronous `node-plugins` OS thread (no async runtime) and started `systemd-run` with the runtime's process type. Spawn registers the child with the runtime's process driver and panics after the OS process already started. So the launcher ran with its plan pipe closed, the helper read no plan and exited 1, the plugin worker thread died, and the server got a failed call. Red test `uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime`: ``` thread '<unnamed>' panicked at /cargo/tokio-1.53.2/src/process/unix/mod.rs:373:5: there is no reactor running, must be called from the context of a Tokio 1.x runtime test uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime ... FAILED ``` 2. **Second blocker, found by the real-binary run (rootless, owned systemd container).** With the panic fixed, the host accepted (`REMOVAL breakit2 host_cleanup=requested`) but nothing was removed. `systemd-run --user --pipe` and `--wait` both need the per-user bus. Hosts without a user bus (no dbus-user-session, as in the fixture image and many minimal servers) refuse with `Failed to connect to user scope bus via local transport`. Plain `systemd-run --user` works over the manager's private socket. Fix: the plan goes into a private 0600 file inside the installation, and the launcher starts without `--pipe`/`--wait`. A dropped reply removes the plan. 3. **Mesh leftovers.** Uninstall never removed `infraternal0` or `inet infraternal_mesh`. Both are kernel state that outlives the daemon by design (this matches minipc01). Uninstall now removes both after the service stops and before any file is removed. 4. **Server wording.** A failed uninstall showed a 12 s neutral toast that did not name the host. It now says "<host> was removed here, but infraternal is still installed on it." as a dismissible caution toast with a "Copy commands" action. The CLI message includes the exact commands. 5. Follow-up, not fixed here: any panic in a node plugin call kills the `node-plugins` worker for the rest of the process. After that, every node action on that host fails until restart.

kayg commented

2026-10-17 16:49:26 +00:00

Author

Owner

Finished on remove-uninstall. Head is 8e6c0eab64f7c48a92209ab0120b690163959dc5 (base release-prod-live 3048580c1), pushed. Not merged and not deployed.

Commits:

5c73feba5 fix(remote): start the uninstall handoff without an async runtime
6304ce604 fix(uninstall): remove the mesh interface and packet filter with the host
bb09ae0b3 fix(removal): say plainly when a removed host still has infraternal
fde559668 fix(remote): hand the uninstall plan over without the per-user bus
b2588a3a8 test(removal): prove on a real host that removal leaves nothing and re-adds
3ae83f62a refactor(removal): move the removal outcome wording into its own function
8e6c0eab6 build: ratchet static size caps

Real-binary removal. Owned disposable systemd container, real SSH, the real static binary, measure.py --remove, then a re-add on the same container. For root, the marked infraternal0 and inet infraternal_mesh were placed before removal.

rootless: REMOVAL breakit2 host_cleanup=requested
REMOVED mode=rootless unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False
re-add: METRIC breakit2 event=Done cumulative_ms=1164 / PROOF installed_full_sha256_matches=true
root: SEEDED mesh_link_present=True mesh_table_present=True
REMOVAL breakit2 host_cleanup=requested
REMOVED mode=root unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False
re-add: METRIC breakit2 event=Done cumulative_ms=1175 / PROOF installed_full_sha256_matches=true

Negative evidence from the first rootless run (panic fixed, plan still sent with --pipe): REMOVED mode=rootless unit_active=active ... data_present=True .... That run is what found the per-user bus blocker.

Size (D243). x86_64 21,090,448 → 21,084,688 (−5,760). Base measured from a static build of 3048580c1 on this host, and it matched the cap exactly. aarch64 cap 19,316,264 → 19,311,064 (−5,200). Its base was not built separately; the delta is against the cap.

scripts/verify fast (exit 0):

| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
PT_INTERP: absent; size: 21084688 bytes; cap: 21084688 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19311064 bytes; cap: 19311064 bytes; delta: +0 bytes
TypeScript protocol tests: 37 pass, 0 fail

Not done:

No browser screenshot of the new leftover toast.
An accepted uninstall is reported as "uninstalling itself". The server gets no later confirmation once the helper has stopped the service.
A panic in any node plugin still kills the node-plugins worker.
The owner's minipc01 was cleaned by hand earlier and was not touched.

Finished on `remove-uninstall`. Head is `8e6c0eab64f7c48a92209ab0120b690163959dc5` (base release-prod-live 3048580c1), pushed. Not merged and not deployed. Commits: - 5c73feba5 fix(remote): start the uninstall handoff without an async runtime - 6304ce604 fix(uninstall): remove the mesh interface and packet filter with the host - bb09ae0b3 fix(removal): say plainly when a removed host still has infraternal - fde559668 fix(remote): hand the uninstall plan over without the per-user bus - b2588a3a8 test(removal): prove on a real host that removal leaves nothing and re-adds - 3ae83f62a refactor(removal): move the removal outcome wording into its own function - 8e6c0eab6 build: ratchet static size caps **Real-binary removal.** Owned disposable systemd container, real SSH, the real static binary, `measure.py --remove`, then a re-add on the same container. For root, the marked `infraternal0` and `inet infraternal_mesh` were placed before removal. ``` rootless: REMOVAL breakit2 host_cleanup=requested REMOVED mode=rootless unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False re-add: METRIC breakit2 event=Done cumulative_ms=1164 / PROOF installed_full_sha256_matches=true root: SEEDED mesh_link_present=True mesh_table_present=True REMOVAL breakit2 host_cleanup=requested REMOVED mode=root unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False re-add: METRIC breakit2 event=Done cumulative_ms=1175 / PROOF installed_full_sha256_matches=true ``` Negative evidence from the first rootless run (panic fixed, plan still sent with `--pipe`): `REMOVED mode=rootless unit_active=active ... data_present=True ...`. That run is what found the per-user bus blocker. **Size (D243).** x86_64 21,090,448 → 21,084,688 (−5,760). Base measured from a static build of 3048580c1 on this host, and it matched the cap exactly. aarch64 cap 19,316,264 → 19,311,064 (−5,200). Its base was not built separately; the delta is against the cap. **`scripts/verify fast`** (exit 0): ``` | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | PT_INTERP: absent; size: 21084688 bytes; cap: 21084688 bytes; delta: +0 bytes PT_INTERP: absent; size: 19311064 bytes; cap: 19311064 bytes; delta: +0 bytes TypeScript protocol tests: 37 pass, 0 fail ``` Not done: - No browser screenshot of the new leftover toast. - An accepted uninstall is reported as "uninstalling itself". The server gets no later confirmation once the helper has stopped the service. - A panic in any node plugin still kills the `node-plugins` worker. - The owner's minipc01 was cleaned by hand earlier and was not touched.

kayg commented

2026-10-17 16:55:09 +00:00

Author

Owner

Break-it review started (Claude Opus, independent): branch review-remove-uninstall from origin/remove-uninstall at 8e6c0eab6 (base release-prod-live 3048580c1). Focus: plan-file planting/races, Node::retire ownership, rootful/rootless paths, re-add during the helper, offline host, and the "Copy commands" text. Disposable containers only.

Break-it review started (Claude Opus, independent): branch `review-remove-uninstall` from `origin/remove-uninstall` at 8e6c0eab6 (base release-prod-live 3048580c1). Focus: plan-file planting/races, `Node::retire` ownership, rootful/rootless paths, re-add during the helper, offline host, and the "Copy commands" text. Disposable containers only.

kayg commented

2026-10-17 18:12:13 +00:00

Author

Owner

Break-it review: remove-uninstall (#235)

Reviewer: Claude Opus (independent). Reviewed origin/remove-uninstall 8e6c0eab6 (base 3048580c1).
Review branch: review-remove-uninstall @ ec8615efc (failing tests only, no fixes).

P1-1 Node::retire deletes a marked infraternal0 this installation never made

crates/plugins/mesh/src/node.rs retire: if Device::owned()? { Device::delete()? }. The marker
infraternal.mesh.v1 is per component, not per installation. The server machine joins its own mesh
through its embedded infraternal agent (D239), and mesh up/up make the same marked name. A bootstrap
install there whose state never recorded a node (no mesh-public.json) still deletes it on uninstall,
cutting the server off its mesh (D215). Same for the nft table.
Test: crates/plugins/mesh/tests/review_retire_ownership.rs::retire_leaves_a_marked_interface_this_installation_never_recorded — FAILS.

P1-2 A foreign infraternal0 aborts the uninstall after the service is already stopped

Device::owned() -> Err(AlreadyExists) for an unmarked interface; cleanup calls retire_kernel after
systemctl disable --now. Result: agent stopped+disabled, every file kept, server already revoked the
record and said "...is uninstalling itself" with no Copy commands. This is the infraternal-dev case.
Re-add then fails with exit 71 "An existing folder ... wasn't created by infraternal setup"
(ssh/src/install.rs:1199: old .bootstrap-owner != new host id). A foreign object is not ours: leave it
and continue, or check ownership before stopping the service.
Test: retire_leaves_a_foreign_interface_without_failing_the_uninstall — FAILS (Err(Kind(AlreadyExists))).

P2-3 retire deletes our interface, then refuses a foreign table

Test: retire_checks_every_object_before_deleting_any — FAILS (half-done uninstall).

P1-4 "Copy commands" delete by name, not by ownership (remote_removal.rs::manual_uninstall, new here)

rootful ip link delete infraternal0; nft delete table inet infraternal_mesh unconditionally: on
infraternal-dev it deletes the foreign link with the server's address, which the automatic path refuses.
rm -rf ~/.local/share/infraternal / /var/lib/infraternal with no .bootstrap-owner check. Offered for
every "unreachable" host, including hosts joined without bootstrap (plugin not registered -> call fails).
~/.local/share/infraternal is the XDG parent of the server CA (remote_startup.rs default_ca_dir ->
infraternal/ca) and joined-node data (remote.rs default_data -> infraternal/agent).
systemctl [--user] stop 'infraternal-session-*.scope' stops every infraternal session on that manager
(names per session, sessions.rs:539), incl. the server's embedded agent; automatic cleanup only retires
its own shims.
; chaining: rm -rf runs even if disable failed. iptables fallback chains (IFM_*, raw guard) not removed.
No secrets; quoting fine.
Tests: crates/infraternal-server/src/remote_removal_review_tests.rs (3) — FAIL.

P2-5 "accepted" precedes the launch; launch failure is silent and leaves the plan

after_write ignores systemd-run's exit. If it fails the owner was already told "uninstalling itself".
Test: crates/plugins/remote/src/uninstall.rs::review_failed_launcher_leaves_no_plan — FAILS.

P2-6 Re-add during the helper (no test; needs a real manager)

No lock between the helper's final validate and remove_dir_all(base) vs. a concurrent bootstrap; an early
re-add gets the misleading exit 71, a late one can lose its new unit/base.

Held

Plan planting: same-uid only (0700 base); write_plan unlinks then O_EXCL|O_NOFOLLOW 0600; take_plan
refuses symlink/foreign uid/oversize and unlinks only the link; all paths recomputed in layout(), host must
equal .bootstrap-owner -> a planted/stale plan can only target the same installation.
Test review_planted_plan_is_never_followed — passes.
retire gets context.sessions (= agent --state), where mesh-public.json lives. Correct.
Rootless never touches netlink/nft (euid 0 gate).
Offline host: "unreachable", named message, manual set (but P1-4).
Pre-existing: up to 128 sessions x 2 s shim retirement exceeds RuntimeMaxSec=30.

Evidence: ~/.cache/codex-scratch/review-remove-uninstall/{mesh-tests.log,lib-tests.log,server-tests.log,verify.log}

# Break-it review: remove-uninstall (#235) Reviewer: Claude Opus (independent). Reviewed origin/remove-uninstall 8e6c0eab6 (base 3048580c1). Review branch: review-remove-uninstall @ ec8615efc (failing tests only, no fixes). ## P1-1 Node::retire deletes a marked infraternal0 this installation never made crates/plugins/mesh/src/node.rs retire: `if Device::owned()? { Device::delete()? }`. The marker infraternal.mesh.v1 is per component, not per installation. The server machine joins its own mesh through its embedded infraternal agent (D239), and `mesh up`/`up` make the same marked name. A bootstrap install there whose state never recorded a node (no mesh-public.json) still deletes it on uninstall, cutting the server off its mesh (D215). Same for the nft table. Test: crates/plugins/mesh/tests/review_retire_ownership.rs::retire_leaves_a_marked_interface_this_installation_never_recorded — FAILS. ## P1-2 A foreign infraternal0 aborts the uninstall after the service is already stopped Device::owned() -> Err(AlreadyExists) for an unmarked interface; cleanup calls retire_kernel after `systemctl disable --now`. Result: agent stopped+disabled, every file kept, server already revoked the record and said "...is uninstalling itself" with no Copy commands. This is the infraternal-dev case. Re-add then fails with exit 71 "An existing folder ... wasn't created by infraternal setup" (ssh/src/install.rs:1199: old .bootstrap-owner != new host id). A foreign object is not ours: leave it and continue, or check ownership before stopping the service. Test: retire_leaves_a_foreign_interface_without_failing_the_uninstall — FAILS (Err(Kind(AlreadyExists))). ## P2-3 retire deletes our interface, then refuses a foreign table Test: retire_checks_every_object_before_deleting_any — FAILS (half-done uninstall). ## P1-4 "Copy commands" delete by name, not by ownership (remote_removal.rs::manual_uninstall, new here) - rootful `ip link delete infraternal0; nft delete table inet infraternal_mesh` unconditionally: on infraternal-dev it deletes the foreign link with the server's address, which the automatic path refuses. - `rm -rf ~/.local/share/infraternal` / `/var/lib/infraternal` with no .bootstrap-owner check. Offered for every "unreachable" host, including hosts joined without bootstrap (plugin not registered -> call fails). ~/.local/share/infraternal is the XDG parent of the server CA (remote_startup.rs default_ca_dir -> infraternal/ca) and joined-node data (remote.rs default_data -> infraternal/agent). - `systemctl [--user] stop 'infraternal-session-*.scope'` stops every infraternal session on that manager (names per session, sessions.rs:539), incl. the server's embedded agent; automatic cleanup only retires its own shims. - `;` chaining: rm -rf runs even if disable failed. iptables fallback chains (IFM_*, raw guard) not removed. No secrets; quoting fine. Tests: crates/infraternal-server/src/remote_removal_review_tests.rs (3) — FAIL. ## P2-5 "accepted" precedes the launch; launch failure is silent and leaves the plan after_write ignores systemd-run's exit. If it fails the owner was already told "uninstalling itself". Test: crates/plugins/remote/src/uninstall.rs::review_failed_launcher_leaves_no_plan — FAILS. ## P2-6 Re-add during the helper (no test; needs a real manager) No lock between the helper's final validate and remove_dir_all(base) vs. a concurrent bootstrap; an early re-add gets the misleading exit 71, a late one can lose its new unit/base. ## Held - Plan planting: same-uid only (0700 base); write_plan unlinks then O_EXCL|O_NOFOLLOW 0600; take_plan refuses symlink/foreign uid/oversize and unlinks only the link; all paths recomputed in layout(), host must equal .bootstrap-owner -> a planted/stale plan can only target the same installation. Test review_planted_plan_is_never_followed — passes. - retire gets context.sessions (= agent --state), where mesh-public.json lives. Correct. - Rootless never touches netlink/nft (euid 0 gate). - Offline host: "unreachable", named message, manual set (but P1-4). - Pre-existing: up to 128 sessions x 2 s shim retirement exceeds RuntimeMaxSec=30. Evidence: ~/.cache/codex-scratch/review-remove-uninstall/{mesh-tests.log,lib-tests.log,server-tests.log,verify.log}

kayg commented

2026-10-17 18:32:33 +00:00

Author

Owner

Break-it review finished. Review branch review-remove-uninstall head 42f70187b (3 test commits on 8e6c0eab6). Findings: comment above.

Failing tests: mesh review_retire_ownership 3/3 FAIL (root in a disposable netns container); remote review_failed_launcher_leaves_no_plan FAIL, review_planted_plan_is_never_followed passes; server remote_removal_review_tests 3/3 FAIL.

scripts/verify fast (on ec8615efc; clippy fail was my test doc backticks, fixed in 42f70187b, cargo clippy --workspace --all-targets --locked -- -D warnings now clean; test fails on the review tests by design):


+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | FAIL (101)   |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Verdict: HOLD — P1: 3 (retire deletes a marked infraternal0 it never made; foreign infraternal0 aborts uninstall after the service is stopped; Copy commands delete by name / rm -rf the XDG parent / stop every session scope), P2: 3 (half-done retire on foreign table; silent launch failure after "accepted" leaves the plan; re-add race), P3: 0.

Break-it review finished. Review branch `review-remove-uninstall` head 42f70187b (3 test commits on 8e6c0eab6). Findings: comment above. Failing tests: mesh `review_retire_ownership` 3/3 FAIL (root in a disposable netns container); remote `review_failed_launcher_leaves_no_plan` FAIL, `review_planted_plan_is_never_followed` passes; server `remote_removal_review_tests` 3/3 FAIL. `scripts/verify fast` (on ec8615efc; clippy fail was my test doc backticks, fixed in 42f70187b, `cargo clippy --workspace --all-targets --locked -- -D warnings` now clean; test fails on the review tests by design): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | FAIL (101) | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` **Verdict: HOLD** — P1: 3 (retire deletes a marked infraternal0 it never made; foreign infraternal0 aborts uninstall after the service is stopped; Copy commands delete by name / rm -rf the XDG parent / stop every session scope), P2: 3 (half-done retire on foreign table; silent launch failure after "accepted" leaves the plan; re-add race), P3: 0.

kayg commented

2026-10-17 18:38:31 +00:00

Author

Owner

Fixing the break-it review findings (Claude Opus): branch remove-uninstall, base 8e6c0eab6 with the review's failing tests cherry-picked (856e8305a, 21af1c3c2, f87bdf05e). Plan, one commit per finding:

P1-1 retire deletes only the interface/filter this installation's own mesh state records (its WireGuard public key, written ahead of creation), never by the generic marker alone.
P1-2 a foreign or unrecorded infraternal0/table is left and reported ("left because infraternal didn't create it here"); the agent and the helper check every kernel object before anything is disabled.
P1-3 "Copy commands" become one command that runs the installed binary's own ownership-checked uninstall (--bootstrap-uninstall <host>), offered only for bootstrap-installed hosts; the helper removes only setup's own entries in the base dir.
P2 retire plans before deleting; launcher failure is reported before "accepted" and leaves no plan; the helper holds setup's parent-directory lock so a concurrent re-add gets "Setup is already running".
Disposable containers only.

Fixing the break-it review findings (Claude Opus): branch `remove-uninstall`, base 8e6c0eab6 with the review's failing tests cherry-picked (856e8305a, 21af1c3c2, f87bdf05e). Plan, one commit per finding: - P1-1 retire deletes only the interface/filter this installation's own mesh state records (its WireGuard public key, written ahead of creation), never by the generic marker alone. - P1-2 a foreign or unrecorded infraternal0/table is left and reported ("left <name> because infraternal didn't create it here"); the agent and the helper check every kernel object before anything is disabled. - P1-3 "Copy commands" become one command that runs the installed binary's own ownership-checked uninstall (`--bootstrap-uninstall <host>`), offered only for bootstrap-installed hosts; the helper removes only setup's own entries in the base dir. - P2 retire plans before deleting; launcher failure is reported before "accepted" and leaves no plan; the helper holds setup's parent-directory lock so a concurrent re-add gets "Setup is already running". Disposable containers only.

kayg commented

2026-10-17 20:28:45 +00:00

Author

Owner

Evidence for the break-it fixes (branch remove-uninstall, local head 5a8e78e7a, not yet pushed).

Kernel ownership (disposable NET_ADMIN container, real WireGuard + nft), crates/plugins/mesh/tests/review_retire_ownership.rs: all 7 pass, including the review's three proofs:

retire_checks_every_object_before_deleting_any ok
retire_decides_every_object_and_leaves_a_foreign_table ok
retire_leaves_a_foreign_interface_without_failing_the_uninstall ok
retire_leaves_a_marked_interface_this_installation_never_recorded ok
retire_leaves_another_installations_interface_and_filter ok
retire_removes_the_interface_and_filter_this_installation_created ok
retire_with_a_record_leaves_a_foreign_interface_and_names_it ok

Real binary, real SSH, owned systemd container (measure.py --remove, then re-add). Root seeds a marked infraternal0 + inet infraternal_mesh this installation never recorded (as the server's own infraternal agent would own): they stay and are named; everything of the installation goes; re-add works (no exit 71).

# rootless-remove.log
METRIC breakit2 event=Done cumulative_ms=1631 message=The infraternal agent is ready.
REMOVAL breakit2 host_cleanup=requested left=[]
REMOVED mode=rootless unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False
# rootless-readd.log
METRIC breakit2 event=Done cumulative_ms=1272 message=The infraternal agent is ready.
PROOF installed_full_sha256_matches=true full_sha256=9745ddbae7c187e8e524983bde4dbad09de0269e5fd36f805dc128f8f72249e5
# root-remove.log
METRIC breakit2 event=Done cumulative_ms=2098 message=The infraternal agent is ready.
SEEDED mesh_link_present=True mesh_table_present=True
REMOVAL breakit2 host_cleanup=requested left=["infraternal0", "infraternal_mesh"]
REMOVED mode=root unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=True mesh_table_present=True
# root-readd.log
METRIC breakit2 event=Done cumulative_ms=1606 message=The infraternal agent is ready.
PROOF installed_full_sha256_matches=true full_sha256=9745ddbae7c187e8e524983bde4dbad09de0269e5fd36f805dc128f8f72249e5

Copied command, by hand on the same fixture (root install, seeded foreign objects):

owner=f7b1985980fd47dbb7103d3290d6e4c3
--- wrong host
infraternal was not removed: permission denied. It removes only the installation infraternal setup made for this host, as the account that installed it.
exit=1
agent=active owner_after=f7b1985980fd47dbb7103d3290d6e4c3
--- right host
Left infraternal0 because infraternal didn't create it here.
Left infraternal_mesh because infraternal didn't create it here.
infraternal was removed from this machine.
exit=0
agent=inactive
ls: cannot access '/var/lib/infraternal': No such file or directory
ls: cannot access '/usr/local/bin/infraternal': No such file or directory
ls: cannot access '/etc/systemd/system/infraternal-agent.service': No such file or directory
infraternal0     DOWN           <POINTOPOINT,NOARP> 
table inet infraternal_mesh

Payload for these runs: static x86_64 build of a9b6a1c89 (behaviour identical to the head; the later commit only changes how replies are encoded).

(The last two lines are the seeded foreign objects, left in place on purpose.)

Evidence for the break-it fixes (branch `remove-uninstall`, local head 5a8e78e7a, not yet pushed). **Kernel ownership (disposable NET_ADMIN container, real WireGuard + nft), crates/plugins/mesh/tests/review_retire_ownership.rs:** all 7 pass, including the review's three proofs: ``` retire_checks_every_object_before_deleting_any ok retire_decides_every_object_and_leaves_a_foreign_table ok retire_leaves_a_foreign_interface_without_failing_the_uninstall ok retire_leaves_a_marked_interface_this_installation_never_recorded ok retire_leaves_another_installations_interface_and_filter ok retire_removes_the_interface_and_filter_this_installation_created ok retire_with_a_record_leaves_a_foreign_interface_and_names_it ok ``` **Real binary, real SSH, owned systemd container (measure.py --remove, then re-add).** Root seeds a marked infraternal0 + inet infraternal_mesh this installation never recorded (as the server's own infraternal agent would own): they stay and are named; everything of the installation goes; re-add works (no exit 71). ``` # rootless-remove.log METRIC breakit2 event=Done cumulative_ms=1631 message=The infraternal agent is ready. REMOVAL breakit2 host_cleanup=requested left=[] REMOVED mode=rootless unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=False mesh_table_present=False # rootless-readd.log METRIC breakit2 event=Done cumulative_ms=1272 message=The infraternal agent is ready. PROOF installed_full_sha256_matches=true full_sha256=9745ddbae7c187e8e524983bde4dbad09de0269e5fd36f805dc128f8f72249e5 # root-remove.log METRIC breakit2 event=Done cumulative_ms=2098 message=The infraternal agent is ready. SEEDED mesh_link_present=True mesh_table_present=True REMOVAL breakit2 host_cleanup=requested left=["infraternal0", "infraternal_mesh"] REMOVED mode=root unit_active=inactive session_scopes=0 infraternal_processes=0 data_present=False unit_present=False launcher_present=False mesh_link_present=True mesh_table_present=True # root-readd.log METRIC breakit2 event=Done cumulative_ms=1606 message=The infraternal agent is ready. PROOF installed_full_sha256_matches=true full_sha256=9745ddbae7c187e8e524983bde4dbad09de0269e5fd36f805dc128f8f72249e5 ``` **Copied command, by hand on the same fixture (root install, seeded foreign objects):** ``` owner=f7b1985980fd47dbb7103d3290d6e4c3 --- wrong host infraternal was not removed: permission denied. It removes only the installation infraternal setup made for this host, as the account that installed it. exit=1 agent=active owner_after=f7b1985980fd47dbb7103d3290d6e4c3 --- right host Left infraternal0 because infraternal didn't create it here. Left infraternal_mesh because infraternal didn't create it here. infraternal was removed from this machine. exit=0 agent=inactive ls: cannot access '/var/lib/infraternal': No such file or directory ls: cannot access '/usr/local/bin/infraternal': No such file or directory ls: cannot access '/etc/systemd/system/infraternal-agent.service': No such file or directory infraternal0 DOWN <POINTOPOINT,NOARP> table inet infraternal_mesh ``` Payload for these runs: static x86_64 build of a9b6a1c89 (behaviour identical to the head; the later commit only changes how replies are encoded). (The last two lines are the seeded foreign objects, left in place on purpose.)

kayg commented

2026-10-17 21:14:30 +00:00

Author

Owner

Finished break-it fixes on remove-uninstall. Head 27a0a1e65d50e69724f27809579156dde973649d, pushed. Not merged, not deployed.

Commits (on 8e6c0eab6 + the review's three test commits):

856e8305a test(mesh): failing break-it proofs that host uninstall retires only its own kernel objects (#235)
21af1c3c2 test(remote): break-it probes for the uninstall plan handoff (#235)
f87bdf05e test(server): failing proofs that the removal Copy commands delete only this installation (#235)
7029b30a5 fix(mesh): uninstall retires only the interface this installation recorded (#235)
e783996af fix(uninstall): leave and name a foreign mesh object instead of failing halfway (#235)
668310084 fix(removal): the copied uninstall runs the host's own ownership-checked cleanup (#235)
2cdd8e950 fix(remote): report a failed uninstall launch instead of "accepted" (#235)
a9b6a1c89 fix(uninstall): hold setup's lock through removal so a re-add waits (#235)
c21757260 test(removal): the real-host removal leaves objects the install never recorded (#235)
23647282b perf(remote): write uninstall replies without a JSON value (#235, D243)
27a0a1e65 build: set static size caps to the #235 break-it fixes' binaries (#235, D243)

One line per finding:

P1-1: the node records its interface's WireGuard public key (mesh-interface.json, written before creation); retire deletes infraternal0 only when the live key matches, the filter only with a recorded frontend and no other node's live interface. The marker alone is not ownership.
P1-2/P2-3: Node::plan_retirement decides every object before any deletion; foreign or unrecorded objects are left and named ("Left because infraternal didn't create it here."), never an error. The infraternal agent checks before accepting and returns the names; the helper checks before it stops anything. Re-add after uninstall works (no exit 71).
P1-3: the copied text is one command, <launcher> --bootstrap-uninstall <host id>, running the same ownership-checked cleanup (.bootstrap-owner must name the host; own shells only; kernel objects by record, nft or iptables fallback; stops on first failure). Cleanup removes only setup's own entries in the base and keeps CA/joined-node data. Offered only for bootstrap-installed hosts.
P2-5: the launcher runs before the reply; a failure replies "failed" (server shows the command) and removes the staged plan; the plan is armed only after the reply is written.
P2-6: cleanup holds setup's parent-directory flock throughout; a concurrent re-add gets exit 73 "Setup is already running".

Size (D243): x86_64 21,099,024 (release-prod-live 21,090,448, +8,576); aarch64 19,321,960 (+5,696 vs the cap before 8e6c0eab6). Caps set to these in 27a0a1e65.

scripts/verify fast (exit 0):

| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

PT_INTERP: absent; size: 21099024 bytes; cap: 21099024 bytes; delta: +0 bytes
PT_INTERP: absent; size: 19321960 bytes; cap: 19321960 bytes; delta: +0 bytes
TypeScript protocol tests: 37 pass, 0 fail

Finished break-it fixes on `remove-uninstall`. Head `27a0a1e65d50e69724f27809579156dde973649d`, pushed. Not merged, not deployed. Commits (on 8e6c0eab6 + the review's three test commits): - 856e8305a test(mesh): failing break-it proofs that host uninstall retires only its own kernel objects (#235) - 21af1c3c2 test(remote): break-it probes for the uninstall plan handoff (#235) - f87bdf05e test(server): failing proofs that the removal Copy commands delete only this installation (#235) - 7029b30a5 fix(mesh): uninstall retires only the interface this installation recorded (#235) - e783996af fix(uninstall): leave and name a foreign mesh object instead of failing halfway (#235) - 668310084 fix(removal): the copied uninstall runs the host's own ownership-checked cleanup (#235) - 2cdd8e950 fix(remote): report a failed uninstall launch instead of "accepted" (#235) - a9b6a1c89 fix(uninstall): hold setup's lock through removal so a re-add waits (#235) - c21757260 test(removal): the real-host removal leaves objects the install never recorded (#235) - 23647282b perf(remote): write uninstall replies without a JSON value (#235, D243) - 27a0a1e65 build: set static size caps to the #235 break-it fixes' binaries (#235, D243) One line per finding: - P1-1: the node records its interface's WireGuard public key (mesh-interface.json, written before creation); retire deletes infraternal0 only when the live key matches, the filter only with a recorded frontend and no other node's live interface. The marker alone is not ownership. - P1-2/P2-3: Node::plan_retirement decides every object before any deletion; foreign or unrecorded objects are left and named ("Left <name> because infraternal didn't create it here."), never an error. The infraternal agent checks before accepting and returns the names; the helper checks before it stops anything. Re-add after uninstall works (no exit 71). - P1-3: the copied text is one command, `<launcher> --bootstrap-uninstall <host id>`, running the same ownership-checked cleanup (.bootstrap-owner must name the host; own shells only; kernel objects by record, nft or iptables fallback; stops on first failure). Cleanup removes only setup's own entries in the base and keeps CA/joined-node data. Offered only for bootstrap-installed hosts. - P2-5: the launcher runs before the reply; a failure replies "failed" (server shows the command) and removes the staged plan; the plan is armed only after the reply is written. - P2-6: cleanup holds setup's parent-directory flock throughout; a concurrent re-add gets exit 73 "Setup is already running". Size (D243): x86_64 21,099,024 (release-prod-live 21,090,448, +8,576); aarch64 19,321,960 (+5,696 vs the cap before 8e6c0eab6). Caps set to these in 27a0a1e65. `scripts/verify fast` (exit 0): ``` | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 21099024 bytes; cap: 21099024 bytes; delta: +0 bytes PT_INTERP: absent; size: 19321960 bytes; cap: 19321960 bytes; delta: +0 bytes TypeScript protocol tests: 37 pass, 0 fail ```

kayg commented

2026-10-17 21:20:20 +00:00

Author

Owner

Break-it delta review r2 (Opus) started.
Branch: review-remove-uninstall-r2, base origin/remove-uninstall 27a0a1e65.

Break-it delta review r2 (Opus) started. Branch: review-remove-uninstall-r2, base origin/remove-uninstall 27a0a1e65.

kayg commented

2026-10-18 03:40:20 +00:00

Author

Owner

Break-it delta review r2 (Opus): remove-uninstall @ `27a0a1e65`

Review branch review-remove-uninstall-r2 @ cf7698dba (failing tests only, no fixes). The kernel tests ran in a disposable container (--cap-add NET_ADMIN, host wireguard module).

Prior findings

P1-1 (marker ≠ ownership): FIXED for an installation that never recorded the interface. The test passes. The adopted case is still open: see R2-1.
P1-2 (a foreign object stops uninstall after the service stops): FIXED.
P2-3 (half-done retire): FIXED.
P1-4 (broad Copy commands): FIXED. The server now hands out one --bootstrap-uninstall <host> command, and only for hosts that infraternal setup installed. The 3 server tests pass.
P2-5 (launcher failure): FIXED (test passes). A smaller gap remains: P3-1.
P2-6 (re-add race): mostly FIXED. A smaller gap remains: P3-2.
All 7 kernel tests in review_retire_ownership.rs pass in the container.

P2 R2-1: the fallback to the coordinator-bound key also fires for an installation that adopted the interface

Node::restore adopts any marked infraternal0, and up() returns early once the node has an identity. So an adopting node never writes mesh-interface.json. plan_retirement falls back to local_key whenever that record is absent, not only for state written before the record existed. A node that adopted another installation's interface is bound to that installation's key, so its uninstall deletes the other installation's interface.
On one coordinator, the unique-key constraint should refuse the duplicate key. The case needs a machine that belongs to two servers, so it is P2.
crates/plugins/mesh/tests/review_r2_retire_adoption.rs::retire_leaves_an_interface_this_installation_only_adopted FAILS: "uninstall deleted an interface this installation only adopted (fallback to the bound key)".

P1, pre-existing and outside this delta (not counted) R2-2: restoring disabled intent deletes another installation's interface

Node::restore with enabled=false calls down() on any marked infraternal0 when the infraternal agent starts. With enabled=true it adopts the interface and applies its own config to it. This breaks the delta's assumption that two installations can share one machine. It needs its own issue.
review_r2_retire_adoption.rs::restoring_disabled_intent_leaves_another_installations_interface FAILS.

P2 R2-3: an interrupted removal can't be finished

cleanup unlinks the unit and the launcher before daemon-reload and the file removal. If it stops in between (RuntimeMaxSec=30, a failed reload, a reboot), the server has already said "uninstalling itself". The copied --bootstrap-uninstall <host> then refuses at validate because the unit is gone (NotFound). Re-adding the host exits 71 on the old .bootstrap-owner.
crates/plugins/remote/src/uninstall.rs::review_r2_an_interrupted_removal_can_be_finished FAILS (left: NotFound, right: Unsupported).

P3

Any helper failure after "accepted" is silent: setup holding the lock for more than 5 s, validate failing after stop, a shim timeout. The copied command is now safe, so the server could always offer it.
A re-add between "accepted" and the moment the helper takes the lock (take_plan waits up to 10 s) still gets exit 71, not 73.
A stale .bootstrap-acquiring keeps the base folder, and the report then says, wrongly, that it "holds files infraternal setup didn't create".

Held (the questions asked)

Planted or stale record: the record uses the same private-file writer and reader (0600, owner uid, O_NOFOLLOW), and the rootful state is root-only. A stale record doesn't match the live key, so the interface is left in place.
Upgrade from older state: a node that created its own interface is bound to its own key, so the fallback is correct. It is wrong only in the adopted case (R2-1).
Fallback matching the server's embedded interface: blocked on one coordinator by key uniqueness. Possible across two coordinators (R2-1).
Symlinks among setup's entries: they are unlinked, never followed, and validate refuses a symlinked base. The probe review_r2_symlinked_setup_entries_are_unlinked_not_followed passes.
--bootstrap-uninstall <host>: not setuid. It acts only on the caller's uid and base. The host id must be 32 lowercase hex characters, non-UTF-8 is refused, and the .bootstrap-owner gate applies. HOME only steers the caller's own rootless base, and root's base is fixed. No privilege boundary is crossed.
Lock ordering: no cycle. cleanup's flock fd is O_CLOEXEC. Setup closes fd 9 before it execs the long-running session (install.rs:590). Stopping the agent takes no lock. cleanup waits at most 5 s.

Gate (`scripts/verify fast`, head `cf7698dba`)

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

The test gate fails only on the new proof: uninstall::tests::review_r2_an_interrupted_removal_can_be_finished ... FAILED (83 passed, 1 failed). The kernel proofs are #[ignore]. Size delta is +0 bytes on both targets.

MERGE: P0 0, P1 0 in the delta (+1 pre-existing, R2-2), P2 2, P3 3. R2-2 and R2-3 should be queued as follow-ups.

## Break-it delta review r2 (Opus): remove-uninstall @ 27a0a1e65 Review branch `review-remove-uninstall-r2` @ cf7698dba (failing tests only, no fixes). The kernel tests ran in a disposable container (`--cap-add NET_ADMIN`, host wireguard module). ### Prior findings - P1-1 (marker ≠ ownership): FIXED for an installation that never recorded the interface. The test passes. The adopted case is still open: see R2-1. - P1-2 (a foreign object stops uninstall after the service stops): FIXED. - P2-3 (half-done retire): FIXED. - P1-4 (broad Copy commands): FIXED. The server now hands out one `--bootstrap-uninstall <host>` command, and only for hosts that infraternal setup installed. The 3 server tests pass. - P2-5 (launcher failure): FIXED (test passes). A smaller gap remains: P3-1. - P2-6 (re-add race): mostly FIXED. A smaller gap remains: P3-2. - All 7 kernel tests in `review_retire_ownership.rs` pass in the container. ### P2 R2-1: the fallback to the coordinator-bound key also fires for an installation that adopted the interface `Node::restore` adopts any marked `infraternal0`, and `up()` returns early once the node has an identity. So an adopting node never writes `mesh-interface.json`. `plan_retirement` falls back to `local_key` whenever that record is absent, not only for state written before the record existed. A node that adopted another installation's interface is bound to that installation's key, so its uninstall deletes the other installation's interface. On one coordinator, the unique-key constraint should refuse the duplicate key. The case needs a machine that belongs to two servers, so it is P2. `crates/plugins/mesh/tests/review_r2_retire_adoption.rs::retire_leaves_an_interface_this_installation_only_adopted` FAILS: "uninstall deleted an interface this installation only adopted (fallback to the bound key)". ### P1, pre-existing and outside this delta (not counted) R2-2: restoring disabled intent deletes another installation's interface `Node::restore` with `enabled=false` calls `down()` on any marked `infraternal0` when the infraternal agent starts. With `enabled=true` it adopts the interface and applies its own config to it. This breaks the delta's assumption that two installations can share one machine. It needs its own issue. `review_r2_retire_adoption.rs::restoring_disabled_intent_leaves_another_installations_interface` FAILS. ### P2 R2-3: an interrupted removal can't be finished cleanup unlinks the unit and the launcher before `daemon-reload` and the file removal. If it stops in between (`RuntimeMaxSec=30`, a failed reload, a reboot), the server has already said "uninstalling itself". The copied `--bootstrap-uninstall <host>` then refuses at `validate` because the unit is gone (NotFound). Re-adding the host exits 71 on the old `.bootstrap-owner`. `crates/plugins/remote/src/uninstall.rs::review_r2_an_interrupted_removal_can_be_finished` FAILS (left: NotFound, right: Unsupported). ### P3 1. Any helper failure after "accepted" is silent: setup holding the lock for more than 5 s, `validate` failing after stop, a shim timeout. The copied command is now safe, so the server could always offer it. 2. A re-add between "accepted" and the moment the helper takes the lock (`take_plan` waits up to 10 s) still gets exit 71, not 73. 3. A stale `.bootstrap-acquiring` keeps the base folder, and the report then says, wrongly, that it "holds files infraternal setup didn't create". ### Held (the questions asked) - **Planted or stale record:** the record uses the same private-file writer and reader (0600, owner uid, O_NOFOLLOW), and the rootful state is root-only. A stale record doesn't match the live key, so the interface is left in place. - **Upgrade from older state:** a node that created its own interface is bound to its own key, so the fallback is correct. It is wrong only in the adopted case (R2-1). - **Fallback matching the server's embedded interface:** blocked on one coordinator by key uniqueness. Possible across two coordinators (R2-1). - **Symlinks among setup's entries:** they are unlinked, never followed, and `validate` refuses a symlinked base. The probe `review_r2_symlinked_setup_entries_are_unlinked_not_followed` passes. - **`--bootstrap-uninstall <host>`:** not setuid. It acts only on the caller's uid and base. The host id must be 32 lowercase hex characters, non-UTF-8 is refused, and the `.bootstrap-owner` gate applies. HOME only steers the caller's own rootless base, and root's base is fixed. No privilege boundary is crossed. - **Lock ordering:** no cycle. cleanup's flock fd is O_CLOEXEC. Setup closes fd 9 before it execs the long-running session (install.rs:590). Stopping the agent takes no lock. cleanup waits at most 5 s. ### Gate (`scripts/verify fast`, head cf7698dba) ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` The test gate fails only on the new proof: `uninstall::tests::review_r2_an_interrupted_removal_can_be_finished ... FAILED` (83 passed, 1 failed). The kernel proofs are `#[ignore]`. Size delta is +0 bytes on both targets. **MERGE: P0 0, P1 0 in the delta (+1 pre-existing, R2-2), P2 2, P3 3.** R2-2 and R2-3 should be queued as follow-ups.

kayg referenced this issue

2026-10-18 06:37:17 +00:00

Scheduled ping closes a healthy host connection when the control queue is full #234

kayg referenced this issue

2026-10-18 06:37:17 +00:00

Add-host ridiculously fast: under 1.5 s local, under 4 s at 150 ms #189

kayg commented

2026-10-18 06:38:46 +00:00

Author

Owner

Release 2 deployed to production at 14:08 IST: release-prod-live 103815e70, server sha256 8608623e…, MainPID 86026, /healthz ok. Backup /var/backups/infraternal/20261018-083808-103815e70…. CA is locked after the restart until the owner unlocks it.

Release 2 deployed to production at 14:08 IST: release-prod-live 103815e70, server sha256 8608623e…, MainPID 86026, /healthz ok. Backup /var/backups/infraternal/20261018-083808-103815e70…. CA is locked after the restart until the owner unlocks it.

kayg referenced this issue

2026-10-18 18:55:39 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-18 19:01:27 +00:00

Author

Owner

Merge findings (#231/#235): production introduced early SSH session publication, shared enrollment shell templates and typed CLI presentation. Resolved the overlaps by keeping replacement on the normal staged service-swap path (no extra shell), retaining the revoked-identity drop in the shared join template, carrying both replacement/session fields, and publishing host_id only after the existing fresh authenticated probe. 50 focused add-host UI tests and TypeScript check pass. Rust checks found an obsolete status test API; repaired; lint/tests queued through build-slot.

Ownership follow-up contract: use production mesh-interface.json as the single local creation receipt. A coordinator binding or an empty interface is not proof of creation: an older installation may have adopted it, including across two independent servers. Without the local receipt leave/name the interface; do not mint a receipt during adoption. The same rule applies to disabled restore and uninstall. Add regression against two independent migrated MeshService databases and real kernel interface. No owner fixture access.

Removal follow-up: strict admission still checks all installed artifacts. Cleanup will accept absent artifacts under the matching private .bootstrap-owner, while validating every artifact still present. Keep the launcher through daemon-reload, skip disabling an already removed unit, make file removal retryable, and prove repeat cleanup plus foreign-artifact refusal. No foundation/dependency change.

Merge findings (#231/#235): production introduced early SSH session publication, shared enrollment shell templates and typed CLI presentation. Resolved the overlaps by keeping replacement on the normal staged service-swap path (no extra shell), retaining the revoked-identity drop in the shared join template, carrying both replacement/session fields, and publishing host_id only after the existing fresh authenticated probe. 50 focused add-host UI tests and TypeScript check pass. Rust checks found an obsolete status test API; repaired; lint/tests queued through build-slot. Ownership follow-up contract: use production mesh-interface.json as the single local creation receipt. A coordinator binding or an empty interface is not proof of creation: an older installation may have adopted it, including across two independent servers. Without the local receipt leave/name the interface; do not mint a receipt during adoption. The same rule applies to disabled restore and uninstall. Add regression against two independent migrated MeshService databases and real kernel interface. No owner fixture access. Removal follow-up: strict admission still checks all installed artifacts. Cleanup will accept absent artifacts under the matching private .bootstrap-owner, while validating every artifact still present. Keep the launcher through daemon-reload, skip disabling an already removed unit, make file removal retryable, and prove repeat cleanup plus foreign-artifact refusal. No foundation/dependency change.

kayg commented

2026-10-18 19:37:24 +00:00

Author

Owner

Committed/pushed production update 65bce9c5db (c00c6364e). Shipped migrations 0026/0027 are unchanged; unshipped replacement-key migration is now 0028. Gate: strict normal-feature Clippy, 13 migration +14 replacement tests, 4 naming +2 presence +6 store tests, TypeScript check +9 protocol tests all pass. receipt.

Six ownership regressions fail before their respective repairs, using real WireGuard interfaces in isolated user/network namespaces: two independent coordinators, plan/execution key replacement, second installation on/off, unmarked interface, live down, delayed configuration. Compile-only fixture mistakes were corrected before these red receipts; no host fixture was used.

R2-3 also has a second red: a closed shim socket returns ConnectionRefused and blocks retry. Repairs and forward/idempotence tests are implemented, gated next.

Compatibility choice: a legacy marked interface without a local creation receipt is unverifiable, including if its coordinator accepted that public key. It is left in place and reported Blocked, not silently adopted or deleted. This is required to preserve another installation across two servers; no private key, dependency or new background work is added.

Committed/pushed production update 65bce9c5dbec0e1dffeaa4da1291471c735fc12d (c00c6364e). Shipped migrations 0026/0027 are unchanged; unshipped replacement-key migration is now 0028. Gate: strict normal-feature Clippy, 13 migration +14 replacement tests, 4 naming +2 presence +6 store tests, TypeScript check +9 protocol tests all pass. [receipt](https://git.kayg.org/attachments/67c3ea2f-031b-4397-b954-4cadb91dc775). Six ownership regressions fail before their respective repairs, using real WireGuard interfaces in isolated user/network namespaces: [two independent coordinators](https://git.kayg.org/attachments/43d2c78d-2372-4733-ac4d-1895e0a07bb8), [plan/execution key replacement](https://git.kayg.org/attachments/4259a85c-3969-4466-a217-75e1574b5bed), [second installation on/off](https://git.kayg.org/attachments/9816540b-b4d6-4570-83ec-e8e01d0dc5e5), [unmarked interface](https://git.kayg.org/attachments/2021b988-9fd8-498b-9660-b4c567c25bbe), [live down](https://git.kayg.org/attachments/43dbf7a6-70af-4f81-8af2-0ab60adc8f76), [delayed configuration](https://git.kayg.org/attachments/f6c09420-ce72-4536-a8dd-44030d6d9c1d). Compile-only fixture mistakes were corrected before these red receipts; no host fixture was used. R2-3 also has a second red: [a closed shim socket returns ConnectionRefused and blocks retry](https://git.kayg.org/attachments/6f6d029a-1067-4951-b6c5-63ffd7ac10f8). Repairs and forward/idempotence tests are implemented, gated next. Compatibility choice: a legacy marked interface without a local creation receipt is unverifiable, including if its coordinator accepted that public key. It is left in place and reported Blocked, not silently adopted or deleted. This is required to preserve another installation across two servers; no private key, dependency or new background work is added.

kayg commented

2026-10-18 19:49:52 +00:00

Author

Owner

Completed/pushed logical module steps: resumable uninstall e17aa341c2; creation-key Mesh ownership e67438b365. Only addhost-readd pushed.

Gates: strict touched-crate all-target Clippy PASS; uninstall 16 passed/0 failed; Mesh lib 61 passed/0 failed/14 ignored; new ownership kernel regressions 6/6; server-address/own restart 2/2; route preservation 1/1; inherited retirement proofs 7/7. All kernel runs were isolated user/network namespaces and functional only, no build-host performance claim. The first inherited retirement run lacked nft on PATH and cascaded after setup failed; /usr/sbin was added for that fixture only, then all seven passed. complete partial gate including setup failure, corrected retirement run.

The uncommitted real-service oracle extension now finishes by stopping/disabling the fixture service, unlinking its checked unit/launcher, invoking the shipping binary to resume cleanup, repeating from the immutable fixture image and requiring every tracked service/shim PID gone. Its runner requires REMOVAL_RESUMED as well as the existing 20 re-add samples and removed-host Replace phase. Iteration gate + current static candidate build are queued/running; real SSH/systemd rerun, paired size and final fast gate remain. Perf VM preflight succeeded through NetBird; existing disposable image is available. No deployment or owner fixture access.

Completed/pushed logical module steps: resumable uninstall e17aa341c20528a0320222e6db29174f04eb307d; creation-key Mesh ownership e67438b365bc1d6be00c956e4431b360b6677a97. Only addhost-readd pushed. Gates: strict touched-crate all-target Clippy PASS; uninstall 16 passed/0 failed; Mesh lib 61 passed/0 failed/14 ignored; new ownership kernel regressions 6/6; server-address/own restart 2/2; route preservation 1/1; inherited retirement proofs 7/7. All kernel runs were isolated user/network namespaces and functional only, no build-host performance claim. The first inherited retirement run lacked nft on PATH and cascaded after setup failed; /usr/sbin was added for that fixture only, then all seven passed. [complete partial gate including setup failure](https://git.kayg.org/attachments/47c1c640-5148-4b92-af85-36b4810db310), [corrected retirement run](https://git.kayg.org/attachments/6c55760f-47e4-4800-9653-3c34d3272b2c). The uncommitted real-service oracle extension now finishes by stopping/disabling the fixture service, unlinking its checked unit/launcher, invoking the shipping binary to resume cleanup, repeating from the immutable fixture image and requiring every tracked service/shim PID gone. Its runner requires REMOVAL_RESUMED as well as the existing 20 re-add samples and removed-host Replace phase. Iteration gate + current static candidate build are queued/running; real SSH/systemd rerun, paired size and final fast gate remain. Perf VM preflight succeeded through NetBird; existing disposable image is available. No deployment or owner fixture access.

kayg commented

2026-10-18 20:50:28 +00:00

Author

Owner

Removal follow-up qualification (branch addhost-readd, current head 86fd93f8a; runtime fixes e17aa341c/e67438b36): both actual systemd modes passed interrupted --bootstrap-uninstall after the checked unit and launcher were already gone, plus a second cleanup/no-op and retained-shim/PID disappearance. The same runs passed 20 stale replacements per mode and revoked-host Replace under a new identity. Perf VM, 4 vCPU, CPUWeight 10000; exact containers absent, all four control PIDs gone.

R2-1 has a passing real-kernel/two-independent-coordinator regression. The second-installation on/off, unmarked interface, delayed config, cached down and detached-retirement cases also pass. Only a matching local creation receipt authorizes the interface; a coordinator binding is insufficient. The owner's infraternal-dev install/interface remain untouched. Size reduction and final full gate are still pending; this is not a completion claim.

rootless-service.log
rootless-summary.json
rootless-cleanup.json
root-service.log
root-summary.json
root-cleanup.json

Removal follow-up qualification (branch addhost-readd, current head 86fd93f8a; runtime fixes e17aa341c/e67438b36): both actual systemd modes passed interrupted --bootstrap-uninstall after the checked unit and launcher were already gone, plus a second cleanup/no-op and retained-shim/PID disappearance. The same runs passed 20 stale replacements per mode and revoked-host Replace under a new identity. Perf VM, 4 vCPU, CPUWeight 10000; exact containers absent, all four control PIDs gone. R2-1 has a passing real-kernel/two-independent-coordinator regression. The second-installation on/off, unmarked interface, delayed config, cached down and detached-retirement cases also pass. Only a matching local creation receipt authorizes the interface; a coordinator binding is insufficient. The owner's infraternal-dev install/interface remain untouched. Size reduction and final full gate are still pending; this is not a completion claim. [rootless-service.log](https://git.kayg.org/attachments/a2ac6354-03f7-440b-8722-f89502f653df) [rootless-summary.json](https://git.kayg.org/attachments/2cb64bc1-641c-43dc-8973-014a86a65a72) [rootless-cleanup.json](https://git.kayg.org/attachments/b4748693-b632-4360-9638-03ab6bb65dcb) [root-service.log](https://git.kayg.org/attachments/188c18b0-bd97-4eb1-acfb-88fab195ee3b) [root-summary.json](https://git.kayg.org/attachments/f2939f26-d094-4e73-92e2-d6d6f84dc8d4) [root-cleanup.json](https://git.kayg.org/attachments/19cda903-4370-4de5-a7c7-a55dfbf6d318)

kayg commented

2026-10-18 22:03:24 +00:00

Author

Owner

R2-3 real-service finding: the compact candidate again passed all 20 rootless replacements and revoked-host Replace, then its public removal phases showed --bootstrap-uninstall returning Broken pipe during shim retirement. Owned container and both control PIDs were gone.

A new real-Unix-socket regression fails before the fix: the authenticated peer sends Exited, then closes before ExitAck. A companion regression closes without Exited and must remain refused. The narrow fix accepts only closed-transport errors from the final ACK after authenticated Exited; all earlier errors still fail. All 18 uninstall tests pass, including both new cases. Source remains uncommitted pending shipping-feature Clippy and fresh real-service runs. Normal profiles and engines stay unchanged; the current pre-fix x86 candidate is within the 16-KiB size target.

round7-vm-run.log
final-ack-red2.log
final-ack-suite-green.log

R2-3 real-service finding: the compact candidate again passed all 20 rootless replacements and revoked-host Replace, then its public removal phases showed --bootstrap-uninstall returning Broken pipe during shim retirement. Owned container and both control PIDs were gone. A new real-Unix-socket regression fails before the fix: the authenticated peer sends Exited, then closes before ExitAck. A companion regression closes without Exited and must remain refused. The narrow fix accepts only closed-transport errors from the final ACK after authenticated Exited; all earlier errors still fail. All 18 uninstall tests pass, including both new cases. Source remains uncommitted pending shipping-feature Clippy and fresh real-service runs. Normal profiles and engines stay unchanged; the current pre-fix x86 candidate is within the 16-KiB size target. [round7-vm-run.log](https://git.kayg.org/attachments/d6627ca6-ca52-4690-95c2-ab9a612b1b18) [final-ack-red2.log](https://git.kayg.org/attachments/85cb46e4-1b9d-452b-96e1-cb00419001bc) [final-ack-suite-green.log](https://git.kayg.org/attachments/918da118-11fe-49f4-a0e5-18f78d16ac20)

kayg commented

2026-10-18 22:13:54 +00:00

Author

Owner

Completed/pushed dec8f7227: removal accepts a closed final ACK only after authenticated Exited. A peer closing before Exited stays refused; partial-frame read and periodic shell retirement behavior are unchanged. The Unix-peer regression failed before the fix, then all 18 uninstall tests passed. Current source also passes cargo fmt --check and cargo clippy --locked --workspace --all-targets -- -D warnings. The three SSH representation/JSON/clone tests pass. Fresh service-oracle/static binaries are building; actual 20x rootless + 20x rootful final qualification remains. No owner install or foreign device was touched.

Completed/pushed dec8f7227: removal accepts a closed final ACK only after authenticated Exited. A peer closing before Exited stays refused; partial-frame read and periodic shell retirement behavior are unchanged. The Unix-peer regression failed before the fix, then all 18 uninstall tests passed. Current source also passes cargo fmt --check and cargo clippy --locked --workspace --all-targets -- -D warnings. The three SSH representation/JSON/clone tests pass. Fresh service-oracle/static binaries are building; actual 20x rootless + 20x rootful final qualification remains. No owner install or foreign device was touched.

kayg commented

2026-10-18 22:26:01 +00:00

Author

Owner

Final real-service qualification PASS at source head 63b0c7a159, exact x86 artifact SHA256 8d5baaa84e32a981519f655edf59a30f7aa52feaa0c3b7afea3b03a355a903e4 (21,234,000 B). Named perf VM, 4 vCPU, scope/container CPUWeight 10000, separately locked per mode. Rootless 20/20: p50 2.950451 s, observed max 3.071849 s; load 0/0/0.129 -> 0.415/0.153/0.177. Rootful 20/20: p50 3.205159 s, observed max 3.269477 s; load 0.415/0.153/0.177 -> 0.885/0.354/0.245.

Both modes retain UUID/public key/state/PTY and prove the new MainPID executable with one live record after each one-shot-dial silent fixture. Both also pass revoked-host Replace, actual --bootstrap-uninstall with the unit and launcher already gone, repeated no-op cleanup, and all tracked shim/service PIDs gone. Rootless container 09bab4039a81cc8283febe345e117f0f037868a1def47878b0cfdaa545f891a0 absent; control PIDs 3404932/3405050 gone. Rootful container 6748f807da20049f8990f2bf9b75ea19a76a26426a1eb748116feb25ec5f2d40 absent; control PIDs 3409605/3409728 gone. No owner installation/device was accessed. The fixture is behavioral and padded to 20,333,104 B, not the historical executable. Optional fresh early-terminal full-image handoff remains the separately recorded pre-existing finding; this oracle exercises production staged replacement.

Author checklist update: reviewed unchanged flat failure JSON, separate UUID purposes and deep clone ownership; optional-facts cost is measured, no new dependency/profile. Final-ACK success requires authenticated Exited; early close remains refused by regression. Local creation marker plus live-key checks guard Mesh restore/config/down/retirement; two-server same-key regression and the other 15 kernel cases passed. Removal remains owner-scoped and verifies every present artifact, retains unrelated state, and retries idempotently. Browser production-build receipts are attached above for independent visual review. Prior author review covers authority, transactionality, additive migration and rollback.

scripts/verify fast is still waiting in the unmodified shared build-slot wrapper on this head. This is a completed service-proof step, not the final completion comment.

round8-vm-run.log
rootless-service.log
rootless-summary.json
rootless-cleanup.json
root-service.log
root-summary.json
root-cleanup.json

Final real-service qualification PASS at source head 63b0c7a1596d60e7afd747c404d85eba5142f613, exact x86 artifact SHA256 8d5baaa84e32a981519f655edf59a30f7aa52feaa0c3b7afea3b03a355a903e4 (21,234,000 B). Named perf VM, 4 vCPU, scope/container CPUWeight 10000, separately locked per mode. Rootless 20/20: p50 2.950451 s, observed max 3.071849 s; load 0/0/0.129 -> 0.415/0.153/0.177. Rootful 20/20: p50 3.205159 s, observed max 3.269477 s; load 0.415/0.153/0.177 -> 0.885/0.354/0.245. Both modes retain UUID/public key/state/PTY and prove the new MainPID executable with one live record after each one-shot-dial silent fixture. Both also pass revoked-host Replace, actual --bootstrap-uninstall with the unit and launcher already gone, repeated no-op cleanup, and all tracked shim/service PIDs gone. Rootless container 09bab4039a81cc8283febe345e117f0f037868a1def47878b0cfdaa545f891a0 absent; control PIDs 3404932/3405050 gone. Rootful container 6748f807da20049f8990f2bf9b75ea19a76a26426a1eb748116feb25ec5f2d40 absent; control PIDs 3409605/3409728 gone. No owner installation/device was accessed. The fixture is behavioral and padded to 20,333,104 B, not the historical executable. Optional fresh early-terminal full-image handoff remains the separately recorded pre-existing finding; this oracle exercises production staged replacement. Author checklist update: reviewed unchanged flat failure JSON, separate UUID purposes and deep clone ownership; optional-facts cost is measured, no new dependency/profile. Final-ACK success requires authenticated Exited; early close remains refused by regression. Local creation marker plus live-key checks guard Mesh restore/config/down/retirement; two-server same-key regression and the other 15 kernel cases passed. Removal remains owner-scoped and verifies every present artifact, retains unrelated state, and retries idempotently. Browser production-build receipts are attached above for independent visual review. Prior author review covers authority, transactionality, additive migration and rollback. scripts/verify fast is still waiting in the unmodified shared build-slot wrapper on this head. This is a completed service-proof step, not the final completion comment. [round8-vm-run.log](https://git.kayg.org/attachments/2a040abb-e8dd-4ab3-94de-afe4ea920aee) [rootless-service.log](https://git.kayg.org/attachments/ee682f20-a006-419a-b037-36ba500858e5) [rootless-summary.json](https://git.kayg.org/attachments/8e00c97c-0779-4459-a6ba-38ed70afe54f) [rootless-cleanup.json](https://git.kayg.org/attachments/a98149f0-3b4f-42cf-9f8b-9606ff71fa82) [root-service.log](https://git.kayg.org/attachments/01a3d854-d0a1-49aa-b776-16c6d634a2c9) [root-summary.json](https://git.kayg.org/attachments/a5b8641b-969a-419d-a699-9f42d0633f68) [root-cleanup.json](https://git.kayg.org/attachments/5cc699a8-0ea0-4479-ba34-ff7fb91c6048)

kayg commented

2026-10-18 23:07:33 +00:00

Author

Owner

Finished #235 follow-ups on addhost-readd, pushed head 63b0c7a159. No deployment and no owner live installation/interface access; issue stays open.

R2-1 / pre-existing second-installation P1: only this installation's local creation receipt matching the live interface key authorizes reuse or deletion. Coordinator-key and empty-device fallbacks are gone; restore/on/off/config/retirement preserve and report foreign interfaces. Two independent coordinators accepting the same key are covered. All 16 real-kernel ownership cases passed.

R2-3: interrupted removal verifies every remaining artifact, accepts absent unit/launcher/current, retains unrelated state, and repeats as a no-op. A closed ACK is accepted only after authenticated Exited; a close without exit remains refused. All 18 uninstall tests passed. Final actual SSH/systemd oracle passed 20 rootless + 20 rootful replacements, revoked-host Replace, then shipping --bootstrap-uninstall after the checked unit and launcher were already gone, repeated no-op cleanup, all tracked shim/service PIDs gone. Both exact containers and all four control PIDs are absent. The behavioral fixture models the one-shot-dial older binary; it is not the historical executable.

scripts/verify fast exited 0 on this head: 1,588 workspace tests passed, 0 failed; all compiler/TypeScript/bundle/protocol checks passed. No load-baseline exception used. Full output is posted verbatim in #231's finish comment and attached below. Exact static sizes x86 21,234,000 B (+8,128 B), ARM 19,455,264 B (+27,576 B, measured D243 justification on #231). All temporary job targets/worktrees and VM job files are removed; receipts remain outside the checkout. Optional fresh early-terminal full-image handoff is separately recorded on #231; staged re-add is qualified.

Gate summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

final-fast.log
workspace-test-counts.json
gate-and-release-identities.json
round8-vm-run.log
rootless-service.log
rootless-summary.json
rootless-cleanup.json
root-service.log
root-summary.json
root-cleanup.json
final-local-cleanup.json
local-port-cleanup.json
gate-and-release-identities.json

Finished #235 follow-ups on addhost-readd, pushed head 63b0c7a1596d60e7afd747c404d85eba5142f613. No deployment and no owner live installation/interface access; issue stays open. R2-1 / pre-existing second-installation P1: only this installation's local creation receipt matching the live interface key authorizes reuse or deletion. Coordinator-key and empty-device fallbacks are gone; restore/on/off/config/retirement preserve and report foreign interfaces. Two independent coordinators accepting the same key are covered. All 16 real-kernel ownership cases passed. R2-3: interrupted removal verifies every remaining artifact, accepts absent unit/launcher/current, retains unrelated state, and repeats as a no-op. A closed ACK is accepted only after authenticated Exited; a close without exit remains refused. All 18 uninstall tests passed. Final actual SSH/systemd oracle passed 20 rootless + 20 rootful replacements, revoked-host Replace, then shipping --bootstrap-uninstall after the checked unit and launcher were already gone, repeated no-op cleanup, all tracked shim/service PIDs gone. Both exact containers and all four control PIDs are absent. The behavioral fixture models the one-shot-dial older binary; it is not the historical executable. scripts/verify fast exited 0 on this head: 1,588 workspace tests passed, 0 failed; all compiler/TypeScript/bundle/protocol checks passed. No load-baseline exception used. Full output is posted verbatim in #231's finish comment and attached below. Exact static sizes x86 21,234,000 B (+8,128 B), ARM 19,455,264 B (+27,576 B, measured D243 justification on #231). All temporary job targets/worktrees and VM job files are removed; receipts remain outside the checkout. Optional fresh early-terminal full-image handoff is separately recorded on #231; staged re-add is qualified. Gate summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` [final-fast.log](https://git.kayg.org/attachments/70e85099-cb47-48ef-8a3b-988b039ceb95) [workspace-test-counts.json](https://git.kayg.org/attachments/9c8f4d83-23f6-4aeb-bec5-43db2cddfcce) [gate-and-release-identities.json](https://git.kayg.org/attachments/3f20a93b-9072-4c43-83ea-f8e414b340e6) [round8-vm-run.log](https://git.kayg.org/attachments/2a040abb-e8dd-4ab3-94de-afe4ea920aee) [rootless-service.log](https://git.kayg.org/attachments/ee682f20-a006-419a-b037-36ba500858e5) [rootless-summary.json](https://git.kayg.org/attachments/8e00c97c-0779-4459-a6ba-38ed70afe54f) [rootless-cleanup.json](https://git.kayg.org/attachments/a98149f0-3b4f-42cf-9f8b-9606ff71fa82) [root-service.log](https://git.kayg.org/attachments/01a3d854-d0a1-49aa-b776-16c6d634a2c9) [root-summary.json](https://git.kayg.org/attachments/a5b8641b-969a-419d-a699-9f42d0633f68) [root-cleanup.json](https://git.kayg.org/attachments/5cc699a8-0ea0-4479-ba34-ff7fb91c6048) [final-local-cleanup.json](https://git.kayg.org/attachments/eda18b9c-516b-49f1-9bca-91471668ddfd) [local-port-cleanup.json](https://git.kayg.org/attachments/8f40ae00-ccb2-462d-962d-bfe0cf7799e2) [gate-and-release-identities.json](https://git.kayg.org/attachments/b2e4c6f2-4cd4-48a9-8b87-41a24cc1c049)

kayg commented

2026-10-18 23:52:45 +00:00

Author

Owner

R2 reproduced on this branch before repair: uninstall 20 passed / 2 failed. The unchanged review test deleted the recreated bin/operator-notes; additional regression c2af008ab also deleted unknown contents in the original slot directory. R3 reproduced before repair: rollback and inspection both refused with exit 71 after unit=new / owner=old. Additional test commit 8cd533dbd covers all journal/marker publication boundaries and both recovery paths; its pre-fix journal-boundary assertion fails. No owner fixture access.

removal-red.log
handoff-red.log
handoff-boundaries-red.log

R2 reproduced on this branch before repair: uninstall 20 passed / 2 failed. The unchanged review test deleted the recreated bin/operator-notes; additional regression c2af008ab also deleted unknown contents in the original slot directory. R3 reproduced before repair: rollback and inspection both refused with exit 71 after unit=new / owner=old. Additional test commit 8cd533dbd covers all journal/marker publication boundaries and both recovery paths; its pre-fix journal-boundary assertion fails. No owner fixture access. [removal-red.log](https://git.kayg.org/attachments/120cdce3-ad2e-4539-8f89-4f9a57ec9ccd) [handoff-red.log](https://git.kayg.org/attachments/e1573b85-5c5f-4aae-852e-64e49deb830f) [handoff-boundaries-red.log](https://git.kayg.org/attachments/ed775d3c-4187-42a1-be94-feb17401cfb0)

kayg commented

2026-10-18 23:59:20 +00:00

Author

Owner

Completed R2 in 867cf236e: bin is never recursively deleted. Only the checked current/live slot names are unlinked, live first so interruption keeps the binding proof. Unknown entries, unbound live files and replacement directories remain, with a truthful leftover report; repeated cleanup cannot infer ownership from their existence. Test-root follow-up 6d8d4eff5 makes every uninstall fixture honor INFRATERNAL_TEST_STATE_ROOT; short owned root ah2 avoids Unix-socket path limits.

Uninstall: 22 passed / 0 failed, including original R2, extra-file, missing-current, ACK-only and wrong-session controls. Strict all-target remote Clippy, fmt and diff checks pass. All 16 unchanged real-kernel ownership cases pass in isolated user/network namespaces (2+6+1+7). Functional only; no build-host performance claim. Final shipping CLI/systemd, browser and full static gates remain.

removal-isolated-green.log
removal-clippy-corrected.log
kernel-ownership.log

Completed R2 in 867cf236e: bin is never recursively deleted. Only the checked current/live slot names are unlinked, live first so interruption keeps the binding proof. Unknown entries, unbound live files and replacement directories remain, with a truthful leftover report; repeated cleanup cannot infer ownership from their existence. Test-root follow-up 6d8d4eff5 makes every uninstall fixture honor INFRATERNAL_TEST_STATE_ROOT; short owned root ah2 avoids Unix-socket path limits. Uninstall: 22 passed / 0 failed, including original R2, extra-file, missing-current, ACK-only and wrong-session controls. Strict all-target remote Clippy, fmt and diff checks pass. All 16 unchanged real-kernel ownership cases pass in isolated user/network namespaces (2+6+1+7). Functional only; no build-host performance claim. Final shipping CLI/systemd, browser and full static gates remain. [removal-isolated-green.log](https://git.kayg.org/attachments/613f9bd0-67a3-4beb-8582-6f553fb7cbf8) [removal-clippy-corrected.log](https://git.kayg.org/attachments/461acea4-8769-42d3-b737-704cc46e28a7) [kernel-ownership.log](https://git.kayg.org/attachments/c1fc2642-6d1c-4897-b32e-21acf5556238)

kayg commented

2026-10-19 01:23:50 +00:00

Author

Owner

Final functional service runs pass on source e0c73f595, exact stripped static x86_64 candidate ea702558d996bdc264856a0f608cb0308d66c85fe81f7128ba6bc7cc59aa8913, 21,239,632 B. Rootless 20/20 and fresh rootful 20/20, each with one live record, retained UUID/key/PTY/shim and candidate MainPID executable digest. Both modes also pass removed-host Replace, shipping resumed uninstall, repeated no-op cleanup and every tracked service/shim PID gone. Exact containers and both control PIDs per mode are absent in cleanup receipts. Shipping P0 fixture preserves/reports the independently recreated bin file.

The earlier rootful attempt stopped at sample 16 with a busy-setup refusal after 15 successful replacements; it is retained separately above, not counted as a passing run. No assertion or candidate change between runs. All tests use owned disposable containers/private network namespaces on the build host. Times are not performance evidence; fixture is the documented one-shot-dial behavioral image, not the historical executable. Owner live acceptance files/installation/interfaces remain untouched. Independent merge-base size build and ARM build are running next; final full fast gate and pushes remain.

rootless-service.log
rootless-summary.json
rootless-cleanup.json
root-service.log
root-summary.json
root-cleanup.json

Final functional service runs pass on source e0c73f595, exact stripped static x86_64 candidate ea702558d996bdc264856a0f608cb0308d66c85fe81f7128ba6bc7cc59aa8913, 21,239,632 B. Rootless 20/20 and fresh rootful 20/20, each with one live record, retained UUID/key/PTY/shim and candidate MainPID executable digest. Both modes also pass removed-host Replace, shipping resumed uninstall, repeated no-op cleanup and every tracked service/shim PID gone. Exact containers and both control PIDs per mode are absent in cleanup receipts. Shipping P0 fixture preserves/reports the independently recreated bin file. The earlier rootful attempt stopped at sample 16 with a busy-setup refusal after 15 successful replacements; it is retained separately above, not counted as a passing run. No assertion or candidate change between runs. All tests use owned disposable containers/private network namespaces on the build host. Times are not performance evidence; fixture is the documented one-shot-dial behavioral image, not the historical executable. Owner live acceptance files/installation/interfaces remain untouched. Independent merge-base size build and ARM build are running next; final full fast gate and pushes remain. [rootless-service.log](https://git.kayg.org/attachments/baa6f9db-8153-4216-a38f-2bf5e07f6a40) [rootless-summary.json](https://git.kayg.org/attachments/63257405-5b2a-47fa-be9a-2e57abdd83ac) [rootless-cleanup.json](https://git.kayg.org/attachments/179d6103-845a-44c3-9726-977edb4d47e8) [root-service.log](https://git.kayg.org/attachments/17442a84-046a-405d-976b-a5decb2411eb) [root-summary.json](https://git.kayg.org/attachments/91d0c880-ca46-4bd2-9374-db6007bf4b44) [root-cleanup.json](https://git.kayg.org/attachments/7fed7eda-cfda-49ae-b84d-324b47e2598d)

kayg commented

2026-10-19 02:38:18 +00:00

Author

Owner

Finished #235 round-2 fixes at bed79b865a; both origin/addhost-readd-r2 and origin/addhost-readd verified at this head. No deploy or owner acceptance fixture access. Issue stays open.

All three review findings fixed; unchanged review assertions pass. Shipping P0 fixture preserves and reports independent bin data while the baseline deletes it. Final qualification: 22 uninstall tests, 100 installer tests, 35 ownership-shell cases, 16 real-kernel cases, 10 production-build browser cases, minimal-host recovery without Python, real SSH/systemd 20 rootless +20 rootful replacements, removed-host Replace and resumed/repeated cleanup. Exact containers and tracked PIDs gone. Static x86 21,239,632 B (+5,632 B vs rebuilt merge base); ARM 19,460,512 B (+5,248 B vs recorded parent). Scratch targets/worktree removed; source clean.

scripts/verify fast exit 0 with no waiver; full verbatim output, artifact identities, earlier failed attempts and receipts are in the finish comment on #231.

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Finished #235 round-2 fixes at bed79b865ae741030d579251f3975c7af9fb4ad5; both origin/addhost-readd-r2 and origin/addhost-readd verified at this head. No deploy or owner acceptance fixture access. Issue stays open. All three review findings fixed; unchanged review assertions pass. Shipping P0 fixture preserves and reports independent bin data while the baseline deletes it. Final qualification: 22 uninstall tests, 100 installer tests, 35 ownership-shell cases, 16 real-kernel cases, 10 production-build browser cases, minimal-host recovery without Python, real SSH/systemd 20 rootless +20 rootful replacements, removed-host Replace and resumed/repeated cleanup. Exact containers and tracked PIDs gone. Static x86 21,239,632 B (+5,632 B vs rebuilt merge base); ARM 19,460,512 B (+5,248 B vs recorded parent). Scratch targets/worktree removed; source clean. scripts/verify fast exit 0 with no waiver; full verbatim output, artifact identities, earlier failed attempts and receipts are in the finish comment on #231. ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ```

kayg commented

2026-10-19 03:42:23 +00:00

Author

Owner

P0 residual guarantee-1 failure, pre-existing source (not a new round-2 regression): shipping static x86 CLI 21,239,632 B deletes an independently recreated state/operator-notes after interrupted removal. Parent .bootstrap-owner is root-owned and matches; replacement state directory/file are uid 1000. Result: cleanup_exit=0, independent_file_preserved=false, “infraternal was removed”, no leftover report. Final fixture ownership assertion fails; exact container absent. remove_files still recursively removes state without its own creation/ownership proof; this operation predates 63b0c7a15. Independent baseline execution is running next. state receipt. Candidate bin control preserves/reports independent data; foreign-owned sessions is preserved with an ownership refusal, not deleted. The same test script now selects bin/state/sessions; test-only commit follows baseline control. No owner fixture access.

P0 residual guarantee-1 failure, pre-existing source (not a new round-2 regression): shipping static x86 CLI 21,239,632 B deletes an independently recreated state/operator-notes after interrupted removal. Parent .bootstrap-owner is root-owned and matches; replacement state directory/file are uid 1000. Result: cleanup_exit=0, independent_file_preserved=false, “infraternal was removed”, no leftover report. Final fixture ownership assertion fails; exact container absent. remove_files still recursively removes state without its own creation/ownership proof; this operation predates 63b0c7a15. Independent baseline execution is running next. [state receipt](https://git.kayg.org/attachments/c513d437-1829-4c10-9743-c62b8639d076). Candidate bin control preserves/reports independent data; foreign-owned sessions is preserved with an ownership refusal, not deleted. The same test script now selects bin/state/sessions; test-only commit follows baseline control. No owner fixture access.

kayg commented

2026-10-19 04:17:28 +00:00

Author

Owner

Round-2 delta review finished at pushed test-only head 6f09507172 on review-addhost-readd-r2. Verdict HOLD: one P1 live-duplicate retirement gap (two native proofs), one P2 in-place handoff-unit edit reporting gap. Additional P0 state-directory deletion is pre-existing, confirmed with both independently built base and subject; the bin repair is effective. Tests: service20+20, uninstall22, kernel16, ownership-shell35, recovery11+1, browser10, TypeScript/UI260 + protocol37 + metadata2 pass. Re-add10 existing pass/2 new red; installer100 existing pass/1 new red/1 ignored. Final full fast gate has only the intentional new handoff test failure; all other Rust rows PASS, no waiver. Exact x86 growth+5,632 B and both cap ratchets confirmed. Full head SHA, verbatim gate, findings, screenshots, receipts and cleanup are in the finish comment on #231. All owned containers/control PIDs gone, browser ports closed, own targets/baseline/artifacts/fixture roots deleted; worktree clean. No deploy/merge or owner fixture access. Issue stays open.

Round-2 delta review finished at pushed test-only head 6f09507172394f074c0ae37639afc25a4daad087 on review-addhost-readd-r2. Verdict HOLD: one P1 live-duplicate retirement gap (two native proofs), one P2 in-place handoff-unit edit reporting gap. Additional P0 state-directory deletion is pre-existing, confirmed with both independently built base and subject; the bin repair is effective. Tests: service20+20, uninstall22, kernel16, ownership-shell35, recovery11+1, browser10, TypeScript/UI260 + protocol37 + metadata2 pass. Re-add10 existing pass/2 new red; installer100 existing pass/1 new red/1 ignored. Final full fast gate has only the intentional new handoff test failure; all other Rust rows PASS, no waiver. Exact x86 growth+5,632 B and both cap ratchets confirmed. Full head SHA, verbatim gate, findings, screenshots, receipts and cleanup are in the finish comment on [#231](https://git.kayg.org/kayg/infraternal/issues/231). All owned containers/control PIDs gone, browser ports closed, own targets/baseline/artifacts/fixture roots deleted; worktree clean. No deploy/merge or owner fixture access. Issue stays open.

kayg commented

2026-10-19 04:23:00 +00:00

Author

Owner

R2-2 inspection: remove_files recursively deletes both state and sessions (uninstall.rs:752), while the service oracle itself creates state/readd-kept independently and later requires state to disappear (readd_service_tests.rs:393,565). This conflicts with the round-3 proven-creation rule. Removal will preserve/report nonempty unproven directories and remove only checked slots, setup entries and empty known layout directories. The functional oracle will require the independent sentinel to survive cleanup and a truthful leftover report, alongside unchanged 20+20 replacements and retained-shim retirement. A completed cleanup remains a no-op even when unproven data remains. No pathname/uid alone is a creation receipt.

kayg commented

2026-10-19 04:33:26 +00:00

Author

Owner

Started round 3 on addhost-readd-r3, base bed79b865a. Imported all five unchanged review test commits through 9d1ba30d1. Addressing registry retirement admission fence, proven-ownership removal for all directories, and independent handoff unit journal. No deployment or owner live installation access.

Started round 3 on addhost-readd-r3, base bed79b865ae741030d579251f3975c7af9fb4ad5. Imported all five unchanged review test commits through 9d1ba30d1. Addressing registry retirement admission fence, proven-ownership removal for all directories, and independent handoff unit journal. No deployment or owner live installation access.

kayg commented

2026-10-19 04:59:20 +00:00

Author

Owner

Completed logical fixes bc6ae4026 (registry retirement fence + scoped temporary cuts) and 087b32b7e (nonrecursive state/session removal). Strict workspace all-target Clippy and fmt passed; re-add12/12, retirement12/12 (+1 opt-in diagnostic), uninstall24/24, kernel16/16 (2+6+1+7), ownership-shell35/35 and recovery11 ordinary passed. These commits are local until the requested final green push/fast-forward.

The latest uncommitted refinements report an already-in-progress admission as already-added with its exact UUID, without taking the global host-map lock, and compare recovery unit byte streams using the existing mandatory checksum tool. Six direct handoff controls pass, including newline/NUL edits, missing checksum tool and unverifiable shared inode; unchanged valid recovery succeeds. Full iteration gate is queued; service40, browser10, paired static size and final fast remain. No deployment or owner fixture access.

readd-green.log
retirement-green.log
uninstall-green.log
kernel-ownership.log
handoff-byte-checks.json

Completed logical fixes bc6ae4026 (registry retirement fence + scoped temporary cuts) and 087b32b7e (nonrecursive state/session removal). Strict workspace all-target Clippy and fmt passed; re-add12/12, retirement12/12 (+1 opt-in diagnostic), uninstall24/24, kernel16/16 (2+6+1+7), ownership-shell35/35 and recovery11 ordinary passed. These commits are local until the requested final green push/fast-forward. The latest uncommitted refinements report an already-in-progress admission as already-added with its exact UUID, without taking the global host-map lock, and compare recovery unit byte streams using the existing mandatory checksum tool. Six direct handoff controls pass, including newline/NUL edits, missing checksum tool and unverifiable shared inode; unchanged valid recovery succeeds. Full iteration gate is queued; service40, browser10, paired static size and final fast remain. No deployment or owner fixture access. [readd-green.log](https://git.kayg.org/attachments/f0f26f60-d560-4845-8359-ed7f17d147ad) [retirement-green.log](https://git.kayg.org/attachments/87518c51-a0bb-4ece-94c8-a39cc8ded30a) [uninstall-green.log](https://git.kayg.org/attachments/a176963d-d2ad-4b61-ac99-2b38c33816ad) [kernel-ownership.log](https://git.kayg.org/attachments/8f562dfc-5063-4621-8622-0d62663efcee) [handoff-byte-checks.json](https://git.kayg.org/attachments/2a7b3ae8-e67f-4785-a941-3804eab8dd5c)

kayg commented

2026-10-19 05:59:53 +00:00

Author

Owner

Round-3 local commits: 087b32b7e preserves/reports unproven populated state/session directories and replacement symlinks; uninstall 24 passed, real-kernel ownership 16 passed. c4b451c50 replaces the shared-inode handoff with an independent copied unit bound to its planned UUID; installer 102 passed, 1 existing ignored, plus 51 real-file ownership cases. d9ae8b5b1 documents the additive contract and the independent state sentinel in the service oracle. Registry follow-up 766b7aa90 passes all 13 re-add cases. Browser 10 passed; receipts/screenshots are on #231. Static builds, minimal-host recovery, shipping removal and rootless/rootful 40-service qualification are still in progress. No owner installation touched and no deployment.

Round-3 local commits: 087b32b7e preserves/reports unproven populated state/session directories and replacement symlinks; uninstall 24 passed, real-kernel ownership 16 passed. c4b451c50 replaces the shared-inode handoff with an independent copied unit bound to its planned UUID; installer 102 passed, 1 existing ignored, plus 51 real-file ownership cases. d9ae8b5b1 documents the additive contract and the independent state sentinel in the service oracle. Registry follow-up 766b7aa90 passes all 13 re-add cases. Browser 10 passed; receipts/screenshots are on #231. Static builds, minimal-host recovery, shipping removal and rootless/rootful 40-service qualification are still in progress. No owner installation touched and no deployment.

kayg commented

2026-10-19 06:13:24 +00:00

Author

Owner

Completed d24a4f43c: the public service oracle now requires its independently created state sentinel to survive with a leftover report. All original UUID/key, executable, PTY/shim, single-live-record and process assertions remain; imported reviewer tests are unchanged.

Exact shipping x86 SHA256 dd76e6d72286d70d4333e135fed6152ed223a1d147f2427b5fbfad32be695166. On infraternal-perf-test (4 CPUs), separately locked CPUWeight=10000 rootless/rootful containers: 20+20 re-adds pass, plus removed-host replacement and resumed/repeated removal in both modes. Rootless p50/observed max 2660286/2698399 us, load before 0.250/0.168/0.153 and after 0.417/0.240/0.181. Rootful p50/observed max 2856465/2959131 us, load before 0.139/0.190/0.168 and after 0.367/0.244/0.190. This uses the explicit sparse one-shot behavioral fixture, not a historical executable. Both exact containers absent, all recorded service/shim/control PIDs gone. Copied receipts match their remote hashes.

An earlier setup-only launch used an unrelocated native runner and produced zero samples; its container/control PIDs were removed. It is excluded from qualification. ARM, minimal-host/shipping-removal controls, paired static size and final fast gate remain.

root-service.log
root-summary.json
root-cleanup.json
rootless-service.log
rootless-summary.json
rootless-cleanup.json
artifact-manifest.json

Completed d24a4f43c: the public service oracle now requires its independently created state sentinel to survive with a leftover report. All original UUID/key, executable, PTY/shim, single-live-record and process assertions remain; imported reviewer tests are unchanged. Exact shipping x86 SHA256 dd76e6d72286d70d4333e135fed6152ed223a1d147f2427b5fbfad32be695166. On infraternal-perf-test (4 CPUs), separately locked CPUWeight=10000 rootless/rootful containers: 20+20 re-adds pass, plus removed-host replacement and resumed/repeated removal in both modes. Rootless p50/observed max 2660286/2698399 us, load before 0.250/0.168/0.153 and after 0.417/0.240/0.181. Rootful p50/observed max 2856465/2959131 us, load before 0.139/0.190/0.168 and after 0.367/0.244/0.190. This uses the explicit sparse one-shot behavioral fixture, not a historical executable. Both exact containers absent, all recorded service/shim/control PIDs gone. Copied receipts match their remote hashes. An earlier setup-only launch used an unrelocated native runner and produced zero samples; its container/control PIDs were removed. It is excluded from qualification. ARM, minimal-host/shipping-removal controls, paired static size and final fast gate remain. [root-service.log](https://git.kayg.org/attachments/c3349bd0-2263-4c57-ae46-c778f1025bc3) [root-summary.json](https://git.kayg.org/attachments/b24aaaf7-46cb-49f2-812d-8bad55bd691a) [root-cleanup.json](https://git.kayg.org/attachments/4c9841e6-d734-4a45-8410-098f1c3de998) [rootless-service.log](https://git.kayg.org/attachments/5fa2b941-e689-43fb-b5ac-2c44ecdbae65) [rootless-summary.json](https://git.kayg.org/attachments/d0587375-ed60-4cca-b98b-c70c57ba28b4) [rootless-cleanup.json](https://git.kayg.org/attachments/28f1345a-8876-461c-8083-4570468b0bd2) [artifact-manifest.json](https://git.kayg.org/attachments/9cac04e4-ec4e-4d92-bbf8-a481c5c91027)

kayg commented

2026-10-19 06:30:29 +00:00

Author

Owner

Paired shipping control confirms R2-2: independently rebuilt bed79b865 static x86 (21239632 bytes) deletes a foreign-owned recreated state/operator-notes and reports success, so the unchanged directory-selecting reviewer fixture fails as intended. The removal fix preserves it and reports Left; bin likewise preserves/reports, while foreign-owned sessions refuses before kernel/socket traversal and preserves the file. Exact disposable containers are absent. Minimal-host recovery passes using the static helper (12/12 recovery including 11 ordinary cases). These interim shipping controls will be refreshed after the exclusive-copy build; the baseline control remains unchanged.

removal-baseline-state-red.log
removal-shipping-state.log
removal-shipping-bin.log
removal-shipping-sessions.log
recovery-minimal-final.log

Paired shipping control confirms R2-2: independently rebuilt bed79b865 static x86 (21239632 bytes) deletes a foreign-owned recreated state/operator-notes and reports success, so the unchanged directory-selecting reviewer fixture fails as intended. The removal fix preserves it and reports Left; bin likewise preserves/reports, while foreign-owned sessions refuses before kernel/socket traversal and preserves the file. Exact disposable containers are absent. Minimal-host recovery passes using the static helper (12/12 recovery including 11 ordinary cases). These interim shipping controls will be refreshed after the exclusive-copy build; the baseline control remains unchanged. [removal-baseline-state-red.log](https://git.kayg.org/attachments/586367e4-dc97-436f-aba3-234adc7a2103) [removal-shipping-state.log](https://git.kayg.org/attachments/31e02758-e4e7-4a02-b6cc-4d059e10f15f) [removal-shipping-bin.log](https://git.kayg.org/attachments/78e61c99-2968-4378-ba32-add65df85b68) [removal-shipping-sessions.log](https://git.kayg.org/attachments/524fca74-997c-4bd1-81d9-e8a2128154f3) [recovery-minimal-final.log](https://git.kayg.org/attachments/d14a0000-32a2-44e1-8aab-4607ab766b24)

kayg commented

2026-10-19 06:47:12 +00:00

Author

Owner

Final refreshed artifact qualification after 8de701f3e: exact shipping x86 SHA256 e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f. On the named 4-CPU perf VM, separate locked CPUWeight=10000 runs pass 20 rootless +20 rootful re-adds, removed-host replacement, resumed/repeated removal, independent-state preservation and every original identity/key/executable/PTY/shim/single-live-record assertion. These supersede the earlier interim artifact receipts.

Rootless p50/observed max 2951067/3035461 us; load before 0/0/0, after 0.273/0.086/0.028. Rootful p50/observed max 3214730/3281014 us; load before 0.070/0.063/0.021, after 0.120/0.100/0.036. These are behavioral-fixture oracle measurements, not a historical binary or a paired old/new latency claim. Both exact containers absent, all recorded service/shim/control PIDs gone, both scopes inactive, owned VM directory removed after hash-verified receipt copy.

Final static-helper minimal-host recovery passes (12 total recovery cases). Final shipping CLI controls preserve recreated bin/state with Left reports and refuse foreign-owned sessions without traversal; all exact local fixture containers removed. Cap commit 58760f49d records x86 21265648 (+26016 paired) / ARM 19483904 (+23392 recorded-base); zero-slack size boundary checks pass. Branch-head verify fast is running.

root-service.log
root-summary.json
root-cleanup.json
rootless-service.log
rootless-summary.json
rootless-cleanup.json
artifact-manifest.json
perf-exclusive-cleanup.log
recovery-minimal-exclusive.log
removal-shipping-exclusive-state.log
removal-shipping-exclusive-sessions.log
removal-shipping-exclusive-bin.log

Final refreshed artifact qualification after 8de701f3e: exact shipping x86 SHA256 e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f. On the named 4-CPU perf VM, separate locked CPUWeight=10000 runs pass 20 rootless +20 rootful re-adds, removed-host replacement, resumed/repeated removal, independent-state preservation and every original identity/key/executable/PTY/shim/single-live-record assertion. These supersede the earlier interim artifact receipts. Rootless p50/observed max 2951067/3035461 us; load before 0/0/0, after 0.273/0.086/0.028. Rootful p50/observed max 3214730/3281014 us; load before 0.070/0.063/0.021, after 0.120/0.100/0.036. These are behavioral-fixture oracle measurements, not a historical binary or a paired old/new latency claim. Both exact containers absent, all recorded service/shim/control PIDs gone, both scopes inactive, owned VM directory removed after hash-verified receipt copy. Final static-helper minimal-host recovery passes (12 total recovery cases). Final shipping CLI controls preserve recreated bin/state with Left reports and refuse foreign-owned sessions without traversal; all exact local fixture containers removed. Cap commit 58760f49d records x86 21265648 (+26016 paired) / ARM 19483904 (+23392 recorded-base); zero-slack size boundary checks pass. Branch-head verify fast is running. [root-service.log](https://git.kayg.org/attachments/dcf80704-e6f6-4d8a-b815-a43eaf036cb5) [root-summary.json](https://git.kayg.org/attachments/3158f1a7-509e-41d0-80e6-c9442ebe4944) [root-cleanup.json](https://git.kayg.org/attachments/be329b2e-82df-443e-a139-c1a6d5752d74) [rootless-service.log](https://git.kayg.org/attachments/a026dbad-b96f-4ce4-9a92-4b185dad5b9a) [rootless-summary.json](https://git.kayg.org/attachments/433b1fac-8380-450e-9cb7-ae43709c2b31) [rootless-cleanup.json](https://git.kayg.org/attachments/35e7ab8a-976e-4596-895e-deb2f8d05a99) [artifact-manifest.json](https://git.kayg.org/attachments/b7ed6be5-8efc-46c5-8346-3f97cbf143b3) [perf-exclusive-cleanup.log](https://git.kayg.org/attachments/46f1a5a4-1698-41d1-9fc4-8afd7f6ec489) [recovery-minimal-exclusive.log](https://git.kayg.org/attachments/f9897c7e-b983-40a7-b271-e2bfb0a40848) [removal-shipping-exclusive-state.log](https://git.kayg.org/attachments/cbcbdd1e-9ed4-477f-8a1c-58a5ab044ab1) [removal-shipping-exclusive-sessions.log](https://git.kayg.org/attachments/c779478d-7f86-4e6a-95f8-9987197360ef) [removal-shipping-exclusive-bin.log](https://git.kayg.org/attachments/713715c5-e5c0-49c5-be85-e274e8cb8cd8)

kayg commented

2026-10-19 07:04:53 +00:00

Author

Owner

Finished round 3 at 58760f49d585220be7706d5b9b2d97b36198b03b; pushed addhost-readd-r3 and fast-forwarded addhost-readd, both refs verified. Registry retirement fencing, conservative state/session removal and independent byte-checked unit handoff are complete, including exclusive snapshot creation after validation. No reviewer test weakened.

Final qualification: 40 rootless/rootful service re-adds plus removed-host replacement and resumed/repeated cleanup in both modes; kernel ownership 16; uninstall 24; installer 103; shell 35; recovery 12; browser 10. Full branch-head scripts/verify fast exits 0, no load exceptions. Verbatim output and head are in the finish comment on #231; raw transcript and cleanup receipts below.

Static x86 +26,016 bytes against rebuilt bed79b865; ARM +23,392 against its recorded base. Exact caps and measured D243 justification are on #231. All owned service/browser processes, containers, temporary builds and baseline checkout cleaned; worktree clean. No deployment or owner live-install access. Issues remain open.

verify-fast-final.log
verify-fast-exit.txt
final-self-review.txt
remote-heads.txt
push.log
final-static-hashes.txt
local-cleanup.json
browser-cleanup.log

Finished round 3 at `58760f49d585220be7706d5b9b2d97b36198b03b`; pushed `addhost-readd-r3` and fast-forwarded `addhost-readd`, both refs verified. Registry retirement fencing, conservative state/session removal and independent byte-checked unit handoff are complete, including exclusive snapshot creation after validation. No reviewer test weakened. Final qualification: 40 rootless/rootful service re-adds plus removed-host replacement and resumed/repeated cleanup in both modes; kernel ownership 16; uninstall 24; installer 103; shell 35; recovery 12; browser 10. Full branch-head `scripts/verify fast` exits 0, no load exceptions. Verbatim output and head are in the finish comment on #231; raw transcript and cleanup receipts below. Static x86 +26,016 bytes against rebuilt bed79b865; ARM +23,392 against its recorded base. Exact caps and measured D243 justification are on #231. All owned service/browser processes, containers, temporary builds and baseline checkout cleaned; worktree clean. No deployment or owner live-install access. Issues remain open. [verify-fast-final.log](https://git.kayg.org/attachments/3852c0f8-5b34-48bb-a712-a3ffee2f8c2e) [verify-fast-exit.txt](https://git.kayg.org/attachments/11599f7a-c8c3-46e2-b2ea-b8916f7e0803) [final-self-review.txt](https://git.kayg.org/attachments/26c70357-d387-44b0-8be9-b05685279191) [remote-heads.txt](https://git.kayg.org/attachments/bde2825d-98d5-499d-b9ea-f19728d7a2f2) [push.log](https://git.kayg.org/attachments/ec112fa9-677c-4f19-bb84-20ed9b662b9c) [final-static-hashes.txt](https://git.kayg.org/attachments/8c4989e3-5fd6-41aa-b27c-f6d2f4fa83a1) [local-cleanup.json](https://git.kayg.org/attachments/1a0255f3-149c-4aca-96fa-8c0e19615b9a) [browser-cleanup.log](https://git.kayg.org/attachments/0a2431a7-563d-4e44-a2bc-3e3fdc9d2097)

kayg commented

2026-10-19 07:27:59 +00:00

Author

Owner

P0 residual guarantee-2 failure, pre-existing deletion block: resumed public cleanup deletes an independently replaced bin/live when the original bin/current link survives. Native real-file fixture starts after unit/launcher unlink, replaces the old live file with independent bytes, then calls cleanup. Result Ok([]), replacement file absent; new preservation assertion fails. uninstall.rs:751-756 checks only current -> live pathname, with no live-file creation/uid/content proof. This block is unchanged from bed79b865, so it is not a newly introduced round-3 regression. Shipping foreign-uid CLI and rebuilt baseline controls are pending. removal-slot-focused-v2.log

P0 residual guarantee-2 failure, pre-existing deletion block: resumed public cleanup deletes an independently replaced bin/live when the original bin/current link survives. Native real-file fixture starts after unit/launcher unlink, replaces the old live file with independent bytes, then calls cleanup. Result Ok([]), replacement file absent; new preservation assertion fails. uninstall.rs:751-756 checks only current -> live pathname, with no live-file creation/uid/content proof. This block is unchanged from bed79b865, so it is not a newly introduced round-3 regression. Shipping foreign-uid CLI and rebuilt baseline controls are pending. [removal-slot-focused-v2.log](https://git.kayg.org/attachments/1c3136ed-802e-4e89-bf23-6b324b5fc1f4)

kayg commented

2026-10-19 07:39:20 +00:00

Author

Owner

Three atomic test-only commits pushed on review-addhost-readd-r3:

952a8b4902: unproven live-slot deletion, native + foreign-uid shipping fixture. Uninstall24 existing pass /1 intended new failure.
d81cc95eb8: snapshot gap through direct retry and rollback; 20 journaled unit-edit combinations. Installer104 pass /2 intended new failures /1 existing ignored; strengthened gap cases reproduce with private identity metadata and no journal.
1d179fa3b5: cancellation/concurrent re-add/runtime shutdown/normal client retry. Reconciliation14 pass; native retirement3 pass/1 opt-in ignored; fence5 pass/1 opt-in ignored.

Workspace all-target Clippy and fmt pass; TypeScript check and browser10 pass. Static head/base builds are running with linker maps. Shipping40, paired CLI controls, minimal-host recovery and final fast still pending. No production source behavior, merge, deploy or owner fixture access.
uninstall-qualified.log
handoff-gap-qualified.log
fence-qualified.log

Three atomic test-only commits pushed on review-addhost-readd-r3: - 952a8b4902beff2320eaab30daf8783ddf5a71b0: unproven live-slot deletion, native + foreign-uid shipping fixture. Uninstall24 existing pass /1 intended new failure. - d81cc95eb8fe62b3dd8c28f8724409be0ff6d245: snapshot gap through direct retry and rollback; 20 journaled unit-edit combinations. Installer104 pass /2 intended new failures /1 existing ignored; strengthened gap cases reproduce with private identity metadata and no journal. - 1d179fa3b5e1947bd03964ff08dbd777506df2b9: cancellation/concurrent re-add/runtime shutdown/normal client retry. Reconciliation14 pass; native retirement3 pass/1 opt-in ignored; fence5 pass/1 opt-in ignored. Workspace all-target Clippy and fmt pass; TypeScript check and browser10 pass. Static head/base builds are running with linker maps. Shipping40, paired CLI controls, minimal-host recovery and final fast still pending. No production source behavior, merge, deploy or owner fixture access. [uninstall-qualified.log](https://git.kayg.org/attachments/230fd1d4-133f-4696-921b-cf6290832168) [handoff-gap-qualified.log](https://git.kayg.org/attachments/d31b77dd-1b24-4c80-87a5-dfe305b763ba) [fence-qualified.log](https://git.kayg.org/attachments/d95be875-c7ba-421c-a05f-0ab97cf64dee)

kayg commented

2026-10-19 08:05:27 +00:00

Author

Owner

P0 strengthened with the map-built static head CLI (21,265,648 B, SHA256 93d8e71d593d6fa8095f333ec40ec400589269f6821bf27dc81fc0fa7e2b5592): root-owned bin + surviving original current link; independently recreated bin/live is uid1000. --bootstrap-uninstall exits0, deletes that file, prints “infraternal was removed from this machine.” and no Left report. New CLI fixture assertion fails as intended. Exact disposable systemd container is absent after cleanup. Rebuilt base and ordinary-release artifact controls remain pending; no owner installation accessed. cli-bound-live-interim.log

P0 strengthened with the map-built static head CLI (21,265,648 B, SHA256 93d8e71d593d6fa8095f333ec40ec400589269f6821bf27dc81fc0fa7e2b5592): root-owned bin + surviving original current link; independently recreated bin/live is uid1000. --bootstrap-uninstall exits0, deletes that file, prints “infraternal was removed from this machine.” and no Left report. New CLI fixture assertion fails as intended. Exact disposable systemd container is absent after cleanup. Rebuilt base and ordinary-release artifact controls remain pending; no owner installation accessed. [cli-bound-live-interim.log](https://git.kayg.org/attachments/d0b46ddf-55b3-4dde-9149-219c251738ae)

kayg commented

2026-10-19 08:18:25 +00:00

Author

Owner

Independent bed79b865 x86 static control confirms R3-2 is pre-existing: rebuilt base21,239,632 B / ea702558d996bdc264856a0f608cb0308d66c85fe81f7128ba6bc7cc59aa8913 also deletes the independently recreated uid1000 bin/live when the original current link survives. CLI exit0, no Left report; the new preservation assertion fails. Exact base control container b75cbaf363b5e5e6926c9ea8b9e10b2a889530a768adce6df1e302963854087c is absent. Both subject/base receipts are on #231. cli-bound-live-base-interim.log

Independent bed79b865 x86 static control confirms R3-2 is pre-existing: rebuilt base21,239,632 B / ea702558d996bdc264856a0f608cb0308d66c85fe81f7128ba6bc7cc59aa8913 also deletes the independently recreated uid1000 bin/live when the original current link survives. CLI exit0, no Left report; the new preservation assertion fails. Exact base control container b75cbaf363b5e5e6926c9ea8b9e10b2a889530a768adce6df1e302963854087c is absent. Both subject/base receipts are on #231. [cli-bound-live-base-interim.log](https://git.kayg.org/attachments/0e05ea23-62f5-45fa-9ed0-fbebe8215cc9)

kayg commented

2026-10-19 08:47:00 +00:00

Author

Owner

Completed ordinary-release functional qualification on unchanged pushed head 1d179fa3b. Ordinary x86/ARM images are byte-identical to their map builds; x86 SHA256 93d8e71d593d6fa8095f333ec40ec400589269f6821bf27dc81fc0fa7e2b5592.

Real SSH/systemd: 20 rootless + 20 rootful re-adds pass, preserving UUID/key/PTY/shim, one active record and the exact candidate MainPID image. Both modes also pass removed-host Replace and resumed/repeated removal with the independent state sentinel preserved/reported. Both exact containers are absent; all recorded service/shim/control PIDs are gone. The old process is the documented one-shot sparse behavioral fixture, not historical executable bytes. Functional checks only; no build-host latency claim.

CLI controls: independent bin/state data preserved with Left reports; foreign-owned sessions refused before traversal and preserved. Both head/base still delete independent bound bin/live and exit0: the new assertions fail as intended. All exact CLI fixture containers removed. Shell oracle 35/35 passes; a first direct invocation omitted its required helper environment and was a setup error, corrected without code changes (the Rust wrapper oracle had already passed).

Full workspace run and final verify fast are in progress.
shipping-manifest.json
rootless-service.log
rootless-summary.json
rootless-cleanup.json
root-service.log
root-summary.json
root-cleanup.json

ownership-shell-direct-v2.log
shipping-bin.log
shipping-state.log
shipping-sessions.log
shipping-bound-live.log
baseline-bound-live.log

Completed ordinary-release functional qualification on unchanged pushed head 1d179fa3b. Ordinary x86/ARM images are byte-identical to their map builds; x86 SHA256 93d8e71d593d6fa8095f333ec40ec400589269f6821bf27dc81fc0fa7e2b5592. Real SSH/systemd: 20 rootless + 20 rootful re-adds pass, preserving UUID/key/PTY/shim, one active record and the exact candidate MainPID image. Both modes also pass removed-host Replace and resumed/repeated removal with the independent state sentinel preserved/reported. Both exact containers are absent; all recorded service/shim/control PIDs are gone. The old process is the documented one-shot sparse behavioral fixture, not historical executable bytes. Functional checks only; no build-host latency claim. CLI controls: independent bin/state data preserved with Left reports; foreign-owned sessions refused before traversal and preserved. Both head/base still delete independent bound bin/live and exit0: the new assertions fail as intended. All exact CLI fixture containers removed. Shell oracle 35/35 passes; a first direct invocation omitted its required helper environment and was a setup error, corrected without code changes (the Rust wrapper oracle had already passed). Full workspace run and final verify fast are in progress. [shipping-manifest.json](https://git.kayg.org/attachments/52ae9125-c9bd-42bd-b2dc-1d2a5074689c) [rootless-service.log](https://git.kayg.org/attachments/2d5b1047-a465-4818-b66a-33b6366935b4) [rootless-summary.json](https://git.kayg.org/attachments/605148cf-a426-468c-b984-218c6bb0d36e) [rootless-cleanup.json](https://git.kayg.org/attachments/239b1861-59ef-4cc1-ab40-c9259e1a921b) [root-service.log](https://git.kayg.org/attachments/4d022c53-efe8-4c26-afcd-4b640457b8f0) [root-summary.json](https://git.kayg.org/attachments/7cad6325-4b7d-462e-a039-ee71b23892bd) [root-cleanup.json](https://git.kayg.org/attachments/c8c90290-a754-4bbd-8212-f6017ac90737) [ownership-shell-direct-v2.log](https://git.kayg.org/attachments/e1ca0d3d-ce12-46a5-b8ab-a56fc4faaec0) [shipping-bin.log](https://git.kayg.org/attachments/3b3ed908-4f92-4c4c-83c2-5c5c11c759b5) [shipping-state.log](https://git.kayg.org/attachments/b5d771c5-c095-42cf-a81c-97a69f13106a) [shipping-sessions.log](https://git.kayg.org/attachments/a53fa0d4-0a50-4670-8403-041a9e850963) [shipping-bound-live.log](https://git.kayg.org/attachments/50b30ce9-b825-4663-9eef-ff4477c69035) [baseline-bound-live.log](https://git.kayg.org/attachments/c90a551c-88fb-4187-b9db-66f84067d105)

kayg commented

2026-10-19 09:26:04 +00:00

Author

Owner

Round 3 finished: HOLD. Head 1d179fa3b5 pushed; test changes only. P0 pre-existing on bed79b865 and still present: interrupted removal with original current link deletes independently recreated bin/live, including a uid1000 independent file under the root-owned bin directory. Shipping CLI exits 0 and reports successful removal without Left. Ordinary foreign bin/state/sessions preservation passes. New uninstall preservation assertion fails as intended. Existing uninstall 24/24, ownership shell 35/35, kernel ownership 16/16, recovery_support 12/12, service re-add 40/40 and browser 10/10 passed. Final scripts/verify fast exits 1 solely on the new preservation assertion; all other final gate rows pass. Full verbatim gate output, size attribution, evidence and review verdict are on #231: #231 . Cleanup proven; worktree clean; no production changes or deployment. Issues remain open.

Round 3 finished: HOLD. Head 1d179fa3b5e1947bd03964ff08dbd777506df2b9 pushed; test changes only. P0 pre-existing on bed79b865 and still present: interrupted removal with original current link deletes independently recreated bin/live, including a uid1000 independent file under the root-owned bin directory. Shipping CLI exits 0 and reports successful removal without Left. Ordinary foreign bin/state/sessions preservation passes. New uninstall preservation assertion fails as intended. Existing uninstall 24/24, ownership shell 35/35, kernel ownership 16/16, recovery_support 12/12, service re-add 40/40 and browser 10/10 passed. Final scripts/verify fast exits 1 solely on the new preservation assertion; all other final gate rows pass. Full verbatim gate output, size attribution, evidence and review verdict are on #231: https://git.kayg.org/kayg/infraternal/issues/231 . Cleanup proven; worktree clean; no production changes or deployment. Issues remain open.

kayg commented

2026-10-19 09:53:30 +00:00

Author

Owner

Starting round 4 on addhost-readd-r4 from 58760f49d5. Imported unchanged review test commits as 7c8e6930a, 4a068a765, ef2032c0c. Continuing #231/#235 history and round-3 findings. Structural scope: install-time identity manifest for removal; disk-recoverable idempotent handoff; generated interruption boundaries, independent edits/recreation, unchanged registry fences. No deploy or owner live fixture access. Final push is limited to addhost-readd-r4 and fast-forward addhost-readd after green qualification.

Starting round 4 on addhost-readd-r4 from 58760f49d585220be7706d5b9b2d97b36198b03b. Imported unchanged review test commits as 7c8e6930a, 4a068a765, ef2032c0c. Continuing #231/#235 history and round-3 findings. Structural scope: install-time identity manifest for removal; disk-recoverable idempotent handoff; generated interruption boundaries, independent edits/recreation, unchanged registry fences. No deploy or owner live fixture access. Final push is limited to addhost-readd-r4 and fast-forward addhost-readd after green qualification.

kayg commented

2026-10-19 09:57:55 +00:00

Author

Owner

Round-4 design before implementation (#231/#235, D17/D198/D243): removal consumes only an atomic install-time .bootstrap-manifest in the private marked directory. Rows bind type, uid, device/inode, SHA256 for regular files and hex-encoded paths; ancestors are checked through no-follow directory descriptors. Unknown/changed entries stay and are reported; no recursive removal. Legacy installs without a manifest cannot authorize deletion. Uncreated directory anchors fence traversal without authorizing rmdir.
Handoff uses one private intent whose atomic name binds old/new identity, original hash and public inode anchors before any temporary write. Prepared public files are links to private recorded inodes; recovery validates all states before changing anything. A retired phase preserves final identities while recovery deletes its own anchors. Unmatched temporary files stay/refuse. Generated command boundaries exercise post-operation interruptions rather than a manually maintained phase list. Existing reviewer assertions remain unchanged. No new dependency/engine or live fixture access.

Round-4 design before implementation (#231/#235, D17/D198/D243): removal consumes only an atomic install-time .bootstrap-manifest in the private marked directory. Rows bind type, uid, device/inode, SHA256 for regular files and hex-encoded paths; ancestors are checked through no-follow directory descriptors. Unknown/changed entries stay and are reported; no recursive removal. Legacy installs without a manifest cannot authorize deletion. Uncreated directory anchors fence traversal without authorizing rmdir. Handoff uses one private intent whose atomic name binds old/new identity, original hash and public inode anchors before any temporary write. Prepared public files are links to private recorded inodes; recovery validates all states before changing anything. A retired phase preserves final identities while recovery deletes its own anchors. Unmatched temporary files stay/refuse. Generated command boundaries exercise post-operation interruptions rather than a manually maintained phase list. Existing reviewer assertions remain unchanged. No new dependency/engine or live fixture access.

kayg commented

2026-10-19 10:03:09 +00:00

Author

Owner

Confirmed unchanged native R3-2 before repair: review_r3_resumed_cleanup_preserves_a_replaced_live_slot: 0 passed / 1 failed; cleanup returned Ok([]), independent replacement bytes absent. Initial package-local invocation lacked test-support and tokio multithread features; corrected invocation reached the intended assertion. Direct old-shell R3-1: interruption -15 after cat, unit.new equals original, repeated Replace exit72.

review-removal-red2.log
handoff-direct-red.log

Confirmed unchanged native R3-2 before repair: review_r3_resumed_cleanup_preserves_a_replaced_live_slot: 0 passed / 1 failed; cleanup returned Ok([]), independent replacement bytes absent. Initial package-local invocation lacked test-support and tokio multithread features; corrected invocation reached the intended assertion. Direct old-shell R3-1: interruption -15 after cat, unit.new equals original, repeated Replace exit72. [review-removal-red2.log](https://git.kayg.org/attachments/f7d5be14-2846-43e6-bd75-cd84af5a781a) [handoff-direct-red.log](https://git.kayg.org/attachments/d63e2136-9c82-4a92-8616-dfdaf29c1c0b)

kayg referenced this issue

2026-10-19 10:44:45 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 11:23:30 +00:00

Author

Owner

Round4 structural recovery step completed: reusable immutable creation-phase helper 90596e810 (Refs #231/#235; writer/consumer integration and exhaustive slice gates still pending).

The helper keeps original host/transaction/base/inode/hash bindings through stage retirement, preserved restaging, and explicitly confirmed retirement. It refuses independently recreated files even with identical bytes. Focused native integration cases for partial-stage recovery, preserved restaging, and explicit original-state retirement each pass 1 test, 0 failures. An independent state child remains intact and blocks retirement; retry after its removal resumes the durable decision without adopting new public data.

The handoff unit/owner/optional-manifest transition remains part of the pending integrated generated-boundary gate. This comment records the completed helper step, not closure of the issue.

Evidence:
fresh-inventory-native-single.log
fresh-preserve-native-single.log
fresh-explicit-retirement-native-single.log
fresh-stage-inventory-single.log
fresh-stage-transition-single.log
fresh-preserve-transition-single.log

Round4 structural recovery step completed: reusable immutable creation-phase helper `90596e810` (Refs #231/#235; writer/consumer integration and exhaustive slice gates still pending). The helper keeps original host/transaction/base/inode/hash bindings through stage retirement, preserved restaging, and explicitly confirmed retirement. It refuses independently recreated files even with identical bytes. Focused native integration cases for partial-stage recovery, preserved restaging, and explicit original-state retirement each pass **1 test, 0 failures**. An independent state child remains intact and blocks retirement; retry after its removal resumes the durable decision without adopting new public data. The handoff unit/owner/optional-manifest transition remains part of the pending integrated generated-boundary gate. This comment records the completed helper step, not closure of the issue. Evidence: [fresh-inventory-native-single.log](https://git.kayg.org/attachments/e80a2df6-0859-4af1-a793-94d713680f54) [fresh-preserve-native-single.log](https://git.kayg.org/attachments/0797c38d-ce33-4885-9dcc-d04abc8de064) [fresh-explicit-retirement-native-single.log](https://git.kayg.org/attachments/0d145482-13ee-411d-932b-a30fed033f53) [fresh-stage-inventory-single.log](https://git.kayg.org/attachments/5dd89f45-94c6-4891-9bbe-dca94e85d866) [fresh-stage-transition-single.log](https://git.kayg.org/attachments/7917098a-0d47-4bc0-a7cb-c05f7f84c41f) [fresh-preserve-transition-single.log](https://git.kayg.org/attachments/580e7779-f1d1-4b29-a831-bad8cd1fa805)

kayg commented

2026-10-19 11:41:11 +00:00

Author

Owner

Round4 preserve/restart follow-up: the fresh cleanup proof now has an explicit private construction intent before inventory writes, retains original state rows across preserved restaging, and restores the saved original tree before replacing it on a repeated fresh restart. The regression has a captured red (exit71), followed by1 native test passing. Four direct proof-intent outcomes and the command-size gate also pass; exhaustive integration gates remain pending. Helper module90596e810 is committed; these integration edits remain uncommitted.

fresh-repeated-restart-red.log
fresh-repeated-restart-green.log
fresh-proof-intent-single.log
fresh-final-command-size.log

Round4 preserve/restart follow-up: the fresh cleanup proof now has an explicit private construction intent before inventory writes, retains original state rows across preserved restaging, and restores the saved original tree before replacing it on a repeated fresh restart. The regression has a captured red (exit71), followed by1 native test passing. Four direct proof-intent outcomes and the command-size gate also pass; exhaustive integration gates remain pending. Helper module90596e810 is committed; these integration edits remain uncommitted. [fresh-repeated-restart-red.log](https://git.kayg.org/attachments/f3ade68b-fc3f-4063-90ab-ee6940a2bc74) [fresh-repeated-restart-green.log](https://git.kayg.org/attachments/70bfdd9a-4d01-43be-ad46-e3d4a180710d) [fresh-proof-intent-single.log](https://git.kayg.org/attachments/c12339f7-59b3-4821-9d51-5c9d0c76ad96) [fresh-final-command-size.log](https://git.kayg.org/attachments/bdbb9624-3421-4dd3-923d-39ae465e615c)

kayg commented

2026-10-19 11:49:27 +00:00

Author

Owner

Round4 adds an acknowledged-stop phase between service stop and fresh cleanup proof publication. Its witness is an exact hardlink pair with the validated immutable plan, fsynced before public retirement, retained through destination cleanup, and finally covered by the fresh inventory. The native retry regression is green (1 passed, 0 failed), including independent acknowledgement recreation and shared-plan edit refusals; existing manager-stop refusal remains green. Three-filesystem disposable-container replay also passes. A command-size RED is recorded for the parent wrapper fix; exhaustive integration gates remain pending.

fresh-manager-stop-red.log
fresh-manager-stop-refusal-green.log
fresh-manager-stop-crossfs.log
fresh-manager-stop-command-size.log
fresh-manager-stop-green.log

Round4 adds an acknowledged-stop phase between service stop and fresh cleanup proof publication. Its witness is an exact hardlink pair with the validated immutable plan, fsynced before public retirement, retained through destination cleanup, and finally covered by the fresh inventory. The native retry regression is green (1 passed, 0 failed), including independent acknowledgement recreation and shared-plan edit refusals; existing manager-stop refusal remains green. Three-filesystem disposable-container replay also passes. A command-size RED is recorded for the parent wrapper fix; exhaustive integration gates remain pending. [fresh-manager-stop-red.log](https://git.kayg.org/attachments/1843ec42-3027-4562-a840-be9a1931abd9) [fresh-manager-stop-refusal-green.log](https://git.kayg.org/attachments/e062903b-b488-4df6-9db4-c40e574b349b) [fresh-manager-stop-crossfs.log](https://git.kayg.org/attachments/9fb50187-9d3b-4c8e-86e1-243bde414ac7) [fresh-manager-stop-command-size.log](https://git.kayg.org/attachments/dfe0b3df-eae1-4b7e-9719-aacd094b98ef) [fresh-manager-stop-green.log](https://git.kayg.org/attachments/9cbdba85-7f57-4969-8dd5-cfe066563520)

kayg referenced this issue

2026-10-19 11:58:22 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 11:58:22 +00:00

Author

Owner

Additional round4 findings and implementation proposal before code. Current-source isolated replay: pre-activation private fresh setup emits STALE (exit0); the same setup after actual ACTIVATE, with valid planned manifest and no active lease, exits71 during SSH inspection because bin/current exists. The final tree gate also rejects its public manifest and state before an outside fresh cleanup proof exists. The current generated pristine activation matrix exercises direct rollback, not inspection of each interrupted state.

Implementation proposal: inspection will reuse the production rollback identity/ancestor, original before-image and published-plan checks. It will verify current fixed public artifacts and planned state against their existing original/prepared receipts, without learning deletion authority from current public contents. Fresh journals retain the existing exact recovery coordinates. Interrupted upgrade journals need a distinct fixed classification carrying original coordinates and original installed host identity, so recovery restores the old installation rather than allocating a new host or deleting its retained state. A live original terminal remains retained; a live setup lease remains busy73. The activation oracle will add inspection and same-coordinate recovery before its existing direct rollback/retry checks, retaining strict foreign-file assertions.

Separate required #235 finding, to be implemented in the parent lane: native completed removal with retained data publishes a bound .bootstrap-removed-UID-DEV-INO-SHA256 receipt and removes the owner. Current SSH inspection and staging both require that missing owner whenever base remains, blocking re-add. The replay constructs the exact terminal receipt shape from the actual install manifest and verifies original receipt inode/hash; it does not claim native helper execution on the same fixture. #235 history explicitly requires re-add after uninstall while CA/joined-node data remains. A distinct validated terminal-completion classification can admit the next setup while retaining independent data and without resurrecting old deletion authority. This second fix is separate from the bound-journal reader.

inspection-review-direct.log
inspection-readonly-findings.md

Additional round4 findings and implementation proposal before code. Current-source isolated replay: pre-activation private fresh setup emits STALE (exit0); the same setup after actual ACTIVATE, with valid planned manifest and no active lease, exits71 during SSH inspection because bin/current exists. The final tree gate also rejects its public manifest and state before an outside fresh cleanup proof exists. The current generated pristine activation matrix exercises direct rollback, not inspection of each interrupted state. Implementation proposal: inspection will reuse the production rollback identity/ancestor, original before-image and published-plan checks. It will verify current fixed public artifacts and planned state against their existing original/prepared receipts, without learning deletion authority from current public contents. Fresh journals retain the existing exact recovery coordinates. Interrupted upgrade journals need a distinct fixed classification carrying original coordinates and original installed host identity, so recovery restores the old installation rather than allocating a new host or deleting its retained state. A live original terminal remains retained; a live setup lease remains busy73. The activation oracle will add inspection and same-coordinate recovery before its existing direct rollback/retry checks, retaining strict foreign-file assertions. Separate required #235 finding, to be implemented in the parent lane: native completed removal with retained data publishes a bound .bootstrap-removed-UID-DEV-INO-SHA256 receipt and removes the owner. Current SSH inspection and staging both require that missing owner whenever base remains, blocking re-add. The replay constructs the exact terminal receipt shape from the actual install manifest and verifies original receipt inode/hash; it does not claim native helper execution on the same fixture. #235 history explicitly requires re-add after uninstall while CA/joined-node data remains. A distinct validated terminal-completion classification can admit the next setup while retaining independent data and without resurrecting old deletion authority. This second fix is separate from the bound-journal reader. [inspection-review-direct.log](https://git.kayg.org/attachments/ec9ff749-a584-492e-b919-c633f7c8e4d1) [inspection-readonly-findings.md](https://git.kayg.org/attachments/89210018-8c84-47d5-b246-0eeb87cf10a7)

kayg referenced this issue

2026-10-19 12:30:36 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 12:30:36 +00:00

Author

Owner

Retained-base re-add design (#235): completed removal can retain state/CA/joined-node data with no owner marker. Reuse base creation custody rather than treating that ownerless pathname as fresh deletion authority. A shared read-only checker requires the original private base inode plus the terminal manifest whose filename binds uid/device/inode/SHA256 and whose original a/d row names that exact base. The initial creation intent will name that terminal before preparing a new owner and stage outside the base; each public rename uses its already-recorded prepared inode and the intent survives until both finish. The stage records original base as a (retention), original terminal as r, new owner as f, plus an empty retained-base- phase marker. Fresh rollback leaves the original base/state/data/terminal and retires only exact new creation entries. Admission additionally requires reserved activation targets absent so completion never authorizes overwriting an independently recreated live slot/unit/launcher. Existing manifest row meanings and four-field rollback receipt stay unchanged. New standalone checker tests pass for original custody and preserve/refuse recreated base, recreated same-byte terminal, edited terminal and extra hardlink. Integration and generated interruption coverage are still pending.

Retained-base re-add design (#235): completed removal can retain state/CA/joined-node data with no owner marker. Reuse base creation custody rather than treating that ownerless pathname as fresh deletion authority. A shared read-only checker requires the original private base inode plus the terminal manifest whose filename binds uid/device/inode/SHA256 and whose original a/d row names that exact base. The initial creation intent will name that terminal before preparing a new owner and stage outside the base; each public rename uses its already-recorded prepared inode and the intent survives until both finish. The stage records original base as a (retention), original terminal as r, new owner as f, plus an empty retained-base-<terminal-name> phase marker. Fresh rollback leaves the original base/state/data/terminal and retires only exact new creation entries. Admission additionally requires reserved activation targets absent so completion never authorizes overwriting an independently recreated live slot/unit/launcher. Existing manifest row meanings and four-field rollback receipt stay unchanged. New standalone checker tests pass for original custody and preserve/refuse recreated base, recreated same-byte terminal, edited terminal and extra hardlink. Integration and generated interruption coverage are still pending.

kayg commented

2026-10-19 12:34:26 +00:00

Author

Owner

Additive retained-base cleanup state machine (#231/#235)

Native removal leaves an immutable filename-bound terminal manifest and its exact original base. Re-add retains those objects: its private capsule publishes a fresh stage with original base a, original terminal r, and newly prepared owner f; an empty retained-base-<terminal basename> marker identifies this retention phase. No public scan grants ownership.

Inspection validates this marker through the shared removed_base validator before a plan exists; once a plan is bound it reuses original/prepared rollback rows. The original retained root and data are retained, while reserved activation targets still require recorded authority. The immutable fresh proof carries the original base/terminal rows through retirement. Cleanup validates both against that proof before touching any creation-bound artifacts, removes only matching f/d candidates, and leaves inherited data and the original terminal. An absent owner plus exact terminal custody is CLEAR only after the stage/admission artifacts retire. Any changed/recreated base, terminal or creation candidate is preserved and refused. Missing already-retired candidates are idempotent. Existing four-field rollback receipts remain unchanged.

Focused tests will exercise retained cleanup twice, inspection before activation/after rollback, and independent terminal/base/creation replacements. Whole generated mutation gates remain the parent serialized slice gate.

# Additive retained-base cleanup state machine (#231/#235) Native removal leaves an immutable filename-bound terminal manifest and its exact original base. Re-add retains those objects: its private capsule publishes a fresh stage with original base `a`, original terminal `r`, and newly prepared owner `f`; an empty `retained-base-<terminal basename>` marker identifies this retention phase. No public scan grants ownership. Inspection validates this marker through the shared removed_base validator before a plan exists; once a plan is bound it reuses original/prepared rollback rows. The original retained root and data are retained, while reserved activation targets still require recorded authority. The immutable fresh proof carries the original base/terminal rows through retirement. Cleanup validates both against that proof before touching any creation-bound artifacts, removes only matching `f`/`d` candidates, and leaves inherited data and the original terminal. An absent owner plus exact terminal custody is CLEAR only after the stage/admission artifacts retire. Any changed/recreated base, terminal or creation candidate is preserved and refused. Missing already-retired candidates are idempotent. Existing four-field rollback receipts remain unchanged. Focused tests will exercise retained cleanup twice, inspection before activation/after rollback, and independent terminal/base/creation replacements. Whole generated mutation gates remain the parent serialized slice gate.

kayg commented

2026-10-19 12:35:09 +00:00

Author

Owner

Bound-journal inspection now shares production rollback proof/identity readers instead of a second receipt parser. Fresh activation recovers its original coordinates; upgrade classification preserves original installed identity and live old runtime, and exact rollback restores the original inodes. Unknown/recreated public files and original private backup roots are refused unchanged. An already accepted Replace authorizes that exact interrupted-upgrade rollback without asking a second time.

Focused native gates (integration uncommitted; whole serialized gates pending):

fresh original-coordinate inspection/recovery: 1 passed; 0 failed; 25.92s, including seven independent same-byte public replacements.
upgrade inspection/recovery: initial failure on retained original mode664 reproduced; final 1 passed; 0 failed; 9.06s, including recreated original private state root refusal and live original UUID listener survival.
backend flow: RED two confirmations versus expected one; GREEN 1 passed; 0 failed; 7.05s.
command argument cap: 1 passed; 0 failed; 0.03s. Root INSPECT/fresh recovery/upgrade recovery [64315,92855,92604] bytes; rootless [64161,92701,92450], limit131072.

The separate completed-removal retained-base re-add gap remains tracked and is being implemented through original terminal/base custody; these focused results do not claim that second flow or every generated mutation cut.

inspection-fresh-native-green.log
inspection-upgrade-native-red.log
inspection-upgrade-native-green.log
inspection-upgrade-flow-red.log
inspection-upgrade-flow-green.log
inspection-recovery-command-size.log

Bound-journal inspection now shares production rollback proof/identity readers instead of a second receipt parser. Fresh activation recovers its original coordinates; upgrade classification preserves original installed identity and live old runtime, and exact rollback restores the original inodes. Unknown/recreated public files and original private backup roots are refused unchanged. An already accepted Replace authorizes that exact interrupted-upgrade rollback without asking a second time. Focused native gates (integration uncommitted; whole serialized gates pending): - fresh original-coordinate inspection/recovery: 1 passed; 0 failed; 25.92s, including seven independent same-byte public replacements. - upgrade inspection/recovery: initial failure on retained original mode664 reproduced; final 1 passed; 0 failed; 9.06s, including recreated original private state root refusal and live original UUID listener survival. - backend flow: RED two confirmations versus expected one; GREEN 1 passed; 0 failed; 7.05s. - command argument cap: 1 passed; 0 failed; 0.03s. Root INSPECT/fresh recovery/upgrade recovery [64315,92855,92604] bytes; rootless [64161,92701,92450], limit131072. The separate completed-removal retained-base re-add gap remains tracked and is being implemented through original terminal/base custody; these focused results do not claim that second flow or every generated mutation cut. [inspection-fresh-native-green.log](https://git.kayg.org/attachments/8d5a1c1e-c43b-41e0-bec4-62bef3841873) [inspection-upgrade-native-red.log](https://git.kayg.org/attachments/d00b52e2-68c7-44d4-893c-9cb4f3101c69) [inspection-upgrade-native-green.log](https://git.kayg.org/attachments/bd1ddff7-64db-45d0-bb1c-f3b90412204d) [inspection-upgrade-flow-red.log](https://git.kayg.org/attachments/318737dd-14ca-4551-8d37-3bb7c96f5dff) [inspection-upgrade-flow-green.log](https://git.kayg.org/attachments/d7b285a4-eae8-4068-b14e-594b0e4b1467) [inspection-recovery-command-size.log](https://git.kayg.org/attachments/bd06254b-9659-4331-a560-d4ac97c7eabe)

kayg commented

2026-10-19 12:47:02 +00:00

Author

Owner

Retained-base cleanup focused control RED exit72 on the original basea row; current direct actual-source test GREEN1/0 (0.50s). It preserves exact original base/terminal and notes, removes only original creator owner/bin, refuses independently recreated terminal/owner/base unchanged, and inspects ownerless completion CLEAR twice.

Activated re-add exposed two additional integration gaps: protected copied original data with mode664 was rejected during private retirement inventory (trace exact stage/replaced-state/retained-data); the explicit retained serializer policy now records those already-admitted copy identities without relaxing new-tree admission. More concretely, actual successful activation+rollback with inert manager left its exact created enablement link: native RED1/0 failure at creation-bound wanted link survived rollback (5.49s). Re-add admission correctly refused that unproven leftover. The fix keeps original wanted links and explicitly retires only exact prepared wanted identity after manager disable, with original preflight still before any manager side effect. Full activated/repeated re-add replay pending.

Both command cap controls remain GREEN2/0 (0.43s): longest253-byteDNS Root125970, rootless126196 bytes, limit131072. INSPECT/fresh/upgrade recovery Root [74463,104723,104472], rootless [74309,104569,104318]. Whole serialized slice gates remain pending.

retained-cleanup-native-red.log
retained-cleanup-native-green.log
retained-wanted-native-red.log
retained-command-size.log

Retained-base cleanup focused control RED exit72 on the original basea row; current direct actual-source test GREEN1/0 (0.50s). It preserves exact original base/terminal and notes, removes only original creator owner/bin, refuses independently recreated terminal/owner/base unchanged, and inspects ownerless completion CLEAR twice. Activated re-add exposed two additional integration gaps: protected copied original data with mode664 was rejected during private retirement inventory (trace exact stage/replaced-state/retained-data); the explicit retained serializer policy now records those already-admitted copy identities without relaxing new-tree admission. More concretely, actual successful activation+rollback with inert manager left its exact created enablement link: native RED1/0 failure at `creation-bound wanted link survived rollback` (5.49s). Re-add admission correctly refused that unproven leftover. The fix keeps original wanted links and explicitly retires only exact prepared wanted identity after manager disable, with original preflight still before any manager side effect. Full activated/repeated re-add replay pending. Both command cap controls remain GREEN2/0 (0.43s): longest253-byteDNS Root125970, rootless126196 bytes, limit131072. INSPECT/fresh/upgrade recovery Root [74463,104723,104472], rootless [74309,104569,104318]. Whole serialized slice gates remain pending. [retained-cleanup-native-red.log](https://git.kayg.org/attachments/ac871130-b404-4c84-b138-8eff6319f2cd) [retained-cleanup-native-green.log](https://git.kayg.org/attachments/837fc9ae-2110-4bd3-b5f6-e36b392fbcb7) [retained-wanted-native-red.log](https://git.kayg.org/attachments/924442ff-77d0-4337-9e99-9f3c31913b9b) [retained-command-size.log](https://git.kayg.org/attachments/3d015142-d6cf-4186-a16e-bd9818258560)

kayg commented

2026-10-19 12:47:28 +00:00

Author

Owner

Structural removal review found another pathname-derived authority path: remove_protocol_link observes an arbitrary current-UID symlink at the reserved runtime plan pathname, creates FileProof from that observation and unlinks it. The link target is safe, but the independently created link itself is not preserved as the round-4 requirement demands. Proposed additive safety behavior: unbound runtime protocol paths (including symlinks) are kept and refuse plan creation/consumption; only the existing creator-issued hardlink proof authorizes retirement. The earlier planted-plan regression will retain its original target-untouched/refusal assertions and add exact link-identity preservation, with explicit fixture cleanup between independent scenarios. The three r3 test-only commits remain unchanged. New failing preservation test precedes the fix; this is pending implementation and gates.

kayg commented

2026-10-19 12:47:53 +00:00

Author

Owner

Runtime uninstall protocol retention contract delta (#231/#235): the structural creation-proof requirement supersedes the earlier convenience of replacing an unknown owned symlink at .uninstall-plan or .uninstall-plan.staged. Unknown links must retain their UID/device/inode and target, with the operation refused; their targets are never followed or changed. Only an existing creator proof can authorize cleanup. Public-path metadata discovered during removal never creates ownership authority. The original planted-plan review is strengthened to preserve link identity/refuse both consumption and replacement while retaining its original refusal and untouched-target assertions; test code explicitly removes its own link between the independent cases. No R3 review assertion is changed. New PLAN/STAGED preservation regressions run before the production change. This follows the owner brief's stronger retention rule and requires no new permission.

Runtime uninstall protocol retention contract delta (#231/#235): the structural creation-proof requirement supersedes the earlier convenience of replacing an unknown owned symlink at `.uninstall-plan` or `.uninstall-plan.staged`. Unknown links must retain their UID/device/inode and target, with the operation refused; their targets are never followed or changed. Only an existing creator proof can authorize cleanup. Public-path metadata discovered during removal never creates ownership authority. The original planted-plan review is strengthened to preserve link identity/refuse both consumption and replacement while retaining its original refusal and untouched-target assertions; test code explicitly removes its own link between the independent cases. No R3 review assertion is changed. New PLAN/STAGED preservation regressions run before the production change. This follows the owner brief's stronger retention rule and requires no new permission.

kayg commented

2026-10-19 12:52:02 +00:00

Author

Owner

The activated retained-base restart regression exposed a proof-generation omission: the before-image retained the original state directory inode but omitted its original children. After rollback restored that original directory, fresh-proof generation filled child paths from the replacement manifest, binding copied inodes. The next preserve/restart correctly refused the mismatch. Raw trace excerpt shows the same original root inode with different original-versus-proof child inodes.

The before-image writer now records bounded original descendants BEFORE operational changes through the shared serializer, all as retention-only a/r/k. This cannot authorize deletion of inherited state and avoids retroactively capturing public paths after rollback. The existing private inode/hash journal binds these rows. The full production retained activation/inspection/re-add/preserve-restart sequence is green under diagnostic tracing; normal focused replay and final whole gates remain pending.

retained-original-state-proof-red-excerpt.log

The activated retained-base restart regression exposed a proof-generation omission: the before-image retained the original state directory inode but omitted its original children. After rollback restored that original directory, fresh-proof generation filled child paths from the replacement manifest, binding copied inodes. The next preserve/restart correctly refused the mismatch. Raw trace excerpt shows the same original root inode with different original-versus-proof child inodes. The before-image writer now records bounded original descendants BEFORE operational changes through the shared serializer, all as retention-only a/r/k. This cannot authorize deletion of inherited state and avoids retroactively capturing public paths after rollback. The existing private inode/hash journal binds these rows. The full production retained activation/inspection/re-add/preserve-restart sequence is green under diagnostic tracing; normal focused replay and final whole gates remain pending. [retained-original-state-proof-red-excerpt.log](https://git.kayg.org/attachments/5c7698df-af15-4ef3-8a5c-4da2a31ea054)

kayg commented

2026-10-19 12:53:33 +00:00

Author

Owner

Retained-base focused flow now passes on actual production generated commands. The new immutable before-image contains original retention-only descendant identities; preserve/restage carries exact terminal custody, and rollback removes only the exact prepared enablement link when there was no original link.

Final focused native output (normal, without diagnostic tracing):
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 156 filtered out; finished in 17.00s
This exercises activation → original-coordinate inspection/recovery → CLEAR twice → re-add → same-transaction preserve/restart → rollback → CLEAR twice. Original base, terminal, state directory and retained mode664 file keep the same device/inode; retained bytes survive and new owner/stage/enablement link retire.

Original upgraded installation regression after the shared reader/serializer changes:
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 156 filtered out; finished in 10.21s
It retains the old host identity/live original UUID listener, restores original public inodes, and refuses independently recreated or symlinked original private state backups plus unrecorded new public data unchanged.

Both argument-size controls:
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.11s
Longest253-byteDNS installation commands Root126693/rootless126919 bytes, below131072. INSPECT/fresh/upgrade recovery Root [74550,105021,104770], rootless [74396,104867,104616]. Owned shell syntax and git diff --check pass. Full serialized iteration/fast/static/generated matrices remain the parent integration gate; these focused receipts do not claim them complete. No integration commit or push from this lane.

retained-activation-native-green.log
retained-command-size-final.log
inspection-upgrade-native-final.log

Retained-base focused flow now passes on actual production generated commands. The new immutable before-image contains original retention-only descendant identities; preserve/restage carries exact terminal custody, and rollback removes only the exact prepared enablement link when there was no original link. Final focused native output (normal, without diagnostic tracing): `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 156 filtered out; finished in 17.00s` This exercises activation → original-coordinate inspection/recovery → CLEAR twice → re-add → same-transaction preserve/restart → rollback → CLEAR twice. Original base, terminal, state directory and retained mode664 file keep the same device/inode; retained bytes survive and new owner/stage/enablement link retire. Original upgraded installation regression after the shared reader/serializer changes: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 156 filtered out; finished in 10.21s` It retains the old host identity/live original UUID listener, restores original public inodes, and refuses independently recreated or symlinked original private state backups plus unrecorded new public data unchanged. Both argument-size controls: `test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.11s` Longest253-byteDNS installation commands Root126693/rootless126919 bytes, below131072. INSPECT/fresh/upgrade recovery Root [74550,105021,104770], rootless [74396,104867,104616]. Owned shell syntax and `git diff --check` pass. Full serialized iteration/fast/static/generated matrices remain the parent integration gate; these focused receipts do not claim them complete. No integration commit or push from this lane. [retained-activation-native-green.log](https://git.kayg.org/attachments/a652302b-55a6-43db-a21b-d10a58db5186) [retained-command-size-final.log](https://git.kayg.org/attachments/51860f38-24d5-4d6a-978b-040ee07a0e4f) [inspection-upgrade-native-final.log](https://git.kayg.org/attachments/1d68ad06-a7ea-4cec-b891-f561cf4c183e)

kayg commented

2026-10-19 13:00:27 +00:00

Author

Owner

Additive private phase admission (#231/#235)

Review controls show an empty original snapshot cannot recover and a 30-byte stopping flag is admitted; rollback also unlinks payload before inventory admission. All cleanup paths must admit typed private phase before their first unlink/manager action, including upgrade. Zero-byte operational flags are exact; transaction/kind canonical bytes and UID/mode/type are checked. Bound payload/prepared/original artifacts use existing identity/hash receipts. A new upload intent names authenticated expected hash/size before private creation; an inode/hash record follows completed verified upload. Only that explicitly unbound private upload interval permits mutable partial bytes, with owned private node and bounded size; it grants no public deletion authority. Later private enrollment state is mutable only before a bound plan and behind a verified payload. A bound plan fixes prepared/public and original backup identities; no later inventory may bless unexpected or foreign private paths.

A shared pure private-prefix predicate takes a byte-emitter function. Only active protected unbound slots may match canonical prefixes; bound/retired files always require original identity+complete hash. Snapshot streams preserve original bytes including trailing newlines. Handoff recovery validates incomplete original/prepared/owner/manifest slots against already bound original sources, then retires them after the whole preflight. This does not grant authority to public suffix files.

Failing native regressions precede source changes. Required actual syscall Replace matrices cover both pristine recovery and foreign-edit preservation; command argument cap stays131072. Whole gates remain serialized by the parent build slot.

# Additive private phase admission (#231/#235) Review controls show an empty original snapshot cannot recover and a 30-byte stopping flag is admitted; rollback also unlinks payload before inventory admission. All cleanup paths must admit typed private phase before their first unlink/manager action, including upgrade. Zero-byte operational flags are exact; transaction/kind canonical bytes and UID/mode/type are checked. Bound payload/prepared/original artifacts use existing identity/hash receipts. A new upload intent names authenticated expected hash/size before private creation; an inode/hash record follows completed verified upload. Only that explicitly unbound private upload interval permits mutable partial bytes, with owned private node and bounded size; it grants no public deletion authority. Later private enrollment state is mutable only before a bound plan and behind a verified payload. A bound plan fixes prepared/public and original backup identities; no later inventory may bless unexpected or foreign private paths. A shared pure private-prefix predicate takes a byte-emitter function. Only active protected unbound slots may match canonical prefixes; bound/retired files always require original identity+complete hash. Snapshot streams preserve original bytes including trailing newlines. Handoff recovery validates incomplete original/prepared/owner/manifest slots against already bound original sources, then retires them after the whole preflight. This does not grant authority to public suffix files. Failing native regressions precede source changes. Required actual syscall Replace matrices cover both pristine recovery and foreign-edit preservation; command argument cap stays131072. Whole gates remain serialized by the parent build slot.

kayg commented

2026-10-19 13:02:58 +00:00

Author

Owner

Committed the atomic runtime protocol-link retention fix as c898c1cad162e082da7bb3ec64e9429a41628ed0 (not pushed). Unknown PLAN/STAGED links now retain UID/device/inode/target and refuse publication/consumption. Cleanup no longer captures current pathname metadata as ownership authority; regular creator-bound receipts remain required. The original planted-plan review keeps its refusal and untouched-target assertions, adds exact link/target retention, and explicitly removes the fixture-owned link between independent cases. No R3 review assertion changed.

Before implementation both new preservation regressions failed. For the atomic commit gate, the module was temporarily set to HEAD plus only the symlink policy hunk under the shared flock/build slot; pending container/hash/sort/cold work was restored byte-for-byte in an EXIT trap before unlocking. Thus the gate tests the exact staged source, not the combined size experiment.

Commands: touched rustfmt --check; cargo test --locked -p infraternal-plugin-remote --features agent,test-support,tokio/rt-multi-thread uninstall -- --nocapture; cargo clippy --locked -p infraternal-plugin-remote --all-targets --features agent,test-support,tokio/rt-multi-thread -- -D warnings. Verbatim gate output:

REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=966 resume_and_repeat_calls=2016
test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 28.86s
    Checking infraternal-plugin-remote v0.1.0
    Finished dev profile [unoptimized + debuginfo] target(s) in 5.04s

The full raw output is attached; fmt and wrapper exited zero. Full branch gate, final binary size and newly reported active-manifest reload authority finding remain parent-job work.

runtime-unbound-symlink-red.log
runtime-unbound-symlink-atomic-gate.log

Committed the atomic runtime protocol-link retention fix as `c898c1cad162e082da7bb3ec64e9429a41628ed0` (not pushed). Unknown PLAN/STAGED links now retain UID/device/inode/target and refuse publication/consumption. Cleanup no longer captures current pathname metadata as ownership authority; regular creator-bound receipts remain required. The original planted-plan review keeps its refusal and untouched-target assertions, adds exact link/target retention, and explicitly removes the fixture-owned link between independent cases. No R3 review assertion changed. Before implementation both new preservation regressions failed. For the atomic commit gate, the module was temporarily set to HEAD plus only the symlink policy hunk under the shared flock/build slot; pending container/hash/sort/cold work was restored byte-for-byte in an EXIT trap before unlocking. Thus the gate tests the exact staged source, not the combined size experiment. Commands: touched `rustfmt --check`; `cargo test --locked -p infraternal-plugin-remote --features agent,test-support,tokio/rt-multi-thread uninstall -- --nocapture`; `cargo clippy --locked -p infraternal-plugin-remote --all-targets --features agent,test-support,tokio/rt-multi-thread -- -D warnings`. Verbatim gate output: ``` REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=966 resume_and_repeat_calls=2016 test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 28.86s Checking infraternal-plugin-remote v0.1.0 Finished dev profile [unoptimized + debuginfo] target(s) in 5.04s ``` The full raw output is attached; fmt and wrapper exited zero. Full branch gate, final binary size and newly reported active-manifest reload authority finding remain parent-job work. [runtime-unbound-symlink-red.log](https://git.kayg.org/attachments/79f069f1-f7d3-4da5-8fd4-04dcc1c7c085) [runtime-unbound-symlink-atomic-gate.log](https://git.kayg.org/attachments/634ee609-78e8-4fad-945b-cae1d0133330)

kayg commented

2026-10-19 13:04:47 +00:00

Author

Owner

Exact raw gate excerpt for c898c1cad162e082da7bb3ec64e9429a41628ed0 below. The earlier completion comment abbreviated the Clippy path and formatting; these are the literal lines from the attached atomic gate log.

REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=966 resume_and_repeat_calls=2016
test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 28.86s
    Checking infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.04s

Exact raw gate excerpt for `c898c1cad162e082da7bb3ec64e9429a41628ed0` below. The earlier completion comment abbreviated the Clippy path and formatting; these are the literal lines from the attached atomic gate log. ``` REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=966 resume_and_repeat_calls=2016 test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 28.86s Checking infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote) Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.04s ```

kayg commented

2026-10-19 13:20:40 +00:00

Author

Owner

Additive creation-receipt contract (#231/#235): an active manifest's content is not proof that setup created its inode. The failing restart regression copies identical valid bytes into a new owned private inode and currently authorizes deletion (active-manifest-reload-red.log: 0 passed; 1 failed).

Setup will bind the complete prepared receipt before publication with an immutable selfnamed hardlink .bootstrap-manifest-UID-DEV-INO-SHA256. The fixed active name must refer to that exact inode. Native recovery validates the encoded identity and digest before accepting active, anchor-only interrupted retirement, or completion transitions. Only exact known peer links explain link counts; unknown aliases and identical independent replacements are retained/refused. Terminal publication is link/fsync/unlink; a mature terminal retains its original selfnamed proof.

Private manifest writes will have intended complete SHA recorded before creation and an inode/digest proof before public mutation. Canonical prefixes are recognized only in an explicitly unbound protected preparation phase and never authorize public deletion. Planned/ready copies have their own inode proofs. Rollback restores a creator-bound original inode where available; observing or copying a legacy manifest grants no deletion authority. Old anchors retire only from previously bound journal identities. This extends D17/D243/D273 without a new dependency or protocol parser.

Additive creation-receipt contract (#231/#235): an active manifest's content is not proof that setup created its inode. The failing restart regression copies identical valid bytes into a new owned private inode and currently authorizes deletion (active-manifest-reload-red.log: 0 passed; 1 failed). Setup will bind the complete prepared receipt before publication with an immutable selfnamed hardlink `.bootstrap-manifest-UID-DEV-INO-SHA256`. The fixed active name must refer to that exact inode. Native recovery validates the encoded identity and digest before accepting active, anchor-only interrupted retirement, or completion transitions. Only exact known peer links explain link counts; unknown aliases and identical independent replacements are retained/refused. Terminal publication is link/fsync/unlink; a mature terminal retains its original selfnamed proof. Private manifest writes will have intended complete SHA recorded before creation and an inode/digest proof before public mutation. Canonical prefixes are recognized only in an explicitly unbound protected preparation phase and never authorize public deletion. Planned/ready copies have their own inode proofs. Rollback restores a creator-bound original inode where available; observing or copying a legacy manifest grants no deletion authority. Old anchors retire only from previously bound journal identities. This extends D17/D243/D273 without a new dependency or protocol parser.

kayg commented

2026-10-19 13:30:31 +00:00

Author

Owner

Creation-receipt reload finding: native RED reproduced independently recreated identical manifest bytes gaining authority after restart: test result: FAILED. 0 passed; 1 failed.

The additive creator-anchor contract posted above is now implemented in the writer/consumer working tree. Actual-function checks pass for selfnamed anchor publication, refusal of an identical independently recreated active receipt, canonical unbound manifest prefixes at 0/1/31/128 bytes, and refusal of an identical-byte replacement of the bound planned copy. The exact original/replacement inode identities remain intact. Shared reader admission uses immutable inode/hash bindings; pending canonical-prefix admission is restricted to protected preparation.

These function checks are preliminary evidence. Native restart GREEN, typed private admission, full rollback/handoff matrices, Clippy and size/cap gates remain pending; no completion claim or push.

Creation-receipt reload finding: [native RED](https://git.kayg.org/attachments/dca690c5-86c7-4ed9-91b5-7fd8dc6dc181) reproduced independently recreated identical manifest bytes gaining authority after restart: `test result: FAILED. 0 passed; 1 failed`. The additive creator-anchor contract posted above is now implemented in the writer/consumer working tree. [Actual-function checks](https://git.kayg.org/attachments/843b1920-ede7-44d3-8478-c45e76b607c2) pass for selfnamed anchor publication, refusal of an identical independently recreated active receipt, canonical unbound manifest prefixes at 0/1/31/128 bytes, and refusal of an identical-byte replacement of the bound planned copy. The exact original/replacement inode identities remain intact. Shared reader admission uses immutable inode/hash bindings; pending canonical-prefix admission is restricted to protected preparation. These function checks are preliminary evidence. Native restart GREEN, typed private admission, full rollback/handoff matrices, Clippy and size/cap gates remain pending; no completion claim or push.

kayg commented

2026-10-19 13:36:29 +00:00

Author

Owner

Additive compatibility choice (#231/#235): a valid legacy receipt without a creator anchor is retention-only evidence. Host handoff will persist bound versus legacy in its intent/retired phase name before writes. An exact preexisting creator alias permits inherited creation rows to remain; the legacy branch downgrades inherited f→r, d→a and l→k. Only the newly prepared, identity-bound unit and owner receive new f rows. No-manifest legacy handoff remains supported.

Recovery uses the persisted choice and never strengthens legacy authority because a new alias now exists. The canonical transform validates the header, allowed paths and record grammar before emitting either branch. This preserves legacy upgrade compatibility without retroactively adopting existing data for deletion. New regressions will cover anchored preservation and unanchored downgrade; gates remain pending.

Additive compatibility choice (#231/#235): a valid legacy receipt without a creator anchor is retention-only evidence. Host handoff will persist `bound` versus `legacy` in its intent/retired phase name before writes. An exact preexisting creator alias permits inherited creation rows to remain; the legacy branch downgrades inherited f→r, d→a and l→k. Only the newly prepared, identity-bound unit and owner receive new f rows. No-manifest legacy handoff remains supported. Recovery uses the persisted choice and never strengthens legacy authority because a new alias now exists. The canonical transform validates the header, allowed paths and record grammar before emitting either branch. This preserves legacy upgrade compatibility without retroactively adopting existing data for deletion. New regressions will cover anchored preservation and unanchored downgrade; gates remain pending.

kayg commented

2026-10-19 13:40:00 +00:00

Author

Owner

P2 repeated-removal reporting reproduced at the intended assertion: role unit: [], test result: FAILED. 0 passed; 1 failed (terminal-reserved-report-red2.log). A valid completion receipt prevented any later reserved entrypoint from being reported. The read-only completion path will retain and report present unit/wanted/launcher/current and other reserved protocol paths on every repeat; completion confers no deletion authority or service-manager action. Ordinary retained data preserves the established completed no-op.

The P1 current-source restart regression is now GREEN: test result: ok. 1 passed; 0 failed (active-manifest-reload-green2.log). Full native generated-cut coverage and combined producer/private-reader gates remain pending. An earlier intermediate fixture-only anchor hash mismatch was corrected at fixture publication before these intended RED/GREEN runs; it is not counted as behavioral RED evidence.
terminal-reserved-report-red2.log
active-manifest-reload-green2.log

P2 repeated-removal reporting reproduced at the intended assertion: `role unit: []`, `test result: FAILED. 0 passed; 1 failed` (terminal-reserved-report-red2.log). A valid completion receipt prevented any later reserved entrypoint from being reported. The read-only completion path will retain and report present unit/wanted/launcher/current and other reserved protocol paths on every repeat; completion confers no deletion authority or service-manager action. Ordinary retained data preserves the established completed no-op. The P1 current-source restart regression is now GREEN: `test result: ok. 1 passed; 0 failed` (active-manifest-reload-green2.log). Full native generated-cut coverage and combined producer/private-reader gates remain pending. An earlier intermediate fixture-only anchor hash mismatch was corrected at fixture publication before these intended RED/GREEN runs; it is not counted as behavioral RED evidence. [terminal-reserved-report-red2.log](https://git.kayg.org/attachments/99b96b3a-5777-4a70-b7c0-c1826793b667) [active-manifest-reload-green2.log](https://git.kayg.org/attachments/947e1b57-d43a-489b-a86b-c006c7879f4e)

kayg commented

2026-10-19 13:41:55 +00:00

Author

Owner

Round 4 private-phase follow-up: a focused real generated enrollment fixture withholds the reply after JOIN created its private state, then adds an independent same-UID private child. Current rollback succeeds and removes that child. This is a confirmed gap beyond zero-byte flag validation; evidence/private-workspace-native-red.log records the failure (0.89s).

The protected upload/enrollment phase must admit only its producer's known identity slots plus retained copies proven by an immutable pre-copy original receipt. Unknown descendants must refuse before any cleanup or manager mutation, rather than being inventoried from their current bytes as a new deletion proof. Bound prepared/published trees continue to require their exact inode/hash receipts. The proposed early before-image for the separately confirmed stale-copy race provides original retention custody without granting original data deletion authority. No public scan or byte-identical inode recreation can acquire creator proof.

The earlier actual syscall Replace properties passed all 45 observed cuts each (pristine 737.18s; independent variants 793.98s); those receipts predate the final creator-alias integration and are not the final candidate gate. Final properties will run in resumable short batches with per-cut receipts and the same assertions.

Round 4 private-phase follow-up: a focused real generated enrollment fixture withholds the reply after JOIN created its private state, then adds an independent same-UID private child. Current rollback succeeds and removes that child. This is a confirmed gap beyond zero-byte flag validation; evidence/private-workspace-native-red.log records the failure (0.89s). The protected upload/enrollment phase must admit only its producer's known identity slots plus retained copies proven by an immutable pre-copy original receipt. Unknown descendants must refuse before any cleanup or manager mutation, rather than being inventoried from their current bytes as a new deletion proof. Bound prepared/published trees continue to require their exact inode/hash receipts. The proposed early before-image for the separately confirmed stale-copy race provides original retention custody without granting original data deletion authority. No public scan or byte-identical inode recreation can acquire creator proof. The earlier actual syscall Replace properties passed all 45 observed cuts each (pristine 737.18s; independent variants 793.98s); those receipts predate the final creator-alias integration and are not the final candidate gate. Final properties will run in resumable short batches with per-cut receipts and the same assertions.

kayg commented

2026-10-19 13:42:27 +00:00

Author

Owner

P1 copy-lineage finding: a real JOIN copied retained state version one, then the original public file changed to version two before ACTIVATE. The current late before-image treated version two as an original backup and commit deleted it while retaining stale copied version one. Native RED: commit retired version two and retained stale version-one copy (private-copy-lineage-native-red2.log).

Fix contract: publish the immutable retention-only before-image BEFORE JOIN copies public state, then require every original public identity/content/ancestor to match that snapshot before activation can stop the service or replace public artifacts. Activation never refreshes the snapshot. A changed original refuses and remains intact; observing an original file grants no deletion authority. Canonical snapshot emission is shared with recovery and remains bounded. Unbound private prefixes remain restricted to their protected preparation phase.
private-copy-lineage-native-red2.log

P1 copy-lineage finding: a real JOIN copied retained state version one, then the original public file changed to version two before ACTIVATE. The current late before-image treated version two as an original backup and commit deleted it while retaining stale copied version one. Native RED: `commit retired version two and retained stale version-one copy` (private-copy-lineage-native-red2.log). Fix contract: publish the immutable retention-only before-image BEFORE JOIN copies public state, then require every original public identity/content/ancestor to match that snapshot before activation can stop the service or replace public artifacts. Activation never refreshes the snapshot. A changed original refuses and remains intact; observing an original file grants no deletion authority. Canonical snapshot emission is shared with recovery and remains bounded. Unbound private prefixes remain restricted to their protected preparation phase. [private-copy-lineage-native-red2.log](https://git.kayg.org/attachments/0a4f0749-2fde-478a-83a1-859889f4802c)

kayg commented

2026-10-19 13:43:45 +00:00

Author

Owner

The original/copy race is confirmed with exact real-file evidence. After generated JOIN copied retained state, the fixture changed the original public file to version two before ACTIVATE. The original was UID1001, device2049, inode6684684, SHA25611f6d299bf06d45dd2c4440abce3edd26bb2dc36e87b72c5dfaaad8f7e2e33fd. The copied version one was UID1001, device2049, inode6684705, SHA25687ce22890d2a86a380640b00317f4f8edb96362cf90d7a319b04e6321561aceb. Both were private600 fixture files.

Current commit succeeded and retired the original version two, retaining stale version one. Exact native regression: fresh_cleanup_round4::private_preflight::original_changes_after_private_copy_never_disappear_on_commit; RED, 0passed/1failed, 6.00s; assertion commit retired version two and retained its stale version-one copy. Raw receipt: evidence/private-copy-lineage-native-red3.log.

The proposed correction publishes the original retention-only before-image before the private copy and revalidates that original proof before activation can stop the manager or replace public artifacts. It must not refresh that proof from later observed bytes. Original data remains retention-only; this change creates no new deletion authority.

The original/copy race is confirmed with exact real-file evidence. After generated JOIN copied retained state, the fixture changed the original public file to version two before ACTIVATE. The original was UID1001, device2049, inode6684684, SHA25611f6d299bf06d45dd2c4440abce3edd26bb2dc36e87b72c5dfaaad8f7e2e33fd. The copied version one was UID1001, device2049, inode6684705, SHA25687ce22890d2a86a380640b00317f4f8edb96362cf90d7a319b04e6321561aceb. Both were private600 fixture files. Current commit succeeded and retired the original version two, retaining stale version one. Exact native regression: fresh_cleanup_round4::private_preflight::original_changes_after_private_copy_never_disappear_on_commit; RED, 0passed/1failed, 6.00s; assertion `commit retired version two and retained its stale version-one copy`. Raw receipt: evidence/private-copy-lineage-native-red3.log. The proposed correction publishes the original retention-only before-image before the private copy and revalidates that original proof before activation can stop the manager or replace public artifacts. It must not refresh that proof from later observed bytes. Original data remains retention-only; this change creates no new deletion authority.

kayg commented

2026-10-19 13:48:55 +00:00

Author

Owner

Manifest writer finding during P1 integration: a small actual-function oracle inserts an independent regular file at stage/planned-manifest after the initial absence check and immediately before copying. The existing cp overwrites its bytes and setup returns zero, then binds that unrelated inode. RED: manifest-copy-clobber-red.log (writer exit=0; independent bytes replaced by receipt body).

The writer will create regular snapshot/planned copies with canonical bytes through the existing strict-shell noclobber redirection instead of overwriting copy semantics. A competing destination must refuse unchanged; no later inode binding may adopt it. Legacy original-inode backup already uses no-clobber hardlink publication. This is part of the creator-bound receipt contract, not an expansion of deletion authority.

Manifest writer finding during P1 integration: a small actual-function oracle inserts an independent regular file at `stage/planned-manifest` after the initial absence check and immediately before copying. The existing `cp` overwrites its bytes and setup returns zero, then binds that unrelated inode. RED: manifest-copy-clobber-red.log (writer exit=0; independent bytes replaced by receipt body). The writer will create regular snapshot/planned copies with canonical bytes through the existing strict-shell noclobber redirection instead of overwriting copy semantics. A competing destination must refuse unchanged; no later inode binding may adopt it. Legacy original-inode backup already uses no-clobber hardlink publication. This is part of the creator-bound receipt contract, not an expansion of deletion authority.

kayg commented

2026-10-19 13:49:24 +00:00

Author

Owner

Round 4 native producer contract proposal: enrollment currently writes a named identity-UUID.pending regular file with write_all. A short write or interruption can leave an opaque private prefix that SSH cannot safely distinguish from an unrelated file. A filename pattern or current-directory inventory cannot create ownership proof.

Use the existing Linux anonymous regular-file primitive (O_TMPFILE), without a new dependency or storage engine. Write and fsync the identity while unnamed. A failed/short/interrupted write closes an unnamed inode; no partial secret file has a cleanup pathname. After the complete bytes are checked, persist expected nonce/role/size/digest and the actual UID/device/inode proof before linking the completed inode under its canonical private/public preparation name. Publication remains no-clobber; replacement validates the earlier identity before rename. The outer setup retains this creator proof until its own manifest has consumed the exact identity inode. Unexpected/recreated named files are preserved/refused. Unsupported anonymous-file publication fails explicitly before replacing the existing identity; no named partial-write fallback.

Rootless owned-fixture probe is GREEN at UID1001: O_TMPFILE600, full write+fsync, linkat via /proc/self/fd with AT_SYMLINK_FOLLOW preserved exact inode; an EEXIST collision retained the independent file; a targeted child wrote seven bytes then was killed, leaving no named partial inode. Receipt evidence/native-anonymous-file-probe.log. The superseded secret-in-symlink proposal is rejected because normal path diagnostics could disclose its target. No secret bytes enter argv, logs, journal filenames or symlink targets.

Next gates: actual native writer short-write/link/rename interruption tests, strict independent-replacement variants, filesystem support/refusal coverage, and syscall/latency/size measurement. This is a proposal plus successful primitive probe, not a completed native producer implementation.

Round 4 native producer contract proposal: enrollment currently writes a named identity-UUID.pending regular file with write_all. A short write or interruption can leave an opaque private prefix that SSH cannot safely distinguish from an unrelated file. A filename pattern or current-directory inventory cannot create ownership proof. Use the existing Linux anonymous regular-file primitive (O_TMPFILE), without a new dependency or storage engine. Write and fsync the identity while unnamed. A failed/short/interrupted write closes an unnamed inode; no partial secret file has a cleanup pathname. After the complete bytes are checked, persist expected nonce/role/size/digest and the actual UID/device/inode proof before linking the completed inode under its canonical private/public preparation name. Publication remains no-clobber; replacement validates the earlier identity before rename. The outer setup retains this creator proof until its own manifest has consumed the exact identity inode. Unexpected/recreated named files are preserved/refused. Unsupported anonymous-file publication fails explicitly before replacing the existing identity; no named partial-write fallback. Rootless owned-fixture probe is GREEN at UID1001: O_TMPFILE600, full write+fsync, linkat via /proc/self/fd with AT_SYMLINK_FOLLOW preserved exact inode; an EEXIST collision retained the independent file; a targeted child wrote seven bytes then was killed, leaving no named partial inode. Receipt evidence/native-anonymous-file-probe.log. The superseded secret-in-symlink proposal is rejected because normal path diagnostics could disclose its target. No secret bytes enter argv, logs, journal filenames or symlink targets. Next gates: actual native writer short-write/link/rename interruption tests, strict independent-replacement variants, filesystem support/refusal coverage, and syscall/latency/size measurement. This is a proposal plus successful primitive probe, not a completed native producer implementation.

kayg commented

2026-10-19 13:51:50 +00:00

Author

Owner

Round 4 native producer contract proposal: enrollment currently writes a named identity-UUID.pending regular file with write_all. A short write or interruption can leave an opaque private prefix that SSH cannot safely distinguish from an unrelated file. A filename pattern or current-directory inventory cannot create ownership proof.

Use the existing Linux anonymous regular-file primitive (O_TMPFILE), without a new dependency or storage engine. Write and fsync the identity while unnamed. A failed/short/interrupted write closes an unnamed inode; no partial secret file has a cleanup pathname. After the complete bytes are checked, persist expected nonce/role/size/digest and the actual UID/device/inode proof before linking the completed inode under its canonical private/public preparation name. Publication remains no-clobber; replacement validates the earlier identity before rename. The outer setup retains this creator proof until its own manifest has consumed the exact identity inode. Unexpected/recreated named files are preserved/refused. Unsupported anonymous-file publication fails explicitly before replacing the existing identity; no named partial-write fallback.

Rootless owned-fixture probe is GREEN at UID1001: O_TMPFILE600, full write+fsync, linkat via /proc/self/fd with AT_SYMLINK_FOLLOW preserved exact inode; an EEXIST collision retained the independent file; a targeted child wrote seven bytes then was killed, leaving no named partial inode. Receipt evidence/native-anonymous-file-probe.log. The superseded secret-in-symlink proposal is rejected because normal path diagnostics could disclose its target. No secret bytes enter argv, logs, journal filenames or symlink targets.

Next gates: actual native writer short-write/link/rename interruption tests, strict independent-replacement variants, filesystem support/refusal coverage, and syscall/latency/size measurement. This is a proposal plus successful primitive probe, not a completed native producer implementation.

Approved implementation placement/API: reuse infraternal-plugin-remote::identity_journal behind its existing agent feature, which already enables nix/fs, openssl and uuid. No Cargo dependency or new crate/engine is introduced. Native join_with_journal accepts an optional public transaction directory path; the hidden bootstrap_journal CLI input is declared through existing action definitions. Journal::prepare probes anonymous creation/proc-fd no-clobber linking before invitation redemption. Journal::publish receives complete bytes plus a callback revalidating the previous copied identity before replacement. The isolated recovery-helper invokes this same shipping writer for generated fixture enrollment, rather than imitating anonymous writes in shell. Ordinary non-bootstrap publish/replace behavior stays compatible.

Round 4 native producer contract proposal: enrollment currently writes a named identity-UUID.pending regular file with write_all. A short write or interruption can leave an opaque private prefix that SSH cannot safely distinguish from an unrelated file. A filename pattern or current-directory inventory cannot create ownership proof. Use the existing Linux anonymous regular-file primitive (O_TMPFILE), without a new dependency or storage engine. Write and fsync the identity while unnamed. A failed/short/interrupted write closes an unnamed inode; no partial secret file has a cleanup pathname. After the complete bytes are checked, persist expected nonce/role/size/digest and the actual UID/device/inode proof before linking the completed inode under its canonical private/public preparation name. Publication remains no-clobber; replacement validates the earlier identity before rename. The outer setup retains this creator proof until its own manifest has consumed the exact identity inode. Unexpected/recreated named files are preserved/refused. Unsupported anonymous-file publication fails explicitly before replacing the existing identity; no named partial-write fallback. Rootless owned-fixture probe is GREEN at UID1001: O_TMPFILE600, full write+fsync, linkat via /proc/self/fd with AT_SYMLINK_FOLLOW preserved exact inode; an EEXIST collision retained the independent file; a targeted child wrote seven bytes then was killed, leaving no named partial inode. Receipt evidence/native-anonymous-file-probe.log. The superseded secret-in-symlink proposal is rejected because normal path diagnostics could disclose its target. No secret bytes enter argv, logs, journal filenames or symlink targets. Next gates: actual native writer short-write/link/rename interruption tests, strict independent-replacement variants, filesystem support/refusal coverage, and syscall/latency/size measurement. This is a proposal plus successful primitive probe, not a completed native producer implementation. Approved implementation placement/API: reuse infraternal-plugin-remote::identity_journal behind its existing agent feature, which already enables nix/fs, openssl and uuid. No Cargo dependency or new crate/engine is introduced. Native join_with_journal accepts an optional public transaction directory path; the hidden bootstrap_journal CLI input is declared through existing action definitions. Journal::prepare probes anonymous creation/proc-fd no-clobber linking before invitation redemption. Journal::publish receives complete bytes plus a callback revalidating the previous copied identity before replacement. The isolated recovery-helper invokes this same shipping writer for generated fixture enrollment, rather than imitating anonymous writes in shell. Ordinary non-bootstrap publish/replace behavior stays compatible.

kayg commented

2026-10-19 13:52:02 +00:00

Author

Owner

Current native uninstall consumer gate:

REMOVAL_OBSERVER leftovers=false actual_mutation_cuts=23 candidate_paths=24 terminal_links=0
REMOVAL_OBSERVER leftovers=true actual_mutation_cuts=21 candidate_paths=24 terminal_links=1
REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464
test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 35.12s

The generated matrix now includes the creator anchor and identical valid receipt copies at every actual cut, alongside unexpected-byte recreation. The restart-origin and repeated completed-entrypoint reporting regressions pass. Creation-time fixture adapters publish the chosen receipt/ancestor rows before each scenario and the no-receipt legacy fixture removes both receipt names; original preservation/no-op assertions remain intact.

Actual-function checks also pass for initial and manual-ready prefixes, strict planned-copy identity, early source-v2/copy-v1 refusal with both inode/hash pairs retained, and refusal of a late independent planned-copy destination. Touched-crate Clippy and combined producer/reader integration gates remain pending; no completion claim or push.
manifest-origin-native-full3.log
manifest-origin-functions-green2.log
manifest-copy-clobber-red.log
manifest-copy-clobber-green.log

Current native uninstall consumer gate: ```text REMOVAL_OBSERVER leftovers=false actual_mutation_cuts=23 candidate_paths=24 terminal_links=0 REMOVAL_OBSERVER leftovers=true actual_mutation_cuts=21 candidate_paths=24 terminal_links=1 REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464 test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 98 filtered out; finished in 35.12s ``` The generated matrix now includes the creator anchor and identical valid receipt copies at every actual cut, alongside unexpected-byte recreation. The restart-origin and repeated completed-entrypoint reporting regressions pass. Creation-time fixture adapters publish the chosen receipt/ancestor rows before each scenario and the no-receipt legacy fixture removes both receipt names; original preservation/no-op assertions remain intact. Actual-function checks also pass for initial and manual-ready prefixes, strict planned-copy identity, early source-v2/copy-v1 refusal with both inode/hash pairs retained, and refusal of a late independent planned-copy destination. Touched-crate Clippy and combined producer/reader integration gates remain pending; no completion claim or push. [manifest-origin-native-full3.log](https://git.kayg.org/attachments/775b2553-be3b-47c6-9b19-270f499921a5) [manifest-origin-functions-green2.log](https://git.kayg.org/attachments/5dd3ac82-28b9-4bce-a938-50a6af54a93c) [manifest-copy-clobber-red.log](https://git.kayg.org/attachments/df9d9f25-ebf3-4937-9794-daedec1ef219) [manifest-copy-clobber-green.log](https://git.kayg.org/attachments/83bed52b-4e5b-48c1-addb-3a5536d5b065)

kayg commented

2026-10-19 13:55:04 +00:00

Author

Owner

Creation-receipt binding finding reproduced by actual writer functions: after the intended SHA was recorded, a sync barrier appended a valid f row for independent data to the unbound manifest. The writer captured the changed digest as its inode proof and published the unrelated path: writer exit=0; unknown path adopted=True, uid1001/device2049/inode3578556/SHA256 2d9c3dfbd45d7cc3f116121ac8a5801b29d108d3176097b8d2d4b96595c2e877 (manifest-pending-binding-red.log).

The common binding operation must compare the complete file digest with the immutable pending intended digest BEFORE creating an inode proof. It will cover initial, planned, ready and before-image receipts; original snapshot copies must likewise match the original bound digest before their own copy-inode proof. Unknown bytes remain unchanged and refuse publication. A valid-looking current row cannot override the intended canonical stream.

Creation-receipt binding finding reproduced by actual writer functions: after the intended SHA was recorded, a sync barrier appended a valid f row for independent data to the unbound manifest. The writer captured the changed digest as its inode proof and published the unrelated path: `writer exit=0; unknown path adopted=True`, uid1001/device2049/inode3578556/SHA256 2d9c3dfbd45d7cc3f116121ac8a5801b29d108d3176097b8d2d4b96595c2e877 (manifest-pending-binding-red.log). The common binding operation must compare the complete file digest with the immutable pending intended digest BEFORE creating an inode proof. It will cover initial, planned, ready and before-image receipts; original snapshot copies must likewise match the original bound digest before their own copy-inode proof. Unknown bytes remain unchanged and refuse publication. A valid-looking current row cannot override the intended canonical stream.

kayg commented

2026-10-19 13:58:24 +00:00

Author

Owner

Native producer implementation is now present in the existing remote plugin's agent feature; no dependency or new engine was added. The internal join_with_journal/hidden bootstrap_journal path opts in, probes anonymous-file/proc-link capability before enrollment redemption, and preserves ordinary writer compatibility. The isolated recovery-helper delegates to the same shipping Journal writer, so subsequent generated syscall coverage can observe the real anonymous writer rather than a shell imitation.

Focused native outcomes: fresh+replacement creator-proof ordering passed1/failed0, 0.14s; an actual seven-byte anonymous write followed by injected WriteZero passed1/failed0 with no named opaque prefix; independent destination collision and injected unsupported capability passed1/failed0, preserving the original identity. Rootless primitive probe also covered targeted writer-child SIGKILL. Current candidate still needs rebuilt helper, generated every-boundary products, native all-target compilation/Clippy, static size and paired latency measurement; these focused results do not establish completion.

The Linux documentation supports the chosen semantics: open(2), O_TMPFILE documents unnamed inode reclamation and proc-fd publication without CAP_DAC_READ_SEARCH; link(2) states that an existing destination is not overwritten. Root saved the primary-source receipt at evidence/linux-open-source.md. O_EXCL is deliberately absent because it would prevent later linking.

Native producer implementation is now present in the existing remote plugin's agent feature; no dependency or new engine was added. The internal join_with_journal/hidden bootstrap_journal path opts in, probes anonymous-file/proc-link capability before enrollment redemption, and preserves ordinary writer compatibility. The isolated recovery-helper delegates to the same shipping Journal writer, so subsequent generated syscall coverage can observe the real anonymous writer rather than a shell imitation. Focused native outcomes: fresh+replacement creator-proof ordering passed1/failed0, 0.14s; an actual seven-byte anonymous write followed by injected WriteZero passed1/failed0 with no named opaque prefix; independent destination collision and injected unsupported capability passed1/failed0, preserving the original identity. Rootless primitive probe also covered targeted writer-child SIGKILL. Current candidate still needs rebuilt helper, generated every-boundary products, native all-target compilation/Clippy, static size and paired latency measurement; these focused results do not establish completion. The Linux documentation supports the chosen semantics: [open(2), O_TMPFILE](https://man7.org/linux/man-pages/man2/open.2.html) documents unnamed inode reclamation and proc-fd publication without CAP_DAC_READ_SEARCH; [link(2)](https://man7.org/linux/man-pages/man2/link.2.html) states that an existing destination is not overwritten. Root saved the primary-source receipt at evidence/linux-open-source.md. O_EXCL is deliberately absent because it would prevent later linking.

kayg commented

2026-10-19 14:03:02 +00:00

Author

Owner

Native runtime-plan preparation gap reproduced: interrupt immediately after actual .uninstall-plan.staged creation, before bytes or creator anchor. The next request is blocked by the unbound reserved file. RED: interrupted preparation left unbound reserved bytes, 0 passed; 1 failed (runtime-plan-create-red.log).

Preparation will reuse the shared anonymous-inode primitive: write and sync through an unnamed descriptor, compute the creator UID/device/inode/digest there, publish its selfnamed creator anchor first, then link the reserved staged name without replacement. Any interrupted short write has no named artifact. Unarmed staged plans may retire only through their original selfnamed creator proof and exact local context; unknown reserved regular files and symlinks remain unchanged/refused. Armed plans retain their existing acknowledgement/consumer contract. Generated native protocol-operation cuts will cover creation, writing, syncing, linking, arming and consumption in addition to the existing cleanup matrix; no exhaustive preparation claim precedes that gate.

Native runtime-plan preparation gap reproduced: interrupt immediately after actual `.uninstall-plan.staged` creation, before bytes or creator anchor. The next request is blocked by the unbound reserved file. RED: `interrupted preparation left unbound reserved bytes`, `0 passed; 1 failed` (runtime-plan-create-red.log). Preparation will reuse the shared anonymous-inode primitive: write and sync through an unnamed descriptor, compute the creator UID/device/inode/digest there, publish its selfnamed creator anchor first, then link the reserved staged name without replacement. Any interrupted short write has no named artifact. Unarmed staged plans may retire only through their original selfnamed creator proof and exact local context; unknown reserved regular files and symlinks remain unchanged/refused. Armed plans retain their existing acknowledgement/consumer contract. Generated native protocol-operation cuts will cover creation, writing, syncing, linking, arming and consumption in addition to the existing cleanup matrix; no exhaustive preparation claim precedes that gate.

kayg commented

2026-10-19 14:05:40 +00:00

Author

Owner

Confirmed another entrypoint to the same private-preflight invariant. Actual restart_setup_with on a fresh private JOIN stage, after adding independent nonempty activating bytes, returned refusal only AFTER moving the state tree into the public base. Native regression restart_retention_admits_complete_private_phase_before_moving_state fails retained before admission: flag (0passed/1failed,0.98s); evidence/private-restart-retain-native-red.log. The regression also covers an independent private state child.

The correction places the SAME complete pure phase validator before orphan-proof retirement or retain/inventory/move actions. An already retired/preserved stage uses its immutable original inventory admission rather than trying to mint a new private proof. This is an ordering correction to the existing strict contract, not a per-flag exception or new deletion authority.

Confirmed another entrypoint to the same private-preflight invariant. Actual restart_setup_with on a fresh private JOIN stage, after adding independent nonempty activating bytes, returned refusal only AFTER moving the state tree into the public base. Native regression restart_retention_admits_complete_private_phase_before_moving_state fails `retained before admission: flag` (0passed/1failed,0.98s); evidence/private-restart-retain-native-red.log. The regression also covers an independent private state child. The correction places the SAME complete pure phase validator before orphan-proof retirement or retain/inventory/move actions. An already retired/preserved stage uses its immutable original inventory admission rather than trying to mint a new private proof. This is an ordering correction to the existing strict contract, not a per-flag exception or new deletion authority.

kayg commented

2026-10-19 14:07:42 +00:00

Author

Owner

Focused round4 private-phase regressions now have direct red/green receipts: commit/commit_after modified activating bytes were accepted before the fix and are now refused before recursive cleanup (1passed/0failed,3.59s); retained-state original-v2/stale-copy-v1 loss reproduced and now refuses before activation (1/0,5.82s); unbound enrollment unknown child was deleted before the fix and is now preserved/refused (1/0,1.25s); restart_setup_with moved private state into public base before admission and now performs the same complete pure preflight before orphan-proof retirement/retain (1/0,3.17s). The restart regression checks both a noncanonical flag and an independent child, not a per-flag exception.

The legacy-present-manifest handoff regression now passes (1/0,7.04s): durable bound|legacy authority choice is fixed in the intent name; unanchored inherited f/d/l rows become r/a/k, while newly prepared unit/owner rows remain creator-bound f. Existing anchored handoff keeps other row bytes/order unchanged. These focused receipts precede the final full generated candidate gates and do not replace them.

Focused round4 private-phase regressions now have direct red/green receipts: commit/commit_after modified activating bytes were accepted before the fix and are now refused before recursive cleanup (1passed/0failed,3.59s); retained-state original-v2/stale-copy-v1 loss reproduced and now refuses before activation (1/0,5.82s); unbound enrollment unknown child was deleted before the fix and is now preserved/refused (1/0,1.25s); restart_setup_with moved private state into public base before admission and now performs the same complete pure preflight before orphan-proof retirement/retain (1/0,3.17s). The restart regression checks both a noncanonical flag and an independent child, not a per-flag exception. The legacy-present-manifest handoff regression now passes (1/0,7.04s): durable bound|legacy authority choice is fixed in the intent name; unanchored inherited f/d/l rows become r/a/k, while newly prepared unit/owner rows remain creator-bound f. Existing anchored handoff keeps other row bytes/order unchanged. These focused receipts precede the final full generated candidate gates and do not replace them.

kayg commented

2026-10-19 14:12:28 +00:00

Author

Owner

Actual ACTIVATE entrypoint gap confirmed: after successful generated JOIN, the fixture inserts an independent same-UID600 child into private staged state before ACTIVATE. Current enroll_and_start succeeds, records the current child in its planned receipt and moves it to public state. Native regression activation_admits_private_workspace_before_minting_a_public_plan fails activation adopted an independent child into its planned receipt (0passed/1failed,2.04s), evidence/private-activation-capture-native-red.log.

The original-public before-image check alone cannot prevent adoption of unrelated private inputs. ACTIVATE must run the same complete pure private-phase validator before its first journal/manager/public mutation or new planned inventory. The planned source factoring shares these readers once with inspection/rollback/commit/restart, rather than introducing another parser or per-child exception. Unknown files remain preserved/refused; the writer cannot observe them into new ownership authority.

Actual ACTIVATE entrypoint gap confirmed: after successful generated JOIN, the fixture inserts an independent same-UID600 child into private staged state before ACTIVATE. Current enroll_and_start succeeds, records the current child in its planned receipt and moves it to public state. Native regression activation_admits_private_workspace_before_minting_a_public_plan fails `activation adopted an independent child into its planned receipt` (0passed/1failed,2.04s), evidence/private-activation-capture-native-red.log. The original-public before-image check alone cannot prevent adoption of unrelated private inputs. ACTIVATE must run the same complete pure private-phase validator before its first journal/manager/public mutation or new planned inventory. The planned source factoring shares these readers once with inspection/rollback/commit/restart, rather than introducing another parser or per-child exception. Unknown files remain preserved/refused; the writer cannot observe them into new ownership authority.

kayg commented

2026-10-19 14:16:07 +00:00

Author

Owner

Manifest creator-proof and runtime-plan progress, current uncommitted round4 tree (base includes c898c1c and storage 6fef7d4).

The anonymous runtime plan producer now completes and syncs an unnamed file, publishes its selfnamed creator-proof anchor first, then publishes the staged pathname without overwrite. A killed partial write leaves no named opaque prefix. Recovery retires only exact same-context creator-proven unarmed plans or orphan anchors; unknown/recreated reserved paths remain unchanged and cause refusal. The new regression first failed with interrupted preparation left unbound reserved bytes (0 passed, 1 failed), then passed after the structural change.

The prepared manifest binding now additionally requires its digest to equal the complete pending intent recorded before the first write. The actual-function RED appended a syntactically valid row for an independent file between write and binding: old writer exited 0 and adopted it. GREEN exits 71 and preserves the independent file. This does not grant any deletion authority to private prefixes.

Focused gate output, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 167 filtered out; finished in 2.54s
REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464
PROTOCOL_OBSERVER_TOTAL actual_operation_cuts=48 independent_recreations=336 resume_repeat_calls=768
test result: ok. 55 passed; 0 failed; 0 ignored; 0 measured; 101 filtered out; finished in 30.71s
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.23s

The producer gate rebuilds recovery-helper before the four actual generated setup tests. The native gate includes same-byte independent active-receipt replacement after reload, post-terminal reserved entrypoint reporting twice, every generated cleanup mutation cut, and every generated protocol preparation/arm/cancel/consume operation cut. Protocol coverage is operation-level; partial anonymous writes and unsupported filesystems are additionally covered by identity_journal tests. Existing R3 assertions remain intact.

Whole-tree format check found only the concurrent stdin-test chain in install.rs:2127; its owner is formatting it. Whole-job verify fast, full SSH matrices, static size and performance gates remain with the parent job. This is a progress receipt, not completion or an exhaustive syscall claim.

runtime-plan-create-red.log
runtime-plan-create-green.log
runtime-protocol-boundaries2.log
manifest-final-native.log
manifest-final-producer.log
manifest-final-remote-clippy.log
manifest-pending-binding-red.log
manifest-pending-binding-green.log

Manifest creator-proof and runtime-plan progress, current uncommitted round4 tree (base includes c898c1c and storage 6fef7d4). The anonymous runtime plan producer now completes and syncs an unnamed file, publishes its selfnamed creator-proof anchor first, then publishes the staged pathname without overwrite. A killed partial write leaves no named opaque prefix. Recovery retires only exact same-context creator-proven unarmed plans or orphan anchors; unknown/recreated reserved paths remain unchanged and cause refusal. The new regression first failed with `interrupted preparation left unbound reserved bytes` (0 passed, 1 failed), then passed after the structural change. The prepared manifest binding now additionally requires its digest to equal the complete pending intent recorded before the first write. The actual-function RED appended a syntactically valid row for an independent file between write and binding: old writer exited 0 and adopted it. GREEN exits 71 and preserves the independent file. This does not grant any deletion authority to private prefixes. Focused gate output, verbatim: ``` test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 167 filtered out; finished in 2.54s REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464 PROTOCOL_OBSERVER_TOTAL actual_operation_cuts=48 independent_recreations=336 resume_repeat_calls=768 test result: ok. 55 passed; 0 failed; 0 ignored; 0 measured; 101 filtered out; finished in 30.71s Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.23s ``` The producer gate rebuilds recovery-helper before the four actual generated setup tests. The native gate includes same-byte independent active-receipt replacement after reload, post-terminal reserved entrypoint reporting twice, every generated cleanup mutation cut, and every generated protocol preparation/arm/cancel/consume operation cut. Protocol coverage is operation-level; partial anonymous writes and unsupported filesystems are additionally covered by identity_journal tests. Existing R3 assertions remain intact. Whole-tree format check found only the concurrent stdin-test chain in install.rs:2127; its owner is formatting it. Whole-job verify fast, full SSH matrices, static size and performance gates remain with the parent job. This is a progress receipt, not completion or an exhaustive syscall claim. [runtime-plan-create-red.log](https://git.kayg.org/attachments/4d4e8371-63a3-4a86-ba15-9a9144b25c08) [runtime-plan-create-green.log](https://git.kayg.org/attachments/739342e6-e44b-48b0-af2b-953a4bc47ce4) [runtime-protocol-boundaries2.log](https://git.kayg.org/attachments/60ee3f52-484b-4c75-b8ba-b7433f8325f2) [manifest-final-native.log](https://git.kayg.org/attachments/9d0906c4-8e71-4f03-bab5-5cca67bb8573) [manifest-final-producer.log](https://git.kayg.org/attachments/205a1ea6-2421-4339-a33d-5b1b51385b16) [manifest-final-remote-clippy.log](https://git.kayg.org/attachments/de27b6cc-bed1-4197-a0ad-f16549192572) [manifest-pending-binding-red.log](https://git.kayg.org/attachments/a0b1f84e-d06e-4254-8487-550e00704690) [manifest-pending-binding-green.log](https://git.kayg.org/attachments/b1773756-cab8-45a4-9b72-6d8fee26c60a)

kayg commented

2026-10-19 14:21:05 +00:00

Author

Owner

The stricter private-source admission exposed a legitimate intermediate state: the generated retained-state cp has created an empty/short private destination, but has not completed its write. A focused JOIN cp control leaves the exact empty destination shape after open; rollback currently refuses71 despite the immutable original remaining unchanged. Regression interrupted_retained_copy_prefixes_recover_without_adopting_changed_bytes is RED (0passed/1failed,3.89s); evidence/private-copy-prefix-native-red.log. Its remaining cases cover a seven-byte canonical prefix and independently changed bytes. The syscall oracle will additionally exercise the real cp creation boundary.

The explicit unbound copy phase may compare a private destination prefix with its exact immutable before-image source. The original source must still match its UID/device/inode/hash; no current public scan creates authority. Only protected newly copied files can use this exception, with private current-owner600/700 mode before retained attributes are applied. Completed/bound native outputs, prepared artifacts and original backups retain exact inode/hash checks and never fall back to prefix admission. Unmatched bytes/unknown children/foreign owners remain preserved and refused. The existing canonical-prefix helper will be reused in the find child, without another parser or a new external dependency.

The stricter private-source admission exposed a legitimate intermediate state: the generated retained-state cp has created an empty/short private destination, but has not completed its write. A focused JOIN cp control leaves the exact empty destination shape after open; rollback currently refuses71 despite the immutable original remaining unchanged. Regression interrupted_retained_copy_prefixes_recover_without_adopting_changed_bytes is RED (0passed/1failed,3.89s); evidence/private-copy-prefix-native-red.log. Its remaining cases cover a seven-byte canonical prefix and independently changed bytes. The syscall oracle will additionally exercise the real cp creation boundary. The explicit unbound copy phase may compare a private destination prefix with its exact immutable before-image source. The original source must still match its UID/device/inode/hash; no current public scan creates authority. Only protected newly copied files can use this exception, with private current-owner600/700 mode before retained attributes are applied. Completed/bound native outputs, prepared artifacts and original backups retain exact inode/hash checks and never fall back to prefix admission. Unmatched bytes/unknown children/foreign owners remain preserved and refused. The existing canonical-prefix helper will be reused in the find child, without another parser or a new external dependency.

kayg commented

2026-10-19 14:25:19 +00:00

Author

Owner

Independent structural review found two remaining cleanup gaps. commit()/commit_after() validate the active stage then recursively retire it without a durable commit-retirement phase (install.rs:1215-1219,1264-1268); interruption after transaction/activating removal cannot resume active admission. A new owned600 stage/unit containing 31 independent bytes passes current fresh_stage_phase (private_phase.sh:184-185), while validate_bound_stage has no unit binding. Isolated receipt: evidence/review-commit-unit/result.txt, exit=0 and ACCEPTED unrelated_unit_bytes=31. Implementing a shared immutable private-retirement inventory and checked individual removal; root retains installation glue. Branch addhost-readd-r4, head recorded by the parent job; no deployment.

kayg commented

2026-10-19 14:35:05 +00:00

Author

Owner

Independent review found an early native-producer admission gap: after the journal root binding and before its original/prepared records, an arbitrary owned600 private identity was accepted. The original review receipt is evidence/review-identity-preintent/result.txt. This violates preservation of independently edited or byte-identically recreated files.

The existing producer protocol now gains a prior copied-identity creator record: immediately after copying the unchanged before-image, JOIN records UID/device/inode/SHA before native preparation/redemption. The native producer validates that exact record before creating any journal directory, then persists its original record before nonce/probe/enrollment effects. Replacing a removed host explicitly records the removal decision before unlinking only that bound copy. No secret bytes appear in metadata. The pure reader requires this same creator proof throughout the early root-only journal states; owned mode and pathname alone confer no authority.

Direct current-source replay: eight cases (before/after root binding × unchanged/edit/recreate/unrecorded) passed; unchanged copies returned0, all modified/unrecorded cases returned71 with inode+bytes preserved. Native regression and generated boundary replays remain pending the serialized build slot. This is a focused result, not an exhaustive coverage claim.

Independent review found an early native-producer admission gap: after the journal root binding and before its original/prepared records, an arbitrary owned600 private identity was accepted. The original review receipt is evidence/review-identity-preintent/result.txt. This violates preservation of independently edited or byte-identically recreated files. The existing producer protocol now gains a prior copied-identity creator record: immediately after copying the unchanged before-image, JOIN records UID/device/inode/SHA before native preparation/redemption. The native producer validates that exact record before creating any journal directory, then persists its original record before nonce/probe/enrollment effects. Replacing a removed host explicitly records the removal decision before unlinking only that bound copy. No secret bytes appear in metadata. The pure reader requires this same creator proof throughout the early root-only journal states; owned mode and pathname alone confer no authority. Direct current-source replay: eight cases (before/after root binding × unchanged/edit/recreate/unrecorded) passed; unchanged copies returned0, all modified/unrecorded cases returned71 with inode+bytes preserved. Native regression and generated boundary replays remain pending the serialized build slot. This is a focused result, not an exhaustive coverage claim.

kayg commented

2026-10-19 14:38:33 +00:00

Author

Owner

Private-retirement structural slice, uncommitted on addhost-readd-r4 at 6fef7d4f1b96ba9ad72c9ba45b64e1c7e379e859: new private_retirement.sh binds a complete stage inventory before individual unlink/rmdir, with outside file identity/hash plus pending-directory identity preserved through partial cleanup. Parent observed the real commit interruption regression fail before integration (private-commit-retirement-red.log). Standalone production-shell checks pass: 10 discovered actual deletion boundaries, 20 resume calls, 7 independent changed/recreated/unknown-object controls; canonical pending prefixes 0,1,31,full resume and unexpected bytes refuse with exit72. No timing claims. Receipts: deletion and preservation, pending prefixes. Source sh -n, targeted rustfmt and git diff --check pass. Seven registered native regressions and full integrated gates remain pending; this is not completion or exhaustive acceptance.

Private-retirement structural slice, uncommitted on addhost-readd-r4 at 6fef7d4f1b96ba9ad72c9ba45b64e1c7e379e859: new private_retirement.sh binds a complete stage inventory before individual unlink/rmdir, with outside file identity/hash plus pending-directory identity preserved through partial cleanup. Parent observed the real commit interruption regression fail before integration (private-commit-retirement-red.log). Standalone production-shell checks pass: 10 discovered actual deletion boundaries, 20 resume calls, 7 independent changed/recreated/unknown-object controls; canonical pending prefixes 0,1,31,full resume and unexpected bytes refuse with exit72. No timing claims. Receipts: [deletion and preservation](https://git.kayg.org/attachments/a4725e60-55f6-4226-9514-38560240c6d6), [pending prefixes](https://git.kayg.org/attachments/bd69b3a8-3a38-486b-bbf7-8e1096a7e684). Source sh -n, targeted rustfmt and git diff --check pass. Seven registered native regressions and full integrated gates remain pending; this is not completion or exhaustive acceptance.

kayg commented

2026-10-19 14:43:39 +00:00

Author

Owner

Two current-source actual installer regressions are RED after rebuilding the native helper from the correct source:

commit_preserves_an_independent_obsolete_private_unit: after successful setup, an unrelated owned600 stage/unit is created. Commit succeeds and deletes it (asserted refusal fails). Result:0 passed/1 failed,10.34s; evidence/private-obsolete-unit-native-red2.log.
activation_never_promotes_an_independent_copy_prefix: upgrade JOIN completes a copy of original full retained data; a wrapper independently truncates only that private copy to its exact8-byte canonical source prefix. ACTIVATE succeeds (asserted refusal fails), proving rollback's legitimate copy-prefix admission was also being used before publishing replacement custody. Result:0 passed/1 failed,10.17s; evidence/private-copy-prefix-capture-native-red2.log.

The first fix rejects obsolete stage unit/launcher/retired-public roles; current public quarantines instead return to their already-bound destination-local publication artifact slot, preserving dev/inode across filesystems. Private fresh-proof has a pure canonical-intent/prefix-or-immutable-peer validator before manager actions. The second needs a durable copy-completion boundary: original-bound canonical prefixes remain recoverable before completion, while activation must use complete original-matching creator-bound copies. No unrelated current bytes become a receipt. Green regressions and generated boundary replays remain pending; no exhaustive claim.

Two current-source actual installer regressions are RED after rebuilding the native helper from the correct source: 1. `commit_preserves_an_independent_obsolete_private_unit`: after successful setup, an unrelated owned600 stage/unit is created. Commit succeeds and deletes it (asserted refusal fails). Result:0 passed/1 failed,10.34s; evidence/private-obsolete-unit-native-red2.log. 2. `activation_never_promotes_an_independent_copy_prefix`: upgrade JOIN completes a copy of original full retained data; a wrapper independently truncates only that private copy to its exact8-byte canonical source prefix. ACTIVATE succeeds (asserted refusal fails), proving rollback's legitimate copy-prefix admission was also being used before publishing replacement custody. Result:0 passed/1 failed,10.17s; evidence/private-copy-prefix-capture-native-red2.log. The first fix rejects obsolete stage unit/launcher/retired-public roles; current public quarantines instead return to their already-bound destination-local publication artifact slot, preserving dev/inode across filesystems. Private fresh-proof has a pure canonical-intent/prefix-or-immutable-peer validator before manager actions. The second needs a durable copy-completion boundary: original-bound canonical prefixes remain recoverable before completion, while activation must use complete original-matching creator-bound copies. No unrelated current bytes become a receipt. Green regressions and generated boundary replays remain pending; no exhaustive claim.

kayg commented

2026-10-19 15:03:49 +00:00

Author

Owner

Native bootstrap producer module step committed as afc30c11c. Scope: opt-in anonymous identity writer/probe/creator bindings using existing dependencies; ordinary enrollment writer remains unchanged. The exact committed module tree was reconstructed from git, mounted privately at the normal source path, checked using the ONE shared target, and then the actual crate roots were refreshed to invalidate overlaid artifacts. This is a module gate, not completion of the wider installer or exhaustive syscall product.

Exact committed-tree gate output:

   Compiling infraternal-shim v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-shim)
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-plugin-api)
   Compiling infraternal-protocol v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-protocol)
   Compiling infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 11.68s
     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/addhost-readd-r4/target/debug/deps/infraternal_plugin_remote-c347e9d9e4d143d8)

running 4 tests
test identity_journal::tests::copied_identity_creator_binding_precedes_any_producer_effect ... ok
test identity_journal::tests::short_write_error_never_publishes_named_opaque_prefix ... ok
test identity_journal::tests::collision_and_unsupported_capability_preserve_existing_identity ... ok
test identity_journal::tests::fresh_and_replacement_keep_creator_proof_before_publication ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 149 filtered out; finished in 0.33s

   Compiling infraternal-shim v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-shim)
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-plugin-api)
    Checking infraternal-protocol v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-protocol)
    Checking infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.02s

Additional actual source-contract finding: the early native bridge calls sessions::state at session_bridge.rs89 before SESSION output at168. sessions.rs197-201 creates/validates runtime and nested session directories using700, without touching setup created-dirs. Therefore these directories must enter retry custody only as retention anchors, never fabricated creator rows. The actual live_retry regression failed when the immutable preserve proof lacked those anchors (private-copy-completion-native-green.log final test is RED). The narrow fix snapshots existing runtime roots/lifetime as a/r before JOIN, revalidates only runtime anchors present in that original immutable receipt, and carries those same retention rows into preservation. The fixture now creates the directories before JOIN to match the native ordering, while adding its independent sentinel only after failure. No assertions are removed. The original-state v1/v2 comparison stays strict. Actual regression replay is queued.

Native bootstrap producer module step committed as afc30c11c. Scope: opt-in anonymous identity writer/probe/creator bindings using existing dependencies; ordinary enrollment writer remains unchanged. The exact committed module tree was reconstructed from git, mounted privately at the normal source path, checked using the ONE shared target, and then the actual crate roots were refreshed to invalidate overlaid artifacts. This is a module gate, not completion of the wider installer or exhaustive syscall product. Exact committed-tree gate output: ``` Compiling infraternal-shim v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-shim) Compiling infraternal-plugin-api v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-plugin-api) Compiling infraternal-protocol v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-protocol) Compiling infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote) Finished `test` profile [unoptimized + debuginfo] target(s) in 11.68s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/addhost-readd-r4/target/debug/deps/infraternal_plugin_remote-c347e9d9e4d143d8) running 4 tests test identity_journal::tests::copied_identity_creator_binding_precedes_any_producer_effect ... ok test identity_journal::tests::short_write_error_never_publishes_named_opaque_prefix ... ok test identity_journal::tests::collision_and_unsupported_capability_preserve_existing_identity ... ok test identity_journal::tests::fresh_and_replacement_keep_creator_proof_before_publication ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 149 filtered out; finished in 0.33s Compiling infraternal-shim v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-shim) Compiling infraternal-plugin-api v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-plugin-api) Checking infraternal-protocol v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/infraternal-protocol) Checking infraternal-plugin-remote v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/addhost-readd-r4/crates/plugins/remote) Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.02s ``` Additional actual source-contract finding: the early native bridge calls sessions::state at session_bridge.rs89 before SESSION output at168. sessions.rs197-201 creates/validates runtime and nested session directories using700, without touching setup created-dirs. Therefore these directories must enter retry custody only as retention anchors, never fabricated creator rows. The actual live_retry regression failed when the immutable preserve proof lacked those anchors (private-copy-completion-native-green.log final test is RED). The narrow fix snapshots existing runtime roots/lifetime as a/r before JOIN, revalidates only runtime anchors present in that original immutable receipt, and carries those same retention rows into preservation. The fixture now creates the directories before JOIN to match the native ordering, while adding its independent sentinel only after failure. No assertions are removed. The original-state v1/v2 comparison stays strict. Actual regression replay is queued.

kayg commented

2026-10-19 15:09:46 +00:00

Author

Owner

Structural copy-completion and early-runtime retention steps now pass the focused actual generated installer regressions. No original assertions were removed.

Copy state machine: before completion, only rollback admits canonical prefixes of unchanged original source rows. Full comparison against the immutable pre-copy before-image emits canonical new copied inode/hash rows. Empty700 copied-state-pending-SHA is durable before any receipt write; even that pending digest already fixes the complete copied tree identities. The owned600 copied-state receipt may contain only its canonical prefix until snapshot-copied-state-UID:DEV:INO-SHA binds its completed inode. Native enrollment starts only after that binding. ACTIVATE requires it for inherited state, and all copied paths remain exact except identity.json when the native producer journal supplies its exact replacement creator. This reuses the existing rollback row parser. Unknown children, same-byte inode replacement, partial independent data edits and changed originals refuse before manager/public publication.

Early runtime is retention-only: source session_bridge.rs89 calls native sessions::state before its SESSION168 receipt; sessions.rs197-201 creates/validates root/nested directories without any setup creator rows. Their existing a/r anchors are therefore captured in the original before-JOIN receipt and carried unchanged into preservation. Revalidation compares only originally captured runtime anchors. The live fixture now models that actual pre-JOIN directory ordering; its independent sentinel is still created after failure and every original assertion remains.

Actual current-source gates (private-copy-completion-native-green2.log):

activation_never_promotes_an_independent_copy_prefix:1 passed;0 failed;7.51s
completed_copy_refuses_byte_identical_recreation:1 passed;0 failed;6.99s
interrupted_retained_copy_prefixes_recover_without_adopting_changed_bytes:1 passed;0 failed;18.47s
live_setup_retry_preserves_the_bridge_and_host_identity_state:1 passed;0 failed;20.36s
restart_recovers_partial_stage_retirement:1 passed;0 failed;15.10s

The obsolete private unit regression also changed actualRED→GREEN1/0,2.49s. The native pre-intent copy reader passed8 direct states plus its compiled unit; the committed anonymous producer passes4 native tests. These are focused gates, not a claim that the final exhaustive syscall products or wider fast gate are complete. Performance runs remain confined to the performance VM; the build host only compiled the ignored benchmark.

Structural copy-completion and early-runtime retention steps now pass the focused actual generated installer regressions. No original assertions were removed. Copy state machine: before completion, only rollback admits canonical prefixes of unchanged original source rows. Full comparison against the immutable pre-copy before-image emits canonical new copied inode/hash rows. Empty700 copied-state-pending-SHA is durable before any receipt write; even that pending digest already fixes the complete copied tree identities. The owned600 copied-state receipt may contain only its canonical prefix until snapshot-copied-state-UID:DEV:INO-SHA binds its completed inode. Native enrollment starts only after that binding. ACTIVATE requires it for inherited state, and all copied paths remain exact except identity.json when the native producer journal supplies its exact replacement creator. This reuses the existing rollback row parser. Unknown children, same-byte inode replacement, partial independent data edits and changed originals refuse before manager/public publication. Early runtime is retention-only: source session_bridge.rs89 calls native sessions::state before its SESSION168 receipt; sessions.rs197-201 creates/validates root/nested directories without any setup creator rows. Their existing a/r anchors are therefore captured in the original before-JOIN receipt and carried unchanged into preservation. Revalidation compares only originally captured runtime anchors. The live fixture now models that actual pre-JOIN directory ordering; its independent sentinel is still created after failure and every original assertion remains. Actual current-source gates (private-copy-completion-native-green2.log): ``` activation_never_promotes_an_independent_copy_prefix:1 passed;0 failed;7.51s completed_copy_refuses_byte_identical_recreation:1 passed;0 failed;6.99s interrupted_retained_copy_prefixes_recover_without_adopting_changed_bytes:1 passed;0 failed;18.47s live_setup_retry_preserves_the_bridge_and_host_identity_state:1 passed;0 failed;20.36s restart_recovers_partial_stage_retirement:1 passed;0 failed;15.10s ``` The obsolete private unit regression also changed actualRED→GREEN1/0,2.49s. The native pre-intent copy reader passed8 direct states plus its compiled unit; the committed anonymous producer passes4 native tests. These are focused gates, not a claim that the final exhaustive syscall products or wider fast gate are complete. Performance runs remain confined to the performance VM; the build host only compiled the ignored benchmark.

kayg commented

2026-10-19 15:19:52 +00:00

Author

Owner

Recovery oracle migration, current branch fix/addhost-readd-r4, native HEAD 066a7a4e8: the original recovery fixtures predate immutable creation receipts, so their manually assembled fresh base/owner/sessions now require original creation identities. Those rows are captured only during fixture assembly, before the first inspection or cleanup; the minimal-image variant captures after its explicit fixture-only chown and maps paths to /fixture. The partial-stage lock case also records its original stage/kind/lifetime-lock at construction. No cleanup-time scan manufactures creator authority, and all existing exit/status/retention assertions remain unchanged.

The compiled shipping source is read through the DEBUG fixture accessor and streamed on stdin, avoiding legacy source-literal extraction and kernel argument limits. The minimal image still uses only the static native runtime helper and its existing shell utilities. Current ordinary eleven plus ignored minimal-image case are queued under the shared build lock; no green claim yet.

Independent pure private_write.sh module check: private_write actual module: 15 cases passed; original trailing newlines preserved. This covers empty/selected partial/full canonical content, changed canonical source, unrelated content, appended/changed trailing bytes, symlink/directory rejection, noncanonical mode and extra hardlink rejection, and the explicit copy-role executable mode. It is a functional check, not exhaustive syscall coverage. Exact module-only projection with fmt and SSH all-target Clippy is queued.

Recovery oracle migration, current branch `fix/addhost-readd-r4`, native HEAD `066a7a4e8`: the original recovery fixtures predate immutable creation receipts, so their manually assembled fresh base/owner/sessions now require original creation identities. Those rows are captured only during fixture assembly, before the first inspection or cleanup; the minimal-image variant captures after its explicit fixture-only chown and maps paths to `/fixture`. The partial-stage lock case also records its original stage/kind/lifetime-lock at construction. No cleanup-time scan manufactures creator authority, and all existing exit/status/retention assertions remain unchanged. The compiled shipping source is read through the DEBUG fixture accessor and streamed on stdin, avoiding legacy source-literal extraction and kernel argument limits. The minimal image still uses only the static native runtime helper and its existing shell utilities. Current ordinary eleven plus ignored minimal-image case are queued under the shared build lock; no green claim yet. Independent pure `private_write.sh` module check: `private_write actual module: 15 cases passed; original trailing newlines preserved`. This covers empty/selected partial/full canonical content, changed canonical source, unrelated content, appended/changed trailing bytes, symlink/directory rejection, noncanonical mode and extra hardlink rejection, and the explicit copy-role executable mode. It is a functional check, not exhaustive syscall coverage. Exact module-only projection with fmt and SSH all-target Clippy is queued.

kayg commented

2026-10-19 15:20:17 +00:00

Author

Owner

Correction to the fixture-assembly note: the branch is addhost-readd-r4 (without a fix/ prefix); native HEAD 066a7a4e8 is unchanged.

Correction to the fixture-assembly note: the branch is `addhost-readd-r4` (without a `fix/` prefix); native HEAD `066a7a4e8` is unchanged.

kayg commented

2026-10-19 15:26:19 +00:00

Author

Owner

Recovery oracle migration is green on the current working source, native HEAD 066a7a4e8, branch addhost-readd-r4. All original assertions remain unchanged. Original base/owner/sessions identities are captured during assembly, after the explicit minimal-image UID mapping and before inspection/cleanup; the partial-stage lock case additionally records the original stage/kind/lifetime lock. This models production creation receipts without learning authority during cleanup. The compiled source accessor is streamed on stdin rather than extracted from Rust literals or sent through a large sh -c argument.

Ordinary tests use the freshly built debug shipping runtime helper. The ignored minimal-image test was run explicitly with the existing static runtime helper and the debug source accessor on the test host, without Python in the image. Functional gate output:

test result: ok. 11 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.77s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 4.76s

The raw helper build and all case names/statuses are in the attached recovery-fixture-current.log. This is a focused functional gate, not the final branch gate or a performance measurement. Oracle changes remain uncommitted for the shared fixture-accessor integration slice.

Recovery oracle migration is green on the current working source, native HEAD `066a7a4e8`, branch `addhost-readd-r4`. All original assertions remain unchanged. Original base/owner/sessions identities are captured during assembly, after the explicit minimal-image UID mapping and before inspection/cleanup; the partial-stage lock case additionally records the original stage/kind/lifetime lock. This models production creation receipts without learning authority during cleanup. The compiled source accessor is streamed on stdin rather than extracted from Rust literals or sent through a large `sh -c` argument. Ordinary tests use the freshly built debug shipping runtime helper. The ignored minimal-image test was run explicitly with the existing static runtime helper and the debug source accessor on the test host, without Python in the image. Functional gate output: ```text test result: ok. 11 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.77s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 4.76s ``` The raw helper build and all case names/statuses are in the attached `recovery-fixture-current.log`. This is a focused functional gate, not the final branch gate or a performance measurement. Oracle changes remain uncommitted for the shared fixture-accessor integration slice.

kayg commented

2026-10-19 15:31:47 +00:00

Author

Owner

Focused recovery fixture lint gate also passed on the current source:

cargo clippy --locked -p infraternal-plugin-ssh --test recovery_support -- -D warnings
    Checking infraternal-plugin-remote v0.1.0
    Checking infraternal-plugin-ssh v0.1.0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.98s

The original eleven ordinary assertions and explicit minimal-image case are green as recorded above. Fixture source is ready for the shared compiled-source accessor/oracle commit; this does not replace the final branch gate.

Focused recovery fixture lint gate also passed on the current source: ```text cargo clippy --locked -p infraternal-plugin-ssh --test recovery_support -- -D warnings Checking infraternal-plugin-remote v0.1.0 Checking infraternal-plugin-ssh v0.1.0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.98s ``` The original eleven ordinary assertions and explicit minimal-image case are green as recorded above. Fixture source is ready for the shared compiled-source accessor/oracle commit; this does not replace the final branch gate.

kayg commented

2026-10-19 16:29:15 +00:00

Author

Owner

Completed native manifest-consumer step in atomic commit 2ba4f42341553d8fcf659e59bd6f480ee6d40a78. The checked snapshot contains only uninstall_manifest.rs and its uninstall.rs consumer/report integration; anonymous runtime-plan production and protocol tests remain a separate change. Original R3 assertions remain intact. No push until the entire brief is green.

manifest-atomic-gate4.log

Exact-projection functional gate: fmt passed; touched-crate all-target Clippy passed. Generated cleanup discovered 44 actual link/unlink boundaries, 24 candidate paths per flow, 1,188 independent recreations and 2,464 resume/repeat calls. Gate output verbatim:

REMOVAL_OBSERVER leftovers=false actual_mutation_cuts=23 candidate_paths=24 terminal_links=0
REMOVAL_OBSERVER leftovers=true actual_mutation_cuts=21 candidate_paths=24 terminal_links=1
REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464
test uninstall::manifest::tests::actual_cleanup_mutations_resume_and_report_every_independent_path_at_every_cut ... ok

test result: ok. 54 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out; finished in 25.95s

Separate full iteration run is RED (158 SSH install passes, 21 failures plus two now-corrected Clippy errors). Failures include obsolete test interception of recursive teardown, error classification, private-copy/retirement compatibility and one observer deadline. These are being handled; no acceptance claim. Additional same-kind/in-place/foreign-owner native matrix coverage is being added without weakening the existing 1,188-case matrix.

Completed native manifest-consumer step in atomic commit 2ba4f42341553d8fcf659e59bd6f480ee6d40a78. The checked snapshot contains only uninstall_manifest.rs and its uninstall.rs consumer/report integration; anonymous runtime-plan production and protocol tests remain a separate change. Original R3 assertions remain intact. No push until the entire brief is green. [manifest-atomic-gate4.log](https://git.kayg.org/attachments/5f711796-2d96-4e53-a2e3-b352ca7bf8e5) Exact-projection functional gate: fmt passed; touched-crate all-target Clippy passed. Generated cleanup discovered 44 actual link/unlink boundaries, 24 candidate paths per flow, 1,188 independent recreations and 2,464 resume/repeat calls. Gate output verbatim: ``` REMOVAL_OBSERVER leftovers=false actual_mutation_cuts=23 candidate_paths=24 terminal_links=0 REMOVAL_OBSERVER leftovers=true actual_mutation_cuts=21 candidate_paths=24 terminal_links=1 REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=44 independent_recreations=1188 resume_and_repeat_calls=2464 test uninstall::manifest::tests::actual_cleanup_mutations_resume_and_report_every_independent_path_at_every_cut ... ok test result: ok. 54 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out; finished in 25.95s ``` Separate full iteration run is RED (158 SSH install passes, 21 failures plus two now-corrected Clippy errors). Failures include obsolete test interception of recursive teardown, error classification, private-copy/retirement compatibility and one observer deadline. These are being handled; no acceptance claim. Additional same-kind/in-place/foreign-owner native matrix coverage is being added without weakening the existing 1,188-case matrix.

kayg commented

2026-10-19 16:34:11 +00:00

Author

Owner

Current iterate compatibility findings (#231/#235), same branch and atomic HEAD as parent job.

The existing followup_fresh_attempt_retains_preexisting_state_data regression fails with exit71 after completing its copied-state inode receipt. The exact generated shell trace identifies the generic fresh-stage scan rejecting inherited state/independent-empty with mode0755; copied retained data must use the same per-entry original/copy proofs as upgrade state. Proposed fix preserves protected private roots and requires the complete typed state validator BEFORE pruning those state roles from the generic private0600/0700 metadata scan. It does not adopt current public paths or unknown descendants.

Two fixture protocols also need to follow the current shipping producer. The invitation test's raw unjournaled state/invitation writer will become a real Journal writer; a separate isolated input receipt records the same delivered bytes after Journal::prepare, outside installation state. The partial-full-upload test currently manually recreates a completed bound payload; that is correctly refused by identity checks. Its setup will instead interrupt the real restaging tee after seven bytes, after the actual new upload intent has been published. All existing bridge, input equality, unknown-byte preservation and nonexecution assertions remain.

Focused verification, including changed-prefix, byte-identical recreation, source-lineage and unknown-child refusal regressions, is queued behind the shared build lock. No performance numbers or completion claim yet.

Current iterate compatibility findings (#231/#235), same branch and atomic HEAD as parent job. The existing followup_fresh_attempt_retains_preexisting_state_data regression fails with exit71 after completing its copied-state inode receipt. The exact generated shell trace identifies the generic fresh-stage scan rejecting inherited state/independent-empty with mode0755; copied retained data must use the same per-entry original/copy proofs as upgrade state. Proposed fix preserves protected private roots and requires the complete typed state validator BEFORE pruning those state roles from the generic private0600/0700 metadata scan. It does not adopt current public paths or unknown descendants. Two fixture protocols also need to follow the current shipping producer. The invitation test's raw unjournaled state/invitation writer will become a real Journal writer; a separate isolated input receipt records the same delivered bytes after Journal::prepare, outside installation state. The partial-full-upload test currently manually recreates a completed bound payload; that is correctly refused by identity checks. Its setup will instead interrupt the real restaging tee after seven bytes, after the actual new upload intent has been published. All existing bridge, input equality, unknown-byte preservation and nonexecution assertions remain. Focused verification, including changed-prefix, byte-identical recreation, source-lineage and unknown-child refusal regressions, is queued behind the shared build lock. No performance numbers or completion claim yet.

kayg commented

2026-10-19 16:36:03 +00:00

Author

Owner

Additive retained-copy recovery clarification (#231/#235): the existing disappearing-source regression models original state children disappearing after a complete copy. Direct shipping functions reproduce exit71 from the later full before-image digest comparison, although the immutable copied-tree receipt and copied bytes remain intact. A vanished original does not authorize deletion of its retained copy.

The reader will allow only absent ORIGINAL STATE DESCENDANT rows after validating the complete creator-bound private copy, including every current inode/hash and the native identity producer. Still-present originals must retain their original identities/bytes, every non-state artifact remains exact, and extra current rows refuse. Pending/unbound copies do not qualify. The existing before-image and copied-tree receipt remain immutable. The original v1/v2 lineage and independently recreated copy regressions will be rerun unchanged.

Additive retained-copy recovery clarification (#231/#235): the existing disappearing-source regression models original state children disappearing after a complete copy. Direct shipping functions reproduce exit71 from the later full before-image digest comparison, although the immutable copied-tree receipt and copied bytes remain intact. A vanished original does not authorize deletion of its retained copy. The reader will allow only absent ORIGINAL STATE DESCENDANT rows after validating the complete creator-bound private copy, including every current inode/hash and the native identity producer. Still-present originals must retain their original identities/bytes, every non-state artifact remains exact, and extra current rows refuse. Pending/unbound copies do not qualify. The existing before-image and copied-tree receipt remain immutable. The original v1/v2 lineage and independently recreated copy regressions will be rerun unchanged.

kayg commented

2026-10-19 16:48:07 +00:00

Author

Owner

Completed shared private-prefix reader step, head 56d8974fe36ed00b3648d9b6d21de993074610e7. Atomic commit adds the pure reader and permanent regressions; integration into the disk phases remains separate. Exact isolated projection gate: sh -n, 15 direct shell cases, formatting, SSH all-target Clippy, and:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s

Every byte prefix (including original trailing newlines) is admitted only against its previously recorded complete digest and private role. Extra links, replaced kinds, permissions and changed source digests are refused. Gate transcript. Whole branch is still under construction; no final gate or push.

Completed shared private-prefix reader step, head `56d8974fe36ed00b3648d9b6d21de993074610e7`. Atomic commit adds the pure reader and permanent regressions; integration into the disk phases remains separate. Exact isolated projection gate: `sh -n`, 15 direct shell cases, formatting, SSH all-target Clippy, and: ``` test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s ``` Every byte prefix (including original trailing newlines) is admitted only against its previously recorded complete digest and private role. Extra links, replaced kinds, permissions and changed source digests are refused. [Gate transcript](https://git.kayg.org/attachments/de8f2877-7890-4b10-816a-b9f266b6f33f). Whole branch is still under construction; no final gate or push.

kayg commented

2026-10-19 16:49:51 +00:00

Author

Owner

Additional exact-kind removal matrix RED: 56 passed, 1 failed, 1 ignored (new strict matrix). At actual mutation cut 2, unit and wanted were removed; helper returned Interrupted before launcher removal. Test then moved original .local subtree (including launcher, base, active manifest and creator anchor) to an independently held sibling and recreated .local as an empty directory with the original kind. Both original subtree and replacement were preserved, but repeated cleanup returned Ok(empty report). New test: crates/plugins/remote/src/uninstall_ownership_tests.rs:360. Source path: cleanup entrypoint order uninstall.rs:39 and :828; removed() sees all original reserved paths/base absent and returns empty at :915. This is a restart observability limitation: original durable receipts moved with the ancestor, so no current-path reconstruction may infer original identities. Root is assessing conservative reporting; no deletion failure observed, no assertion weakened. Raw receipt: /home/kayg/.cache/codex-scratch/addhost-readd-r4/evidence/native-ownership-first-red.log. Existing independent-recreation matrix remains green: 44 actual cuts, 1188 recreation cases, 2464 resume/repeat calls.

kayg referenced this issue

2026-10-19 16:50:08 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 16:50:09 +00:00

Author

Owner

Contract clarification for #235, proposed before updating the older command-count test: restaging after the early prompt now uses exactly two SSH operations, (1) public cleanup streamed through stdin, then (2) one compound cache/transfer/enrollment command. Each reacquires and validates the same durable phase. The old concatenated command exceeds the kernel single-argument limit once the shared ownership state machine is included; treating its truncated or rejected source as recoverable would be incorrect. The early prompt is already live before either operation.

The existing test session_restaging_uses_one_compound_command will become an ordered boundary assertion: exactly cleanup then exactly one compound transfer, preserving the full-image equality and commit assertions. No separate cache, upload or enrollment operations are added. Kernel argument coverage stays fixed at 131072 bytes; latest focused gate maximum is 130913. The extra SSH round trip must be measured on the perf VM with the required early-prompt timeline before final acceptance. No budget is raised and no R3 test changes.

Contract clarification for #235, proposed before updating the older command-count test: restaging after the early prompt now uses exactly two SSH operations, (1) public cleanup streamed through stdin, then (2) one compound cache/transfer/enrollment command. Each reacquires and validates the same durable phase. The old concatenated command exceeds the kernel single-argument limit once the shared ownership state machine is included; treating its truncated or rejected source as recoverable would be incorrect. The early prompt is already live before either operation. The existing test `session_restaging_uses_one_compound_command` will become an ordered boundary assertion: exactly cleanup then exactly one compound transfer, preserving the full-image equality and commit assertions. No separate cache, upload or enrollment operations are added. Kernel argument coverage stays fixed at 131072 bytes; latest focused gate maximum is 130913. The extra SSH round trip must be measured on the perf VM with the required early-prompt timeline before final acceptance. No budget is raised and no R3 test changes.

kayg commented

2026-10-19 16:54:54 +00:00

Author

Owner

Structural completion correction proposed before code changes (#231/#235): the new every-cut exact-kind/byte-edit matrix preserved all changed objects but exposed244 silent reports (1192 actual changed cases across44 current removal mutations). Moving a created ancestor can relocate the only manifest; after final authority deletion, a new external directory is also indistinguishable from normal inherited parents. Reporting current pathnames as ownership would be wrong. Controls prove successful removal with7 retained-a external parents must still repeat as a no-op.

Retain the existing original authenticated terminal receipt on EVERY completed removal, including an otherwise empty installation. Its marked base and exact control ancestor chain stay solely to make completion durable; operational units, launchers, slots and proven runtime files still retire. The existing terminal reader validates its original uid/device/inode/hash/link count. Repeated calls use that positive completion proof and report changed recorded candidates. If no original manifest/terminal is reachable and the expected base is absent, report the unverified expected base instead of silently claiming success. No deletion authority is inferred from absence or a new directory. Existing removed-install re-add already consumes the original terminal through creator proof; that path must remain green.

This is a state-machine choice, not a pathname exception. Update only physical control-retirement expectations to require the original durable terminal and its unchanged control parents; keep every identity, changed-object preservation, original R3 and repeated-report assertion. Add first/repeated no-op controls for both created-d and retained-a external parents. Independent structural review agrees this resolves the missing disk evidence without outside authority. Raw RED matrix will be attached with the fix. Current whole branch remains unfinished and unpublished.

Structural completion correction proposed before code changes (#231/#235): the new every-cut exact-kind/byte-edit matrix preserved all changed objects but exposed244 silent reports (1192 actual changed cases across44 current removal mutations). Moving a created ancestor can relocate the only manifest; after final authority deletion, a new external directory is also indistinguishable from normal inherited parents. Reporting current pathnames as ownership would be wrong. Controls prove successful removal with7 retained-a external parents must still repeat as a no-op. Retain the existing original authenticated terminal receipt on EVERY completed removal, including an otherwise empty installation. Its marked base and exact control ancestor chain stay solely to make completion durable; operational units, launchers, slots and proven runtime files still retire. The existing terminal reader validates its original uid/device/inode/hash/link count. Repeated calls use that positive completion proof and report changed recorded candidates. If no original manifest/terminal is reachable and the expected base is absent, report the unverified expected base instead of silently claiming success. No deletion authority is inferred from absence or a new directory. Existing removed-install re-add already consumes the original terminal through creator proof; that path must remain green. This is a state-machine choice, not a pathname exception. Update only physical control-retirement expectations to require the original durable terminal and its unchanged control parents; keep every identity, changed-object preservation, original R3 and repeated-report assertion. Add first/repeated no-op controls for both created-d and retained-a external parents. Independent structural review agrees this resolves the missing disk evidence without outside authority. Raw RED matrix will be attached with the fix. Current whole branch remains unfinished and unpublished.

kayg commented

2026-10-19 16:56:46 +00:00

Author

Owner

Extended exact-kind/same-inode native removal matrix completed strict RED: 44 actual syscall cuts, 24 candidate paths, 2112 attempted cases, 1192 applied changes (1056 exact-kind recreations, 136 regular same-inode edits); 535 absent-edit and 385 nonregular skips. All preservation assertions passed across 2384 repeated calls; 1638 explicit reports, 502 refusals, 244 silent reports fail the strict zero-silence assertion. Changed external created-d ancestors become undiscoverable once their subtree contains all original receipt paths, or after final authority retirement. No current-path recapture is permitted. Baseline controls: original created-d fixture removes all 7 external parents, first/repeat reports0; retained-a fixture keeps all 7 unchanged external parents with base absent, first/repeat reports0. This distinguishes retention from created paths; .local in the RED is created-d. Parent proposed permanent original terminal receipt plus conservative no-authority reporting separately before production edits. New identity/preservation assertions remain strong. Literal UID1002 writer smoke admitted natural f/d/l recreation and regular same-inode edit, UID1001 test caps0x3 and writer caps0x2; root/artifact mounts readonly, network only lo, /work tmpfs, all owned PIDs/container reaped and removed. Full foreign matrix remains pending. Reproducible scratch harness attached; no production edits in this test slice.

native-ownership-full-red.log
literal-foreign-writer-smoke3.log
ownership-foreign_writer.py.txt
ownership-run_container.py.txt
ownership-stage_artifact.py.txt
ownership-native-gate.sh.txt

Extended exact-kind/same-inode native removal matrix completed strict RED: 44 actual syscall cuts, 24 candidate paths, 2112 attempted cases, 1192 applied changes (1056 exact-kind recreations, 136 regular same-inode edits); 535 absent-edit and 385 nonregular skips. All preservation assertions passed across 2384 repeated calls; 1638 explicit reports, 502 refusals, 244 silent reports fail the strict zero-silence assertion. Changed external created-d ancestors become undiscoverable once their subtree contains all original receipt paths, or after final authority retirement. No current-path recapture is permitted. Baseline controls: original created-d fixture removes all 7 external parents, first/repeat reports0; retained-a fixture keeps all 7 unchanged external parents with base absent, first/repeat reports0. This distinguishes retention from created paths; .local in the RED is created-d. Parent proposed permanent original terminal receipt plus conservative no-authority reporting separately before production edits. New identity/preservation assertions remain strong. Literal UID1002 writer smoke admitted natural f/d/l recreation and regular same-inode edit, UID1001 test caps0x3 and writer caps0x2; root/artifact mounts readonly, network only lo, /work tmpfs, all owned PIDs/container reaped and removed. Full foreign matrix remains pending. Reproducible scratch harness attached; no production edits in this test slice. [native-ownership-full-red.log](https://git.kayg.org/attachments/71ac3f1d-4de2-4326-9327-6766f82b7027) [literal-foreign-writer-smoke3.log](https://git.kayg.org/attachments/8ad59606-fda0-48cf-9aa1-4de93e0d9c7a) [ownership-foreign_writer.py.txt](https://git.kayg.org/attachments/8525c05d-c8e0-4c50-b6ac-d2ac6ca3ef10) [ownership-run_container.py.txt](https://git.kayg.org/attachments/d3b4daa1-9dc4-4d03-986d-0258cd3b0762) [ownership-stage_artifact.py.txt](https://git.kayg.org/attachments/73d9d348-ec2c-44d5-aeb8-b22b20e18b5f) [ownership-native-gate.sh.txt](https://git.kayg.org/attachments/f933ee71-f682-4235-811c-a603d50874aa)

kayg commented

2026-10-19 16:58:15 +00:00

Author

Owner

Completed native helper-plan publication step, head fe5f7e06fdfde5e02041576d25386d87ed200753. Named partial plans are eliminated: anonymous write+fsync → creator anchor+directory sync → staged link → armed link → consumption. Same-context unarmed retry uses the original creator binding. Cancellation preserves independently replaced names.

Exact isolated commit gate passed fmt, remote all-target Clippy and:

PROTOCOL_OBSERVER_TOTAL actual_operation_cuts=48 independent_recreations=336 resume_repeat_calls=768
test result: ok. 56 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out; finished in 37.81s

Raw gate. The separately proposed permanent completion-terminal correction and expanded ordinary/foreign ownership matrices are still WIP; this is not the final branch gate. No push/deploy.

Completed native helper-plan publication step, head `fe5f7e06fdfde5e02041576d25386d87ed200753`. Named partial plans are eliminated: anonymous write+fsync → creator anchor+directory sync → staged link → armed link → consumption. Same-context unarmed retry uses the original creator binding. Cancellation preserves independently replaced names. Exact isolated commit gate passed fmt, remote all-target Clippy and: ``` PROTOCOL_OBSERVER_TOTAL actual_operation_cuts=48 independent_recreations=336 resume_repeat_calls=768 test result: ok. 56 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out; finished in 37.81s ``` [Raw gate](https://git.kayg.org/attachments/6c4599a4-13e7-4dd3-b0da-79d6fe5415d0). The separately proposed permanent completion-terminal correction and expanded ordinary/foreign ownership matrices are still WIP; this is not the final branch gate. No push/deploy.

kayg commented

2026-10-19 16:58:31 +00:00

Author

Owner

Literal separate-UID removal matrix completed against immutable pre-fix native ELF: strict RED on 300 silent reports, with every preservation assertion passing. 44 actual cuts, 24 paths, 3168 attempts; 1713 applied changes = 1056 natural UID1002 same-kind exact-byte/target recreations + 136 UID1002-writer edits preserving original UID1001 inode + 521 original-inode owner changes to UID1002. Explicit skips: absent edit535, absent owner535, nonregular edit385. Repeated calls3426 = explicit reports1970 + refusals1156 + silent reports300. Separate writer UID1002 has only CAP_DAC_OVERRIDE (all cap sets0x2); test UID1001 checks all cap sets0x3 (CHOWN+DAC_OVERRIDE). Kernel receipts record readonly root and artifact mounts, only lo network interface, /work tmpfs and namespace IDs. Original staged ELF SHA256 49d1ee9049a769e8f80df8f6b6c2172f68ec38e3b3a06964a66f4c180903750e remained unchanged. Owned container bda6219bbe2fca04f8c14701d0a9fcf97bddcf045c5149df3f65cbbb20abaa66 removed, inspect exit1; host client3933072 gone; namespace testPID9 and writerPID7 both reaped/gone (test101, writer0). Current production terminal correction and stronger completion tests are queued for full native gate, then identical foreign replay; no current-green claim.

native-ownership-foreign-red.log
ownership-foreign_writer.py.txt

Literal separate-UID removal matrix completed against immutable pre-fix native ELF: strict RED on 300 silent reports, with every preservation assertion passing. 44 actual cuts, 24 paths, 3168 attempts; 1713 applied changes = 1056 natural UID1002 same-kind exact-byte/target recreations + 136 UID1002-writer edits preserving original UID1001 inode + 521 original-inode owner changes to UID1002. Explicit skips: absent edit535, absent owner535, nonregular edit385. Repeated calls3426 = explicit reports1970 + refusals1156 + silent reports300. Separate writer UID1002 has only CAP_DAC_OVERRIDE (all cap sets0x2); test UID1001 checks all cap sets0x3 (CHOWN+DAC_OVERRIDE). Kernel receipts record readonly root and artifact mounts, only lo network interface, /work tmpfs and namespace IDs. Original staged ELF SHA256 49d1ee9049a769e8f80df8f6b6c2172f68ec38e3b3a06964a66f4c180903750e remained unchanged. Owned container bda6219bbe2fca04f8c14701d0a9fcf97bddcf045c5149df3f65cbbb20abaa66 removed, inspect exit1; host client3933072 gone; namespace testPID9 and writerPID7 both reaped/gone (test101, writer0). Current production terminal correction and stronger completion tests are queued for full native gate, then identical foreign replay; no current-green claim. [native-ownership-foreign-red.log](https://git.kayg.org/attachments/21034ff2-c1dc-49e2-a577-7ddf74a14e59) [ownership-foreign_writer.py.txt](https://git.kayg.org/attachments/9deb53c2-9aa2-4b39-a602-c3ba91770ca6)

kayg commented

2026-10-19 16:59:35 +00:00

Author

Owner

Focused compatibility verification after fe5f7e06f plus the integrated WIP (no new integration commit):

All five iterate failures assigned to this lane now pass unchanged assertions: fresh preexisting-state retention, disappearing original-copy source, committed independent operator notes, partial full-upload bridge reuse, and buffered-head invitation delivery. The fresh-mode scan now follows complete typed state proof validation; inherited modes are not mistaken for private writer modes. Missing original state descendants qualify only after the entire bound copied tree revalidates. Still-present originals and all non-state artifacts stay exact.

The partial-upload fixture now interrupts the actual restaging writer after seven bytes and its prior upload intent; it no longer fabricates recreation of a completed bound payload. The invitation fixture uses the shipping Journal producer and records delivered synthetic input outside installation state after capability probing. Its buffered head implementation still models read-through buffering for -c and delegates unrelated metadata options. All original bridge/input/nonexecution assertions remain.

Strict controls also pass: modified copied prefix, byte-identical copied recreation, newer original-v2 lineage, unknown enrollment children, empty/partial/mismatched interrupted copy variants, and the new missing-original-plus-independent-child preservation case (activation and rollback twice refuse, both trees retained). Transaction-content mismatch now keeps the existing Upload72 refusal after ownership/type/mode checks; unreadable metadata and kind mismatches retain71.

Verbatim focused gate results:

test negotiated_transfer_delivers_the_invitation_after_a_buffering_head ... ok
test compound_restaging_refuses_a_foreign_journal_before_upload ... ok
test every_setup_command_fits_one_kernel_argument_in_both_modes ... ok

Maximum generated argument130913bytes, under the unchanged131072 ceiling (Rootless maximum130799). After fixing only four test octal-separator lints in the independent observer, the full SSH all-target check reports:

Checking infraternal-plugin-ssh v0.1.0
Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.21s

These are functional gate receipts, not host performance measurements. The parent lane still owns the complete final verify-fast gate, release-size blocker, real service/VM evidence and integration commits. The matched management-only compilation candidate remains scratch-only pending size and perf-VM measurements; no profile adoption has been made.

Focused compatibility verification after fe5f7e06f plus the integrated WIP (no new integration commit): All five iterate failures assigned to this lane now pass unchanged assertions: fresh preexisting-state retention, disappearing original-copy source, committed independent operator notes, partial full-upload bridge reuse, and buffered-head invitation delivery. The fresh-mode scan now follows complete typed state proof validation; inherited modes are not mistaken for private writer modes. Missing original state descendants qualify only after the entire bound copied tree revalidates. Still-present originals and all non-state artifacts stay exact. The partial-upload fixture now interrupts the actual restaging writer after seven bytes and its prior upload intent; it no longer fabricates recreation of a completed bound payload. The invitation fixture uses the shipping Journal producer and records delivered synthetic input outside installation state after capability probing. Its buffered head implementation still models read-through buffering for -c and delegates unrelated metadata options. All original bridge/input/nonexecution assertions remain. Strict controls also pass: modified copied prefix, byte-identical copied recreation, newer original-v2 lineage, unknown enrollment children, empty/partial/mismatched interrupted copy variants, and the new missing-original-plus-independent-child preservation case (activation and rollback twice refuse, both trees retained). Transaction-content mismatch now keeps the existing Upload72 refusal after ownership/type/mode checks; unreadable metadata and kind mismatches retain71. Verbatim focused gate results: ``` test negotiated_transfer_delivers_the_invitation_after_a_buffering_head ... ok test compound_restaging_refuses_a_foreign_journal_before_upload ... ok test every_setup_command_fits_one_kernel_argument_in_both_modes ... ok ``` Maximum generated argument130913bytes, under the unchanged131072 ceiling (Rootless maximum130799). After fixing only four test octal-separator lints in the independent observer, the full SSH all-target check reports: ``` Checking infraternal-plugin-ssh v0.1.0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.21s ``` These are functional gate receipts, not host performance measurements. The parent lane still owns the complete final verify-fast gate, release-size blocker, real service/VM evidence and integration commits. The matched management-only compilation candidate remains scratch-only pending size and perf-VM measurements; no profile adoption has been made.

kayg commented

2026-10-19 17:02:33 +00:00

Author

Owner

Permanent-terminal follow-up actual-cut regression RED before ordering fix: every_actual_cut_finishes_retiring_noncontrol_created_parents. Cut14 resumes active+creator-anchor+original-terminal and incorrectly reports independent base contents; cut15 resumes creator-anchor+original-terminal and does the same. All peer identities are original; recognition must require exact terminal receipt, never prefix/path alone. Cut16 resumes after terminal becomes sole authority; cleanup returns completed no-op while original created .config parent still exists. Assertion at crates/plugins/remote/src/uninstall_ownership_tests.rs:472 fails; unchanged base+terminal identities passed before it. Source cause: remove_internal called finish_completion before parent_order, while subsequent completed() paths intentionally never delete. Root is moving original non-control created parent retirement before terminal publication; matching original control ancestors remain, replacements never skip. Both failures have actual RED receipts; no assertion weakened.

native-parent-retirement-red.log
native-parent-retirement-cut-red.log

Permanent-terminal follow-up actual-cut regression RED before ordering fix: every_actual_cut_finishes_retiring_noncontrol_created_parents. Cut14 resumes active+creator-anchor+original-terminal and incorrectly reports independent base contents; cut15 resumes creator-anchor+original-terminal and does the same. All peer identities are original; recognition must require exact terminal receipt, never prefix/path alone. Cut16 resumes after terminal becomes sole authority; cleanup returns completed no-op while original created .config parent still exists. Assertion at crates/plugins/remote/src/uninstall_ownership_tests.rs:472 fails; unchanged base+terminal identities passed before it. Source cause: remove_internal called finish_completion before parent_order, while subsequent completed() paths intentionally never delete. Root is moving original non-control created parent retirement before terminal publication; matching original control ancestors remain, replacements never skip. Both failures have actual RED receipts; no assertion weakened. [native-parent-retirement-red.log](https://git.kayg.org/attachments/008032d8-93c5-4e21-af83-60c33feb0364) [native-parent-retirement-cut-red.log](https://git.kayg.org/attachments/6aaa8493-7434-4642-baac-96293b6d6ec5)

kayg commented

2026-10-19 17:05:28 +00:00

Author

Owner

Completed pure removed-install custody reader, head 373925ac5efff54cd1b01a7303bd068c6c5a2f9c. Integration remains separate. The reader accepts only the original private base and terminal uid/device/inode/hash with one link; it never derives deletion authority from retained contents. It refuses independently present activation destinations before preparing another owner.

Exact isolated module gate: shell syntax, fmt, all-target SSH Clippy;13 real-shell controls (original custody, five identity/content/link changes, seven independent activation destinations), all preserving data/inodes. Source SHA256 30233fdeb0d7bdf931e23d7881a44df79c1e029eb1efa048fe0e08e9eb9ae76c.

test result: ok. 49 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.71s

Gate, exact direct control runner. Whole branch still unfinished; no final gate/push.

Completed pure removed-install custody reader, head `373925ac5efff54cd1b01a7303bd068c6c5a2f9c`. Integration remains separate. The reader accepts only the original private base and terminal uid/device/inode/hash with one link; it never derives deletion authority from retained contents. It refuses independently present activation destinations before preparing another owner. Exact isolated module gate: shell syntax, fmt, all-target SSH Clippy;13 real-shell controls (original custody, five identity/content/link changes, seven independent activation destinations), all preserving data/inodes. Source SHA256 `30233fdeb0d7bdf931e23d7881a44df79c1e029eb1efa048fe0e08e9eb9ae76c`. ``` test result: ok. 49 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.71s ``` [Gate](https://git.kayg.org/attachments/cad44be0-87aa-4e1a-901d-09e8bad5c57c), [exact direct control runner](https://git.kayg.org/attachments/696461d1-0e4f-45cb-9f49-707becddd340). Whole branch still unfinished; no final gate/push.

kayg commented

2026-10-19 17:07:07 +00:00

Author

Owner

Compatibility follow-up:14 distinct focused regressions now replay green (11 in first run plus3 corrected/exact-filter replays); touched SSH all-target Clippy and fmt pass. Coverage includes public-cleanup fixture HOME isolation, incomplete creator transaction, resumed acquisition retirement, stale socket, earlier cache refresh, exact cleanup→compound-transfer ordering, receipt budget, activation inspection, partial private retirement, late ready/owner files and stopped-unit restoration. The first run's2 red fixtures and its accidentally empty inspection filter remain visible in the raw log; the replay fixes both and uses the exact inspection name.

Fixture changes follow actual current producer phases: acquisition transaction remains in the protected prepared capsule; the sealed private retirement proof survives final stage unlink; stopped units use destination-local quarantine. Runtime directory identities are recorded before fresh-proof sealing, rather than inventing later ownership. Partial retirement stops after the real planned-manifest unlink, then preserves/reports a same-byte independently recreated still-bound transaction file. Original R3 assertions were not changed.

The fixture adapter now detects public-source markers through diagnostic prefixes and drops inherited HOME for every owned child; the permanent regression covers run and stream. See the earlier fixture-isolation finding for why this matters.

First diagnostic run, 3 corrected/exact replays, HOME guard regression. Full iterate/fast gates remain outstanding; these are functional test receipts, not performance acceptance numbers.

Compatibility follow-up:14 distinct focused regressions now replay green (11 in first run plus3 corrected/exact-filter replays); touched SSH all-target Clippy and fmt pass. Coverage includes public-cleanup fixture HOME isolation, incomplete creator transaction, resumed acquisition retirement, stale socket, earlier cache refresh, exact cleanup→compound-transfer ordering, receipt budget, activation inspection, partial private retirement, late ready/owner files and stopped-unit restoration. The first run's2 red fixtures and its accidentally empty inspection filter remain visible in the raw log; the replay fixes both and uses the exact inspection name. Fixture changes follow actual current producer phases: acquisition transaction remains in the protected prepared capsule; the sealed private retirement proof survives final stage unlink; stopped units use destination-local quarantine. Runtime directory identities are recorded before fresh-proof sealing, rather than inventing later ownership. Partial retirement stops after the real planned-manifest unlink, then preserves/reports a same-byte independently recreated still-bound transaction file. Original R3 assertions were not changed. The fixture adapter now detects public-source markers through diagnostic prefixes and drops inherited HOME for every owned child; the permanent regression covers run and stream. See the earlier fixture-isolation finding for why this matters. [First diagnostic run](https://git.kayg.org/attachments/6e0d0eb0-5180-4daf-82f2-820b2f3ae7fc), [3 corrected/exact replays](https://git.kayg.org/attachments/fe670371-2c22-494c-b5e0-2b1f9878cfa2), [HOME guard regression](https://git.kayg.org/attachments/28f35048-6e4c-4c89-8b14-e420071f9d04). Full iterate/fast gates remain outstanding; these are functional test receipts, not performance acceptance numbers.

kayg commented

2026-10-19 17:09:13 +00:00

Author

Owner

Native ownership test slice GREEN after permanent original terminal correction (working-tree tests; parent owns atomic integration and final branch gate). Fmt and all-target remote Clippy pass. Focused unmodified resume/repeat now completes all 21 actual cuts, retires every original non-control created parent and retains original terminal/base identities. Controls: original created-d parents retain only .local and .local/share (2/7); inherited-a parents retain all7 exact original identities; first/repeated reports0. Full uninstall gate: 59 passed; 0 failed; 1 ignored (separately required foreign slice). Ordinary strict matrix:42 actual cuts,2016 attempts,1164 changes (1008 same-kind exact-byte/target recreations +156 original-inode regular edits),492 absent-edit and360 nonregular skips;2328 repeats=1880 reports+448 refusals, silent0. Original matrix remains unchanged except terminal transition count:42 actualcuts,1134 independent recreations,2352 resume/repeatcalls. Runtime protocol matrix also passes:48 actual operations,336 independent recreations,768 resume/repeatcalls.

Literal separate-user matrix GREEN on exact immutably staged ELF:42 cuts,3024 attempts,1680 changes (1008 natural UID1002 same-kind recreations +156 UID1002-writer original-inode edits +516 original-inode owner changes to UID1002); absent edit492/owner492,nonregular360.3360 repeats=2104 reports+1256 refusals,silent0. NativePID9 UID1001 all capability sets0x3 (CHOWN,DAC_OVERRIDE); separate writerPID7 UID1002 all sets0x2 (DAC_OVERRIDE only). Readonly root/artifact mounts, network only lo, /work tmpfs and namespace IDs recorded. Container9f394e43dc5a3245a12dddac3118b50bd3da9c09a0c514d8284dc27068b787c9 removed/inspect1; hostclient4047639 gone, both namespacechildren reaped/gone, all exits0. Original source ELF SHA3fe77e352a2f25f3c3f6376d9af76133e50e117d934b8aae28cdf1df4de8cd7c unchanged during staging; staged ELF SHAa57eb3613001afce6dd3b09ce31378880d6afd3669f25bb6a2b9a5245904e787 unchanged across replay.

Reproduction after rebuilding via attached native-gate.sh: flock JOB/build.lock build-slot python3 JOB/ownership-harness/run_container.py --artifact JOB/ownership-artifacts --executable ownership-tests. Exact harness/loader bundler and receipts attached. No whole-branch acceptance claim; full scripts/verify fast and shell/install/Replace matrices remain parent work.

native-ownership-gate.log
native-ownership-artifact.json.txt
ownership-foreign_writer.py.txt
ownership-run_container.py.txt
ownership-stage_artifact.py.txt
ownership-stage-native.py.txt
ownership-native-gate.sh.txt
native-ownership-foreign-green.log

Native ownership test slice GREEN after permanent original terminal correction (working-tree tests; parent owns atomic integration and final branch gate). Fmt and all-target remote Clippy pass. Focused unmodified resume/repeat now completes all 21 actual cuts, retires every original non-control created parent and retains original terminal/base identities. Controls: original created-d parents retain only .local and .local/share (2/7); inherited-a parents retain all7 exact original identities; first/repeated reports0. Full uninstall gate: 59 passed; 0 failed; 1 ignored (separately required foreign slice). Ordinary strict matrix:42 actual cuts,2016 attempts,1164 changes (1008 same-kind exact-byte/target recreations +156 original-inode regular edits),492 absent-edit and360 nonregular skips;2328 repeats=1880 reports+448 refusals, silent0. Original matrix remains unchanged except terminal transition count:42 actualcuts,1134 independent recreations,2352 resume/repeatcalls. Runtime protocol matrix also passes:48 actual operations,336 independent recreations,768 resume/repeatcalls. Literal separate-user matrix GREEN on exact immutably staged ELF:42 cuts,3024 attempts,1680 changes (1008 natural UID1002 same-kind recreations +156 UID1002-writer original-inode edits +516 original-inode owner changes to UID1002); absent edit492/owner492,nonregular360.3360 repeats=2104 reports+1256 refusals,silent0. NativePID9 UID1001 all capability sets0x3 (CHOWN,DAC_OVERRIDE); separate writerPID7 UID1002 all sets0x2 (DAC_OVERRIDE only). Readonly root/artifact mounts, network only lo, /work tmpfs and namespace IDs recorded. Container9f394e43dc5a3245a12dddac3118b50bd3da9c09a0c514d8284dc27068b787c9 removed/inspect1; hostclient4047639 gone, both namespacechildren reaped/gone, all exits0. Original source ELF SHA3fe77e352a2f25f3c3f6376d9af76133e50e117d934b8aae28cdf1df4de8cd7c unchanged during staging; staged ELF SHAa57eb3613001afce6dd3b09ce31378880d6afd3669f25bb6a2b9a5245904e787 unchanged across replay. Reproduction after rebuilding via attached native-gate.sh: flock JOB/build.lock build-slot python3 JOB/ownership-harness/run_container.py --artifact JOB/ownership-artifacts --executable ownership-tests. Exact harness/loader bundler and receipts attached. No whole-branch acceptance claim; full scripts/verify fast and shell/install/Replace matrices remain parent work. [native-ownership-gate.log](https://git.kayg.org/attachments/9d4d176c-ca42-467e-be35-b9f62779f0d3) [native-ownership-artifact.json.txt](https://git.kayg.org/attachments/e3a08803-4878-40ec-9253-9f12ed14dfd9) [ownership-foreign_writer.py.txt](https://git.kayg.org/attachments/4127788c-58a1-4d1f-bc27-fb166ae019df) [ownership-run_container.py.txt](https://git.kayg.org/attachments/31a4c284-ee33-4ca0-a057-8747527aa37b) [ownership-stage_artifact.py.txt](https://git.kayg.org/attachments/2e17831a-853b-4a15-aacb-9d1de3bec593) [ownership-stage-native.py.txt](https://git.kayg.org/attachments/4f0e81e0-e79d-4413-822e-92ab5ec8f507) [ownership-native-gate.sh.txt](https://git.kayg.org/attachments/2509684a-f9ba-4a16-8fa7-7f6047c13647) [native-ownership-foreign-green.log](https://git.kayg.org/attachments/e6ea7cbe-fb51-48d5-b282-ee58cfc60915)

kayg commented

2026-10-19 17:11:41 +00:00

Author

Owner

Completed durable removal-terminal correction, head f12a11e6469b6401b9f0fad0d9f646d42b63e59b. Original completion evidence now persists even when all operational files retired. Non-control created parents retire before sole-terminal publication; the exact original three-link transition resumes without false leftovers. An absent base without original authority reports uncertainty and grants no deletion authority. The contract choice was posted before code changes.

Exact isolated commit gate passes fmt, touched remote all-target Clippy and:

REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=1134 resume_and_repeat_calls=2352
OWNERSHIP_MATRIX_TOTAL foreign_uid=None actual_mutation_cuts=42 attempted_cases=2016 changed_cases=1164 exact_kind_recreations=1008 in_place_edits=156 same_inode_owner_changes=0 absent_edit_skips=492 absent_owner_skips=0 nonregular_edit_skips=360 repeated_reports=1880 repeated_refusals=448 silent_reports=0
test result: ok. 59 passed; 0 failed; 1 ignored; 0 measured; 102 filtered out; finished in 59.42s

Exact commit gate. The required separate-user run also passed1680 changes/3360 repeats with zero silent reports; its literal UID/capability/isolation/cleanup receipts are in the independent review comment. Full install/Replace Cartesian proof, size and final gate still pending; no push/deploy.

Completed durable removal-terminal correction, head `f12a11e6469b6401b9f0fad0d9f646d42b63e59b`. Original completion evidence now persists even when all operational files retired. Non-control created parents retire before sole-terminal publication; the exact original three-link transition resumes without false leftovers. An absent base without original authority reports uncertainty and grants no deletion authority. The contract choice was posted before code changes. Exact isolated commit gate passes fmt, touched remote all-target Clippy and: ``` REMOVAL_OBSERVER_TOTAL actual_mutation_cuts=42 independent_recreations=1134 resume_and_repeat_calls=2352 OWNERSHIP_MATRIX_TOTAL foreign_uid=None actual_mutation_cuts=42 attempted_cases=2016 changed_cases=1164 exact_kind_recreations=1008 in_place_edits=156 same_inode_owner_changes=0 absent_edit_skips=492 absent_owner_skips=0 nonregular_edit_skips=360 repeated_reports=1880 repeated_refusals=448 silent_reports=0 test result: ok. 59 passed; 0 failed; 1 ignored; 0 measured; 102 filtered out; finished in 59.42s ``` [Exact commit gate](https://git.kayg.org/attachments/6333ddf1-3af0-4edb-bcde-00bd0a8140c2). The required separate-user run also passed1680 changes/3360 repeats with zero silent reports; its literal UID/capability/isolation/cleanup receipts are in the independent review comment. Full install/Replace Cartesian proof, size and final gate still pending; no push/deploy.

kayg commented

2026-10-19 17:17:57 +00:00

Author

Owner

P1 structural creator-origin gap confirmed in shipping shell functions. Control with an independent public base/state directory+file and unmodified original created-dirs refuses72 and preserves both. Append valid d/f rows for those unrelated objects to the same original created-dirs inode: validate_private_stage accepts, publish_fresh_proof promotes the current rows into immutable cleanup authority, and explicit fresh retirement exits0 deleting independent file and base. Replayed with canonical original base-created-SHA marker binding all 6 initial inodes exactly as base_creation.sh:105; only regular content changed, not journal inode. Sources: private_phase.sh:268-270 checks syntax/uid/mode only, fresh_proof_expected:199 prioritizes every current created-dirs row; base-created marker binds rows inode but not later content. Original fixture receipts in evidence/review-creator-rows-a4fd099f27564457809078e842e2b87d/result.json. Permanent strict regression now added near private preflight; actual fixture gate is queued. Proposed structural fix: immutable creator snapshot heads with original inode/hash bindings, predecessor-bound pending successor digest before writes, canonical private-source role recipes, all publications after stable successor proof; created-dirs becomes verified derived cache, never independent authority. No production edits in review slice.

review-creator-rows.py.txt
review-creator-rows-result.json.txt

P1 structural creator-origin gap confirmed in shipping shell functions. Control with an independent public base/state directory+file and unmodified original created-dirs refuses72 and preserves both. Append valid d/f rows for those unrelated objects to the same original created-dirs inode: validate_private_stage accepts, publish_fresh_proof promotes the current rows into immutable cleanup authority, and explicit fresh retirement exits0 deleting independent file and base. Replayed with canonical original base-created-SHA marker binding all 6 initial inodes exactly as base_creation.sh:105; only regular content changed, not journal inode. Sources: private_phase.sh:268-270 checks syntax/uid/mode only, fresh_proof_expected:199 prioritizes every current created-dirs row; base-created marker binds rows inode but not later content. Original fixture receipts in evidence/review-creator-rows-a4fd099f27564457809078e842e2b87d/result.json. Permanent strict regression now added near private preflight; actual fixture gate is queued. Proposed structural fix: immutable creator snapshot heads with original inode/hash bindings, predecessor-bound pending successor digest before writes, canonical private-source role recipes, all publications after stable successor proof; created-dirs becomes verified derived cache, never independent authority. No production edits in review slice. [review-creator-rows.py.txt](https://git.kayg.org/attachments/09232868-2552-4aa1-a749-b916eb2e9f67) [review-creator-rows-result.json.txt](https://git.kayg.org/attachments/f4f4d739-833c-4647-b498-b5448ce3e6fa)

kayg commented

2026-10-19 17:34:00 +00:00

Author

Owner

Independent review follow-up, additional P1 phase gap: the private retirement loader verifies its outside proof, but its later worker reads current proof rows without checking the original digest again. A real-function control adds an unrecorded private file between the read-only and deleting find passes: unchanged proof refuses72/preserves it; changing the same original proof inode to include that file makes the old worker finish0 and remove it. The final proof unlink also lacked a new original-identity check. This affects the shared state-retirement worker too.

Original control/result JSON, exact replay source. Permanent regression private_retirement_round4::retirement_proof_is_rechecked_after_the_initial_inventory covers current-byte edit, identical-byte replacement and extra alias, twice each, preserving all original stage files and receipts.

Correction is WIP: share complete-bound-file predicates with manifest readers, capture the validated original binding once, pass it and the exact expected link count into every worker, verify after each row read and before unlink, and verify final proof retirement. Fresh-proof row consumers follow the same original-binding rule. Focused gate is queued/running; no GREEN claim yet. The separate creator-ledger origin problem is being implemented as immutable anchored snapshots, not a syntax-only row check.

Independent review follow-up, additional P1 phase gap: the private retirement loader verifies its outside proof, but its later worker reads current proof rows without checking the original digest again. A real-function control adds an unrecorded private file between the read-only and deleting find passes: unchanged proof refuses72/preserves it; changing the same original proof inode to include that file makes the old worker finish0 and remove it. The final proof unlink also lacked a new original-identity check. This affects the shared state-retirement worker too. [Original control/result JSON](https://git.kayg.org/attachments/e8efba31-f8e4-4f0a-a8a3-567b94f88c28), [exact replay source](https://git.kayg.org/attachments/7d874d65-a2f0-4c7b-8247-332b50fb4748). Permanent regression `private_retirement_round4::retirement_proof_is_rechecked_after_the_initial_inventory` covers current-byte edit, identical-byte replacement and extra alias, twice each, preserving all original stage files and receipts. Correction is WIP: share complete-bound-file predicates with manifest readers, capture the validated original binding once, pass it and the exact expected link count into every worker, verify after each row read and before unlink, and verify final proof retirement. Fresh-proof row consumers follow the same original-binding rule. Focused gate is queued/running; no GREEN claim yet. The separate creator-ledger origin problem is being implemented as immutable anchored snapshots, not a syntax-only row check.

kayg commented

2026-10-19 18:59:21 +00:00

Author

Owner

Confirmed re-add/activation ownership gap on the round-4 candidate: a one-shot real systemctl-stop hook creates/recreates an independent unit after the original before-image check. Fresh activation succeeds and replaces UID/device/inode 1001:2049:2526795 with 1001:2049:2667522; upgrade succeeds and replaces 1001:2049:2497101 with 1001:2049:2667590. Both print stop_hook=yes/refused=false/kept=false. In-place-edit control correctly refuses and retains 1001:2049:2667539. Result: 1 passed, 2 failed. verbatim RED, source hashes

New tests/install/late_publication_round4.rs preserves the original manager behavior and retains old inodes aside, preventing inode reuse. Production fix is now authorized: original immutable before-image checks before public backup/move/replacement, original/creator ancestor custody, and no-clobber publication into expected-empty slots. No assertion is weakened. Detailed design and progress remain on #231; no completion claim.

Confirmed re-add/activation ownership gap on the round-4 candidate: a one-shot real systemctl-stop hook creates/recreates an independent unit after the original before-image check. Fresh activation succeeds and replaces UID/device/inode 1001:2049:2526795 with 1001:2049:2667522; upgrade succeeds and replaces 1001:2049:2497101 with 1001:2049:2667590. Both print stop_hook=yes/refused=false/kept=false. In-place-edit control correctly refuses and retains 1001:2049:2667539. Result: 1 passed, 2 failed. [verbatim RED](https://git.kayg.org/attachments/27eb72d7-683f-452e-8974-603f38f1eda5), [source hashes](https://git.kayg.org/attachments/ebfb7ce3-3431-45bd-9d03-91a45527e391) New tests/install/late_publication_round4.rs preserves the original manager behavior and retains old inodes aside, preventing inode reuse. Production fix is now authorized: original immutable before-image checks before public backup/move/replacement, original/creator ancestor custody, and no-clobber publication into expected-empty slots. No assertion is weakened. Detailed design and progress remain on #231; no completion claim.

kayg commented

2026-10-19 20:08:29 +00:00

Author

Owner

Finding: the unused legacy .bootstrap-acquiring cleanup path authenticated canonical bytes/mode but had no original inode row. Direct execution of the real fresh_cleanup.sh function removed an independently created 600 marker and returned0. The new path keeps the exact uid/dev/inode/bytes, reports the path and returns72; absent marker remains a no-op. Permanent Rust regression added before the fix. CLEANUP now also refuses this unrecorded marker and removes its obsolete pathname-only stage/acquisition fallback. No current constructor writes this legacy marker.

Before, after. Functional direct checks only; full frozen install replay remains pending.

Finding: the unused legacy .bootstrap-acquiring cleanup path authenticated canonical bytes/mode but had no original inode row. Direct execution of the real fresh_cleanup.sh function removed an independently created 600 marker and returned0. The new path keeps the exact uid/dev/inode/bytes, reports the path and returns72; absent marker remains a no-op. Permanent Rust regression added before the fix. CLEANUP now also refuses this unrecorded marker and removes its obsolete pathname-only stage/acquisition fallback. No current constructor writes this legacy marker. [Before](https://git.kayg.org/attachments/8c1f2400-f543-4db1-b9f5-29900c75c292), [after](https://git.kayg.org/attachments/47d043bc-4e8b-44a6-8ada-ef10b7ebb1c4). Functional direct checks only; full frozen install replay remains pending.

kayg commented

2026-10-19 20:17:12 +00:00

Author

Owner

Immutable late-publication v3: ALL 6 actual late controls PASS, each with the real stop hook reached, refusal and independent object kept: fresh unit recreation, upgrade unit recreation/in-place edit, upgrade binary/state/launcher recreation. Unit identities in the log are unchanged. Library Clippy PASS; direct publication 5/6. Overall LATE_PUBLICATION_GATE_V3 exit=1, because the NEW isolated launcher-backup test created a parent with native umask002 (mode775), correctly refused by publication_prepare. Exact mode control confirms775 alone produces71; only that test setup now explicitly makes its parent700, with preservation assertions unchanged. No production change for this fixture correction.

Verbatim v3 gate, immutable source receipt. Production publication SHA256 5e1ce9f099ebe4cfdd3e1b867c4b77e6f71b93d9456addbbb77a4aaa8b8ea2a5; original authority SHA256 3ea57927bc65f16e03b63bc434ccc4b08add53d0eb33d3cb2f867a7e7e3d2062; before/after hashes agree.

Separate ordinary second-fresh enroll71 remains UNRESOLVED. A coherent replay now queues the exact v3 production plus ONLY fixture native-AWK dispatch and the new launcher-test parent-mode correction; no live reader/parser WIP or private/enrollment trace is included. Full integration/size/final gate remain pending.

Immutable late-publication v3: ALL 6 actual late controls PASS, each with the real stop hook reached, refusal and independent object kept: fresh unit recreation, upgrade unit recreation/in-place edit, upgrade binary/state/launcher recreation. Unit identities in the log are unchanged. Library Clippy PASS; direct publication 5/6. Overall `LATE_PUBLICATION_GATE_V3 exit=1`, because the NEW isolated launcher-backup test created a parent with native umask002 (mode775), correctly refused by publication_prepare. [Exact mode control](https://git.kayg.org/attachments/d5fc9e68-d22d-4e59-9f72-d88eb117d3be) confirms775 alone produces71; only that test setup now explicitly makes its parent700, with preservation assertions unchanged. No production change for this fixture correction. [Verbatim v3 gate](https://git.kayg.org/attachments/6ecf1f46-2470-4a52-afd5-73cc4267fbce), [immutable source receipt](https://git.kayg.org/attachments/7aa7a4a3-1928-47d2-8296-d1c3dead69d8). Production publication SHA256 5e1ce9f099ebe4cfdd3e1b867c4b77e6f71b93d9456addbbb77a4aaa8b8ea2a5; original authority SHA256 3ea57927bc65f16e03b63bc434ccc4b08add53d0eb33d3cb2f867a7e7e3d2062; before/after hashes agree. Separate ordinary second-fresh enroll71 remains UNRESOLVED. A coherent replay now queues the exact v3 production plus ONLY fixture native-AWK dispatch and the new launcher-test parent-mode correction; no live reader/parser WIP or private/enrollment trace is included. Full integration/size/final gate remain pending.

kayg commented

2026-10-19 20:50:07 +00:00

Author

Owner

New concrete authority-read finding: manifest_emit authenticates previous-manifest once (manifest_authority.sh205–213), then manifest_directory42/113/130 and manifest_state33 reread its pathname with grep. A real-producer scratch control (upgrade capsule, immutable origin seed, before-image, original/saved/anchor bindings, real typed owner/launcher/unit preparation) transiently appends one d row during raw grep, restoring the exact original bytes and inode afterward. manifest_initial_emit returns0 and emits original_d_authority=no changed_d_authority=yes restored_binding=yes. An inherited parent gains deletion authority absent from its admitted original receipt. No authority checks are stubbed.

RED output, support source hashes. Proposal before code: capture bound receipt bytes with existing private_read, consume only captured bytes in parent emitters, and have each find worker receive the existing bounded private_write_program plus original binding and private_read once per batch. Never pass full receipt rows in argv. Investigate analogous rollback/private-phase consumers with concrete controls. D243/D255, #231/#235. Root owns the independent ready-manifest fix; its hunks remain separate.

New concrete authority-read finding: manifest_emit authenticates previous-manifest once (manifest_authority.sh205–213), then manifest_directory42/113/130 and manifest_state33 reread its pathname with grep. A real-producer scratch control (upgrade capsule, immutable origin seed, before-image, original/saved/anchor bindings, real typed owner/launcher/unit preparation) transiently appends one d row during raw grep, restoring the exact original bytes and inode afterward. manifest_initial_emit returns0 and emits original_d_authority=no changed_d_authority=yes restored_binding=yes. An inherited parent gains deletion authority absent from its admitted original receipt. No authority checks are stubbed. [RED output](https://git.kayg.org/attachments/655330bc-f3db-4d68-8ebd-fbb1314de389), [support source hashes](https://git.kayg.org/attachments/1979c97b-9986-41d6-bf98-e25dd4067f6c). Proposal before code: capture bound receipt bytes with existing private_read, consume only captured bytes in parent emitters, and have each find worker receive the existing bounded private_write_program plus original binding and private_read once per batch. Never pass full receipt rows in argv. Investigate analogous rollback/private-phase consumers with concrete controls. D243/D255, #231/#235. Root owns the independent ready-manifest fix; its hunks remain separate.

kayg commented

2026-10-19 20:53:27 +00:00

Author

Owner

New manual-completion finding: manifest_ready authenticated the original manifest before preparation but used an unconditional final rename after ready-ledger updates. A real sync-step hook recreated the manifest there: old producer returned 0 and overwrote the independent inode. The fix rechecks the original binding and all original ancestor identities immediately before publication; the same control now refuses (71) and preserves exact bytes/uid/device/inode. Separately, raw ready-row capture accepted changed rows when the original bytes were restored afterward; authenticated private_read capture now refuses (71), emits zero bytes, and leaves the original restored. Unchanged real producer completion still passes.

Publication RED, GREEN, capture RED, GREEN, unchanged positive. Permanent real commit_manual and read-capture regressions are queued in isolated manual-ready-source-v1; no full-test claim yet.

New manual-completion finding: manifest_ready authenticated the original manifest before preparation but used an unconditional final rename after ready-ledger updates. A real sync-step hook recreated the manifest there: old producer returned 0 and overwrote the independent inode. The fix rechecks the original binding and all original ancestor identities immediately before publication; the same control now refuses (71) and preserves exact bytes/uid/device/inode. Separately, raw ready-row capture accepted changed rows when the original bytes were restored afterward; authenticated private_read capture now refuses (71), emits zero bytes, and leaves the original restored. Unchanged real producer completion still passes. [Publication RED](https://git.kayg.org/attachments/11ac59c7-9880-4bce-9879-8a39ad1e7bb5), [GREEN](https://git.kayg.org/attachments/cfb9fd74-881a-47d8-ace1-2a923fa23dad), [capture RED](https://git.kayg.org/attachments/11f65313-49eb-4519-a108-070d011f5ffd), [GREEN](https://git.kayg.org/attachments/bc4cc535-3fe6-4e57-886e-f92fb7c1bb2f), [unchanged positive](https://git.kayg.org/attachments/0aa8f41f-beb0-4453-80df-494e9de11877). Permanent real commit_manual and read-capture regressions are queued in isolated manual-ready-source-v1; no full-test claim yet.

kayg commented

2026-10-19 21:01:05 +00:00

Author

Owner

Further concrete RED: after real manifest_initial_emit, manifest_bind, anchor/published proof and rollback_plan_bound, a transient changed/restored raw AWK read of planned-manifest makes actual rollback_retire move an independently recreated public binary into private replaced-binary. Status0; final original plan binding still validates. Destructive RED. Fix in progress: retain admitted original/planned/copied bytes and bindings; parent checks use those bytes, worker checks use original binding and existing private_read once per batch. No current tuple becomes new authority.

Manifest producer real-constructor controls: RED3 shows parent and find worker promote a→d, and changed capture is accepted. Candidate3 retains a→a and refuses changed/restored bytes during capture with71+hookhit. These are direct semantic controls, not the final branch gate.

Correction to prior fixture diagnosis: original panic lines347/421 were final program_c sentinel lookups, not program_a start lookups. Exact serialized source119151B SHA98a410ca87ede6819c86107492ae3723963fa7e649cddb07287eab8b0568405f has program_a=true, wire=true, literal=true, empty_c=true, refused=false. Extractor now preserves the generator's actual empty final binding. Both original semantic isolation controls and install-test Clippy pass; FIXTURE_SHAPE_GATE_V3 exit=0. No cap/timeouts/assertions weakened; final native dispatcher ambient-environment control included.

Further concrete RED: after real manifest_initial_emit, manifest_bind, anchor/published proof and rollback_plan_bound, a transient changed/restored raw AWK read of planned-manifest makes actual rollback_retire move an independently recreated public binary into private replaced-binary. Status0; final original plan binding still validates. [Destructive RED](https://git.kayg.org/attachments/0a50e2df-7610-4d38-87e9-17e13aaeaa53). Fix in progress: retain admitted original/planned/copied bytes and bindings; parent checks use those bytes, worker checks use original binding and existing private_read once per batch. No current tuple becomes new authority. Manifest producer real-constructor controls: [RED3](https://git.kayg.org/attachments/d576804f-f42b-4a65-b5a2-5acde1d61d25) shows parent and find worker promote a→d, and changed capture is accepted. [Candidate3](https://git.kayg.org/attachments/584ac04b-4342-40de-b2d7-ff8a346df687) retains a→a and refuses changed/restored bytes during capture with71+hookhit. These are direct semantic controls, not the final branch gate. Correction to prior fixture diagnosis: original panic lines347/421 were final program_c sentinel lookups, not program_a start lookups. Exact serialized source119151B SHA98a410ca87ede6819c86107492ae3723963fa7e649cddb07287eab8b0568405f has program_a=true, wire=true, literal=true, empty_c=true, refused=false. Extractor now preserves the generator's actual empty final binding. Both original semantic isolation controls and install-test Clippy pass; [FIXTURE_SHAPE_GATE_V3 exit=0](https://git.kayg.org/attachments/47dfc927-00c5-4155-95b8-815965ee7beb). No cap/timeouts/assertions weakened; final native dispatcher ambient-environment control included.

kayg commented

2026-10-19 21:12:00 +00:00

Author

Owner

Receipt-read follow-up, exact constructors: (1) preserving final newlines added an empty row to the completed-copy count. Real bind_copied_state wrote3 valid rows but refused71; counting captured bytes without appending another newline now succeeds0. (2) the remaining before-image fallback accepted an independently changed original when only raw AWK reads received changed rows, then the exact original receipt bytes were restored. Reproduction: control=refused, changed_original=accepted, original binding valid, hook hit. The candidate captures before-image bytes once through private_read, uses them for ancestor membership and compares original/current streams without reopening the receipt; identical control now refuses the changed original. A completed copy with a genuinely missing original child still succeeds.

Copy-count RED, GREEN, before-image RED, GREEN, missing-child positive. The standalone hook clears command lookup after installing its wrapper; the earlier inconclusive probe did not reach the hook and is not RED evidence.

All9 permanent captured-receipt cases are queued for a coherent Cargo replay plus fmt/clippy; frozen source. These controls are functional, not VM performance acceptance.

Receipt-read follow-up, exact constructors: (1) preserving final newlines added an empty row to the completed-copy count. Real bind_copied_state wrote3 valid rows but refused71; counting captured bytes without appending another newline now succeeds0. (2) the remaining before-image fallback accepted an independently changed original when only raw AWK reads received changed rows, then the exact original receipt bytes were restored. Reproduction: control=refused, changed_original=accepted, original binding valid, hook hit. The candidate captures before-image bytes once through private_read, uses them for ancestor membership and compares original/current streams without reopening the receipt; identical control now refuses the changed original. A completed copy with a genuinely missing original child still succeeds. [Copy-count RED](https://git.kayg.org/attachments/8d44ecab-fe2e-49da-835a-17110cdbe374), [GREEN](https://git.kayg.org/attachments/c0439426-8311-48cc-b8b1-87017add2cb3), [before-image RED](https://git.kayg.org/attachments/9f948f95-7e6c-4802-877d-42addf394b37), [GREEN](https://git.kayg.org/attachments/f8ef1420-bb00-47a9-8170-9ebfeca416ac), [missing-child positive](https://git.kayg.org/attachments/6b381cad-0e1e-4c7c-aeba-5331480e9c62). The standalone hook clears command lookup after installing its wrapper; the earlier inconclusive probe did not reach the hook and is not RED evidence. All9 permanent captured-receipt cases are queued for a coherent Cargo replay plus fmt/clippy; [frozen source](https://git.kayg.org/attachments/914b0c8d-243b-42f6-9ef8-2b5556352bfe). These controls are functional, not VM performance acceptance.

kayg commented

2026-10-19 22:11:27 +00:00

Author

Owner

Independent current-v2 review found four control paths that still bypass original identity authority. Full matrix held; no acceptance claim.

Legacy suffixed handoff content-only recovery deletes canonical same-byte recreated unit.new and overwrites a recreated live unit; both return0. Different UID is already refused by -O. Evidence https://git.kayg.org/attachments/32c7138f-5388-40b6-96cd-7f7e898c0a30
Fresh outer four-field rollback receipt is not in the immutable inventory. Same-byte independent receipt is deleted/status0, with or without an original fresh proof. Focused final-phase fixture, not full producer replay: https://git.kayg.org/attachments/525e685c-daeb-40be-ab9a-10103d923989
fresh_proof_expected validates before-image/active manifest then reopens their raw pathnames. Added permanent real-constructor regressions first; direct RED for BOTH streams returns0 with retained r row changed to deletion f row while original bytes are restored. Before https://git.kayg.org/attachments/b7adfeb8-9d44-407c-9c4e-c59b6fe3cc3c ; active https://git.kayg.org/attachments/3dcd0bbe-111c-4b28-b7c3-9f36661e58e8 ; independent focused result https://git.kayg.org/attachments/ea2bb75d-161d-48f7-b64d-56c775040bbb . No final deletion claimed for this probe.
Actual private retirement after read-only inventory deletes an independent empty pending directory; later returns72. Original pending identity was already recorded. Evidence https://git.kayg.org/attachments/fc9f10ce-476b-41ab-8aa0-e71a64894302

Design adjustment before implementation: the already-durable immutable fresh proof becomes the SOLE new-flow service-complete admission barrier. Remove redundant creation/reconstruction/deletion of the unbound four-field outer receipt. Existing legacy outer receipts remain untouched, reported and refused before mutation; proof-only recovery, preserve/staging phases and partial private retirement remain supported. This is a change to internal fresh-recovery representation; existing user-visible recovery outcomes remain. New actual-producer regression is added before the change: interrupt after successful base rmdir, independently create/recreate legacy outer file, repeat rollback twice and require same inode/bytes/proof retention. Existing fixtures will target the original immutable proof rather than silently consume legacy records.

Other repairs: legacy handoff fallback only retains/reports/refuses; fresh-proof derivation uses authenticated captured rows and ORIGINAL inode coordinates; all pending capsule/peer removals use one original-control check at each mutation. Coherent v3 compiled gates and complete generated matrix are still required.

Independent current-v2 review found four control paths that still bypass original identity authority. Full matrix held; no acceptance claim. 1. Legacy suffixed handoff content-only recovery deletes canonical same-byte recreated unit.new and overwrites a recreated live unit; both return0. Different UID is already refused by -O. Evidence https://git.kayg.org/attachments/32c7138f-5388-40b6-96cd-7f7e898c0a30 2. Fresh outer four-field rollback receipt is not in the immutable inventory. Same-byte independent receipt is deleted/status0, with or without an original fresh proof. Focused final-phase fixture, not full producer replay: https://git.kayg.org/attachments/525e685c-daeb-40be-ab9a-10103d923989 3. fresh_proof_expected validates before-image/active manifest then reopens their raw pathnames. Added permanent real-constructor regressions first; direct RED for BOTH streams returns0 with retained r row changed to deletion f row while original bytes are restored. Before https://git.kayg.org/attachments/b7adfeb8-9d44-407c-9c4e-c59b6fe3cc3c ; active https://git.kayg.org/attachments/3dcd0bbe-111c-4b28-b7c3-9f36661e58e8 ; independent focused result https://git.kayg.org/attachments/ea2bb75d-161d-48f7-b64d-56c775040bbb . No final deletion claimed for this probe. 4. Actual private retirement after read-only inventory deletes an independent empty pending directory; later returns72. Original pending identity was already recorded. Evidence https://git.kayg.org/attachments/fc9f10ce-476b-41ab-8aa0-e71a64894302 Design adjustment before implementation: the already-durable immutable fresh proof becomes the SOLE new-flow service-complete admission barrier. Remove redundant creation/reconstruction/deletion of the unbound four-field outer receipt. Existing legacy outer receipts remain untouched, reported and refused before mutation; proof-only recovery, preserve/staging phases and partial private retirement remain supported. This is a change to internal fresh-recovery representation; existing user-visible recovery outcomes remain. New actual-producer regression is added before the change: interrupt after successful base rmdir, independently create/recreate legacy outer file, repeat rollback twice and require same inode/bytes/proof retention. Existing fixtures will target the original immutable proof rather than silently consume legacy records. Other repairs: legacy handoff fallback only retains/reports/refuses; fresh-proof derivation uses authenticated captured rows and ORIGINAL inode coordinates; all pending capsule/peer removals use one original-control check at each mutation. Coherent v3 compiled gates and complete generated matrix are still required.

kayg commented

2026-10-19 22:28:48 +00:00

Author

Owner

New focused v4 finding: repeated Replace validates a partly retired private stage before dispatching the original retirement intent. Actual production retire_prepare/retire_resume interrupted immediately after successful rm(kind) leaves original transaction/proof. Exact restart prelude + full rollback dispatcher returns71 for both commit:upgrade and rollback:upgrade; full rollback dispatcher alone resumes0 from identical disk. No function stubs. Added permanent generated deletion-boundary regression before changing production ordering; proposed repair dispatches the original authenticated retirement intent before ordinary stage admission.

result.json
review-v4-restart.py.txt

New focused v4 finding: repeated Replace validates a partly retired private stage before dispatching the original retirement intent. Actual production retire_prepare/retire_resume interrupted immediately after successful rm(kind) leaves original transaction/proof. Exact restart prelude + full rollback dispatcher returns71 for both commit:upgrade and rollback:upgrade; full rollback dispatcher alone resumes0 from identical disk. No function stubs. Added permanent generated deletion-boundary regression before changing production ordering; proposed repair dispatches the original authenticated retirement intent before ordinary stage admission. [result.json](https://git.kayg.org/attachments/fba5417d-5622-47c9-a630-6af525e3b122) [review-v4-restart.py.txt](https://git.kayg.org/attachments/f15949f2-7c66-4598-89da-04d292c68f31)

kayg commented

2026-10-19 22:31:58 +00:00

Author

Owner

V4 compiled and passed install-target Clippy, but SSH library gate failed62 passed/2 failed/2 ignored: multiline quoted manifest child-worker violates existing compaction invariant; synthetic bounded-step fixture used retired dictionary word fresh_inspection_proof. Preserve assertions: child worker now stays on one physical quoted line, and fixture uses retained manifest_before_parent (same22bytes, same124,800-byte body and unchanged limits/behavior checks).

Focused fresh-proof-only review found validate_retired_stage retained unreachable legacy-schema fallback. Both real callers already require immutable proof; disappearance must refuse. Permanent missing-proof regression added before repair; direct real-helper RED0 -> GREEN72 preserves original stage/inodes/bytes. Removed fallback rather than inferring new authority. New retained restart regression enumerates actual rm/rmdir boundaries for commit/rollbackupgrade and repeats restart twice. Direct kind-deletion reproducer now restart0 for both actions with original intent dispatched ahead of ordinary stage checks. Compiled pre-fix regressions and coherent v5 integrated gate remain pending.

recovery-v4.log
recovery-v3-v4-delta.json
missing-fresh-admission-red.json
missing-fresh-admission-green.json
retained-restart-v5-direct.json

V4 compiled and passed install-target Clippy, but SSH library gate failed62 passed/2 failed/2 ignored: multiline quoted manifest child-worker violates existing compaction invariant; synthetic bounded-step fixture used retired dictionary word fresh_inspection_proof. Preserve assertions: child worker now stays on one physical quoted line, and fixture uses retained manifest_before_parent (same22bytes, same124,800-byte body and unchanged limits/behavior checks). Focused fresh-proof-only review found validate_retired_stage retained unreachable legacy-schema fallback. Both real callers already require immutable proof; disappearance must refuse. Permanent missing-proof regression added before repair; direct real-helper RED0 -> GREEN72 preserves original stage/inodes/bytes. Removed fallback rather than inferring new authority. New retained restart regression enumerates actual rm/rmdir boundaries for commit/rollbackupgrade and repeats restart twice. Direct kind-deletion reproducer now restart0 for both actions with original intent dispatched ahead of ordinary stage checks. Compiled pre-fix regressions and coherent v5 integrated gate remain pending. [recovery-v4.log](https://git.kayg.org/attachments/ab02effc-b8ed-4f14-be31-557d08a8e082) [recovery-v3-v4-delta.json](https://git.kayg.org/attachments/a1e00787-32c0-43dc-95eb-891ba55665a6) [missing-fresh-admission-red.json](https://git.kayg.org/attachments/9409c916-ba6b-4a2b-9b2f-6f53dfa8c745) [missing-fresh-admission-green.json](https://git.kayg.org/attachments/381b17fb-a90e-4552-aa4e-d27c4e3682b1) [retained-restart-v5-direct.json](https://git.kayg.org/attachments/e03d4cf6-5829-4b31-8807-d2b538f67474)

kayg commented

2026-10-19 22:55:19 +00:00

Author

Owner

Checkpoint at HEAD939407e9; still WIP/unpushed. Corrected compiled pre-fix regressions now demonstrate intended failures: repeated retained restart exits72 at an actual private deletion cut; retired-stage admission without immutable proof incorrectly succeeds0. Initial fixture incorrectly loaded guard before initializing base; that earlier failure was fixture-only and is not production evidence. Corrected source changes only fixture initialization order. Other focused rows pass:11 captured-receipt,2 legacy handoff (20 same-byte inode variants,40 repeats), actual recreated legacy outer, setup/recovery caps. Largest checked ordinary command129590 including253-byte DNS; unchanged cap131071.

V6 gate canceled by exact own waiting PID2382944 before execution; v7 draft never ran. V8 integrated gate stopped before tests at new recovery fixture expect_used lint; v9 fixes only accessor diagnostic form (same invariant), queued full SSH all-target Clippy/library/full install/ownership+ordinary recovery. New reporting control: recreated pending directory retained72 but no Left report; direct GREEN now preserves same identity and reports its exact path. Shared private-retirement admission/control refusals use one reporter, retaining their original status, without another process.

Ownership/recovery fixture migration now keeps modern partial-stage tests on actual immutable inventory checks, with original stage/proof/bytes retained; only old-format controls create legacy outer receipts. Three legacy75 expectations explicitly become modern inventory71; all R3 assertions unchanged. Runtime replay still pending the current compiled helper.

recovery-v4-regression2.log
recovery-v8.log
result.json
private-pending-report-green.json
ownership-recovery-fixture-migration-audit.md

Checkpoint at HEAD939407e9; still WIP/unpushed. Corrected compiled pre-fix regressions now demonstrate intended failures: repeated retained restart exits72 at an actual private deletion cut; retired-stage admission without immutable proof incorrectly succeeds0. Initial fixture incorrectly loaded guard before initializing base; that earlier failure was fixture-only and is not production evidence. Corrected source changes only fixture initialization order. Other focused rows pass:11 captured-receipt,2 legacy handoff (20 same-byte inode variants,40 repeats), actual recreated legacy outer, setup/recovery caps. Largest checked ordinary command129590 including253-byte DNS; unchanged cap131071. V6 gate canceled by exact own waiting PID2382944 before execution; v7 draft never ran. V8 integrated gate stopped before tests at new recovery fixture expect_used lint; v9 fixes only accessor diagnostic form (same invariant), queued full SSH all-target Clippy/library/full install/ownership+ordinary recovery. New reporting control: recreated pending directory retained72 but no Left report; direct GREEN now preserves same identity and reports its exact path. Shared private-retirement admission/control refusals use one reporter, retaining their original status, without another process. Ownership/recovery fixture migration now keeps modern partial-stage tests on actual immutable inventory checks, with original stage/proof/bytes retained; only old-format controls create legacy outer receipts. Three legacy75 expectations explicitly become modern inventory71; all R3 assertions unchanged. Runtime replay still pending the current compiled helper. [recovery-v4-regression2.log](https://git.kayg.org/attachments/2cbe7940-dc56-49c8-82e1-34c1fbcf5f32) [recovery-v8.log](https://git.kayg.org/attachments/6b2aeca6-1bfe-4e82-9617-d97c61c90b47) [result.json](https://git.kayg.org/attachments/7ba1f802-be9c-4098-81c0-be49ca13a16e) [private-pending-report-green.json](https://git.kayg.org/attachments/03023438-a3d4-4195-8ad0-8c609201c220) [ownership-recovery-fixture-migration-audit.md](https://git.kayg.org/attachments/cf9d2255-55c5-4f15-ba08-c02ca7efc390)

kayg commented

2026-10-19 23:18:45 +00:00

Author

Owner

Integrated frozen9: checked_staging_survives_a_buffering_payload_reader_and_reuses_the_cache fails before receipt (install.rs3216). Exact frozen fixture head ignores named-file arguments: public control head -c 4 -- PUBLIC_FILE returns stdin bytes, whereas native head returns file bytes. The new authenticated proof reader uses that named-file shape, so the fixture consumes transfer stdin during a metadata read.

Narrow test-tool correction: buffer only exact anonymous -c N; delegate all other shapes to installed head. Applied to the two buffered readers and streaming reader. No production or test-assertion changes. Exact named-file and anonymous controls now pass; unchanged compiled regressions pending.

red control
corrected controls

Separate ordinary interrupted-lock cleanup/retry failure is being diagnosed; no successful full install gate claimed.

Integrated frozen9: checked_staging_survives_a_buffering_payload_reader_and_reuses_the_cache fails before receipt (install.rs3216). Exact frozen fixture head ignores named-file arguments: public control head -c 4 -- PUBLIC_FILE returns stdin bytes, whereas native head returns file bytes. The new authenticated proof reader uses that named-file shape, so the fixture consumes transfer stdin during a metadata read. Narrow test-tool correction: buffer only exact anonymous -c N; delegate all other shapes to installed head. Applied to the two buffered readers and streaming reader. No production or test-assertion changes. Exact named-file and anonymous controls now pass; unchanged compiled regressions pending. [red control](https://git.kayg.org/attachments/557f5b3e-a0d8-4fc1-9727-a6e16e361ef6) [corrected controls](https://git.kayg.org/attachments/67ef16be-c83c-41d5-b8eb-e81be943dcd1) Separate ordinary interrupted-lock cleanup/retry failure is being diagnosed; no successful full install gate claimed.

kayg commented

2026-10-19 23:24:31 +00:00

Author

Owner

Additional test-oracle correction while investigating the buffered-reader failure: streaming.rs hash wrapper marks image progress after any stdin hash byte. Public metadata-only input reproduced that false witness (marker created before image input). New admission buffers exactly the public fixture image header (10 bytes), forwards it to the real hash child and acknowledges progress only for that image header. Metadata negative control now has no marker; image positive control has one. Original streaming assertions, transfer-tail barrier, sample size and deadlines unchanged; no production change.

negative control before correction
metadata and image controls after correction

Queued compiled buffered-reader gate now selects immutable buffered-readers-v9b-source; v9 draft was superseded before execution. All three exact compiled regression counts must be one and pass. Full install9 is still running with known failures; no final qualification claimed.

Additional test-oracle correction while investigating the buffered-reader failure: streaming.rs hash wrapper marks image progress after any stdin hash byte. Public metadata-only input reproduced that false witness (marker created before image input). New admission buffers exactly the public fixture image header (10 bytes), forwards it to the real hash child and acknowledges progress only for that image header. Metadata negative control now has no marker; image positive control has one. Original streaming assertions, transfer-tail barrier, sample size and deadlines unchanged; no production change. [negative control before correction](https://git.kayg.org/attachments/4e5fe456-ffee-4b36-9742-bda27645a274) [metadata and image controls after correction](https://git.kayg.org/attachments/a2c91beb-1c60-46bc-aecb-3af6d69f604f) Queued compiled buffered-reader gate now selects immutable buffered-readers-v9b-source; v9 draft was superseded before execution. All three exact compiled regression counts must be one and pass. Full install9 is still running with known failures; no final qualification claimed.

kayg referenced this issue

2026-10-19 23:33:08 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 23:33:08 +00:00

Author

Owner

Direct-source guard and reporting repair qualification for #231 / #235; this is not a Cargo or full-matrix result.

The missing-parent guard now locks the recorded capsule ancestor before original recovery, then validates and acquires a published parent by exact fd identity if publication raced ancestor selection. It invokes the existing recovery machine and never constructs a new transaction during inspection/rollback. setup_guard.sh SHA256 0555e9664db42cc1405880041f85fb920a5f6705a8f8d3b7d983d9e56f599d39. Guard-only direct control: interrupted real mkdir42 → original rollback0 with capsule/base removed → new transaction stage0 → rollback0. Its separate unknown-entry witness was preserved/refused but exposed the missing report before the reporting repair.

Base-creation custody checks now reuse shared fresh_refuse PATH 71. One bc_empty helper reports exact unknown children; existing schema/type/UID/inode checks and refusal status remain. The single failed bc_parent_rows capture forwards its existing public producer output, preserving Left diagnostics including path newlines; successful rows stay captured. Producer-closure audit found only generated identity/hash/hexpath rows and retention reports, no file contents or private input. base_creation.sh SHA256 c62a59fef0f4e44b817434d57cf5ffd99f4c74518b6087d546c871c422362005.

Direct reporting flow: statuses42,71,71,0,0,0, with exact sentinel Left path and unchanged inode/bytes on both refusals. Custody and captured-report controls: eight repeated custody controls (edited record, identical recreated record, bound-directory recreation, unknown child ×2), plus two actual parent-row capture controls retaining a newline-containing child path and its exact report. The corresponding permanent tests were added to the existing base_creation_round4 module; their Cargo gate is pending. No old assertions or thresholds changed.

Read-only review: bc_empty is an ordinary function, so its fresh_refuse terminates the current shell even in conditional/errexit-suppressed contexts; its dedicated loop variable does not overwrite callers. Failed captured rows are printed through literal %s, never evaluated, and the branch still exits71. Exact compiled caps and relevant concurrency/recovery gates remain required. The separate observer FT_ROOT correction is frozen against source9 and queued behind the existing jobs. All broader comparisons remain held: 0/8 current-source pairs; all96 partitions remain planned, with actual cut/path counts and the full Cartesian product unexecuted. Full preservation acceptance must check Left reports as well as retained identity/bytes.

Direct-source guard and reporting repair qualification for #231 / #235; this is **not** a Cargo or full-matrix result. The missing-parent guard now locks the recorded capsule ancestor before original recovery, then validates and acquires a published parent by exact fd identity if publication raced ancestor selection. It invokes the existing recovery machine and never constructs a new transaction during inspection/rollback. setup_guard.sh SHA256 `0555e9664db42cc1405880041f85fb920a5f6705a8f8d3b7d983d9e56f599d39`. [Guard-only direct control](https://git.kayg.org/attachments/ff3ec417-80ce-4abd-8e5d-18a324e8b10b): interrupted real mkdir42 → original rollback0 with capsule/base removed → new transaction stage0 → rollback0. Its separate unknown-entry witness was preserved/refused but exposed the missing report before the reporting repair. Base-creation custody checks now reuse shared fresh_refuse PATH 71. One bc_empty helper reports exact unknown children; existing schema/type/UID/inode checks and refusal status remain. The single failed bc_parent_rows capture forwards its existing public producer output, preserving Left diagnostics including path newlines; successful rows stay captured. Producer-closure audit found only generated identity/hash/hexpath rows and retention reports, no file contents or private input. base_creation.sh SHA256 `c62a59fef0f4e44b817434d57cf5ffd99f4c74518b6087d546c871c422362005`. [Direct reporting flow](https://git.kayg.org/attachments/9d63d0f0-42dc-48be-9737-720e01a26e58): statuses42,71,71,0,0,0, with exact sentinel Left path and unchanged inode/bytes on both refusals. [Custody and captured-report controls](https://git.kayg.org/attachments/ed1ffcb8-4a88-4f38-801f-2a9d4b3e8ad4): eight repeated custody controls (edited record, identical recreated record, bound-directory recreation, unknown child ×2), plus two actual parent-row capture controls retaining a newline-containing child path and its exact report. The corresponding permanent tests were added to the existing base_creation_round4 module; their Cargo gate is pending. No old assertions or thresholds changed. Read-only review: bc_empty is an ordinary function, so its fresh_refuse terminates the current shell even in conditional/errexit-suppressed contexts; its dedicated loop variable does not overwrite callers. Failed captured rows are printed through literal `%s`, never evaluated, and the branch still exits71. Exact compiled caps and relevant concurrency/recovery gates remain required. The separate observer FT_ROOT correction is frozen against source9 and queued behind the existing jobs. All broader comparisons remain held: 0/8 current-source pairs; all96 partitions remain planned, with actual cut/path counts and the full Cartesian product unexecuted. Full preservation acceptance must check Left reports as well as retained identity/bytes.

kayg commented

2026-10-19 23:35:01 +00:00

Author

Owner

Confirmed fixture-phase diagnosis and test-only migration (Cargo qualification pending).

The earlier-cache recovery fixture called real old.stage, which already publishes the runtime root and seals its creator row. Its factory then appended a duplicate runtime row directly to the immutable created-dirs inode. A broad rollback().is_err() assertion accepted that early ledger refusal, leaving the setup lease alive; later inspection correctly reported Busy. The intended case was a later foreign-root refusal after durable fresh cleanup.

A direct disposable control using the pinned v9 helper (6a5aafc37968e420865b8623e9aef8611012640a55ac7b7c4ea33dfdaf24ff28) confirms the distinction: original raw append -> ledger refusal, rollback72, no fresh proof, exact lease still live; corrected original-production row -> rollback72 with fresh proof present, transaction/socket retired, foreign sentinel preserved. Original diagnosis, corrected control.

The Rust fixture now asserts that real staging created the runtime root, keeps its dead socket/cache replacement checks, and additionally requires the immutable fresh proof after the expected rollback error. Remaining raw-append factories were migrated without changing their preservation assertions: readiness uses real enrollment and commit_manual, interrupted immediately after the real readiness rename; nested rendezvous publication calls compiled SHARED's existing typed producer over public-source stdin. The raw append helper is removed; no reset/reseed/new producer role or current-path ownership capture was added.

Direct production-source controls reached rendezvous producer0 and its intended durable fresh phase while preserving the stale nested socket. The readiness control reached JOIN0/activation0, exact post-readiness-rename cut99 with canonical nonce, then rollback0 with base absent. Rendezvous control, readiness control. These are bounded direct shell/source controls, not a compiled Rust fixture-suite verdict. The helper source file is rustfmt-clean; the modified Cargo tests remain pending the shared gate. No shipping behavior changed and no host performance numbers are claimed.

Confirmed fixture-phase diagnosis and test-only migration (Cargo qualification pending). The earlier-cache recovery fixture called real `old.stage`, which already publishes the runtime root and seals its creator row. Its factory then appended a duplicate runtime row directly to the immutable `created-dirs` inode. A broad `rollback().is_err()` assertion accepted that early ledger refusal, leaving the setup lease alive; later inspection correctly reported Busy. The intended case was a later foreign-root refusal after durable fresh cleanup. A direct disposable control using the pinned v9 helper (`6a5aafc37968e420865b8623e9aef8611012640a55ac7b7c4ea33dfdaf24ff28`) confirms the distinction: original raw append -> ledger refusal, rollback72, no fresh proof, exact lease still live; corrected original-production row -> rollback72 with fresh proof present, transaction/socket retired, foreign sentinel preserved. [Original diagnosis](https://git.kayg.org/attachments/a95bf364-1ac9-4291-98c6-efc1a7739caa), [corrected control](https://git.kayg.org/attachments/ac1c0e72-b997-4c05-962e-24f760f8d88b). The Rust fixture now asserts that real staging created the runtime root, keeps its dead socket/cache replacement checks, and additionally requires the immutable fresh proof after the expected rollback error. Remaining raw-append factories were migrated without changing their preservation assertions: readiness uses real enrollment and `commit_manual`, interrupted immediately after the real readiness rename; nested rendezvous publication calls compiled `SHARED`'s existing typed producer over public-source stdin. The raw append helper is removed; no reset/reseed/new producer role or current-path ownership capture was added. Direct production-source controls reached rendezvous producer0 and its intended durable fresh phase while preserving the stale nested socket. The readiness control reached JOIN0/activation0, exact post-readiness-rename cut99 with canonical nonce, then rollback0 with base absent. [Rendezvous control](https://git.kayg.org/attachments/82cd3446-0422-4961-a1cb-f9121ac19672), [readiness control](https://git.kayg.org/attachments/cc852a8c-8835-440b-87ce-270a09029364). These are bounded direct shell/source controls, not a compiled Rust fixture-suite verdict. The helper source file is rustfmt-clean; the modified Cargo tests remain pending the shared gate. No shipping behavior changed and no host performance numbers are claimed.

kayg commented

2026-10-19 23:41:51 +00:00

Author

Owner

Structural diagnostic fix: shared fresh_refuse currently writes stdout, so a nested inventory capture can swallow its exact Left report despite retaining/refusing the independent path. Direct actual-reporter control, including a newline in the public fixture path: exit71, unchanged inode/bytes, no outward report before correction.

All seven existing Left sites now use stderr (legacy handoff already did); status and message bytes are unchanged. Failed canonical-row captures no longer need per-assignment forwarding or emit partial rows. Production parser review found no Left stdout consumer: setup/transfer/linger/check readers consume named receipts, while command failures preserve numeric status with allowlisted stderr classification.

red captured-reporter control
green exact newline-path stderr, clean stdout, same identity/bytes

New round4 exact-report assertions are moving to stderr with added stdout-empty checks; status/identity/bytes assertions retained. The generated preservation oracle is adding a per-probe matcher over both output streams, retaining only an exact known-path boolean, reset every attempt; arbitrary process output and private stdin are never recorded. Negative controls must reject retained+nonzero without an exact report and stale witness reuse. Cargo/current integrated gates remain pending; frozen9 is unchanged and still running.

Structural diagnostic fix: shared fresh_refuse currently writes stdout, so a nested inventory capture can swallow its exact Left report despite retaining/refusing the independent path. Direct actual-reporter control, including a newline in the public fixture path: exit71, unchanged inode/bytes, no outward report before correction. All seven existing Left sites now use stderr (legacy handoff already did); status and message bytes are unchanged. Failed canonical-row captures no longer need per-assignment forwarding or emit partial rows. Production parser review found no Left stdout consumer: setup/transfer/linger/check readers consume named receipts, while command failures preserve numeric status with allowlisted stderr classification. [red captured-reporter control](https://git.kayg.org/attachments/278bd589-f3da-4dab-827c-b5a2225a5dbf) [green exact newline-path stderr, clean stdout, same identity/bytes](https://git.kayg.org/attachments/c9f464f6-7da0-41d8-b9f9-59e1bc21dd99) New round4 exact-report assertions are moving to stderr with added stdout-empty checks; status/identity/bytes assertions retained. The generated preservation oracle is adding a per-probe matcher over both output streams, retaining only an exact known-path boolean, reset every attempt; arbitrary process output and private stdin are never recorded. Negative controls must reject retained+nonzero without an exact report and stale witness reuse. Cargo/current integrated gates remain pending; frozen9 is unchanged and still running.

kayg commented

2026-10-19 23:48:03 +00:00

Author

Owner

Additional standalone fixture dependency correction: legacy_acquisition_bytes_do_not_authorize_an_unrecorded_inode loaded fresh_cleanup.sh without the shared creation_proof.sh reporter. Thus it returned127 (fresh_refuse: not found) before its intended refusal assertion. The test now includes the real shared module; expected status72 and original byte/UID/device/inode preservation assertions are unchanged. No shipping behavior changed.

Direct real-module control: omitted dependency127; complete dependency72; both retain the exact original marker; corrected diagnostic uses stderr and stdout remains empty. This is a bounded direct source control and rustfmt check, with the compiled Cargo fixture verdict still pending the next shared gate.

Additional standalone fixture dependency correction: `legacy_acquisition_bytes_do_not_authorize_an_unrecorded_inode` loaded `fresh_cleanup.sh` without the shared `creation_proof.sh` reporter. Thus it returned127 (`fresh_refuse: not found`) before its intended refusal assertion. The test now includes the real shared module; expected status72 and original byte/UID/device/inode preservation assertions are unchanged. No shipping behavior changed. [Direct real-module control](https://git.kayg.org/attachments/9cd2f022-bd67-4283-a2ed-28d0496672fd): omitted dependency127; complete dependency72; both retain the exact original marker; corrected diagnostic uses stderr and stdout remains empty. This is a bounded direct source control and rustfmt check, with the compiled Cargo fixture verdict still pending the next shared gate.

kayg referenced this issue

2026-10-19 23:50:17 +00:00

Re-adding a host replaces an older stuck infraternal agent (#225 field case) #231

kayg commented

2026-10-19 23:50:18 +00:00

Author

Owner

Retention reporting qualification update for #231 / #235. The earlier stdout-forwarding proposal is superseded by centralized terminal diagnostics on stderr, which also keeps STEP/FAIL stdout clean and carries exact reports through command substitutions without a new channel or line parser.

Direct-source controls splice the current shared fresh_refuse function into pinned9 definitions; they do not assume the old helper already contains the channel change. Eight repeated custody controls plus two actual captured/newline-path controls pass with exact stderr reporting and empty stdout. Current shared guard control passes six cases: mode775 and symlink refuse71 with exact stderr, owned755 succeeds0, each repeated twice with unchanged UID/device/inode/mode/link count. Permanent counterparts are added to the existing test module. These are direct-source results, not Cargo or full-matrix acceptance.

The test transport now has a per-probe in-memory retention witness shared with the original interrupted transaction. Local's existing execution core accepts an optional matcher, and Boundaries observes both channels before failure mapping, including its stopped-to-Local route. It saves only canonical expected public path prefixes and a boolean, never arbitrary failed output or private stdin. Every inspect/rollback/restart/commit/Replace attempt resets evidence. Strict preservation keeps every original identity/byte assertion and additionally requires a fresh exact Left report; typed producer adoption retains its independent binding/durability proof. Only a verified live own lease73 may defer reporting until the mandatory inactive inspection. Expected paths are the candidate plus independently changed descendants; no ancestor or pathname-prefix exemption was added.

The exact std-only matcher control exposed a whitespace-only reason false positive (RED), then passed after requiring actual reason bytes before the closing newline (GREEN1). It also covers wrong paths, incomplete reports, embedded path newlines, both output channels and stale evidence. A real-transport retained+nonzero/no-report negative control, private-stdin non-evidence control and unchanged-descendant exclusion control are added but await integrated Cargo qualification. File hashes and scope record.

The environment-only frozen9 gate remains queued behind existing serialized jobs. No new heavy gate, v10 source capture, or broad matrix run started. Current-source comparison count remains0/8; all96 partitions remain required, with actual Cartesian counts and VM feasibility measurements pending.

Retention reporting qualification update for #231 / #235. The earlier stdout-forwarding proposal is superseded by centralized terminal diagnostics on **stderr**, which also keeps STEP/FAIL stdout clean and carries exact reports through command substitutions without a new channel or line parser. Direct-source controls splice the current shared fresh_refuse function into pinned9 definitions; they do not assume the old helper already contains the channel change. [Eight repeated custody controls plus two actual captured/newline-path controls](https://git.kayg.org/attachments/a8502734-f810-44f4-940d-945ea20e2ea9) pass with exact stderr reporting and empty stdout. [Current shared guard control](https://git.kayg.org/attachments/23c466b2-b49e-4333-bac0-a53399a15c06) passes six cases: mode775 and symlink refuse71 with exact stderr, owned755 succeeds0, each repeated twice with unchanged UID/device/inode/mode/link count. Permanent counterparts are added to the existing test module. These are direct-source results, not Cargo or full-matrix acceptance. The test transport now has a per-probe in-memory retention witness shared with the original interrupted transaction. Local's existing execution core accepts an optional matcher, and Boundaries observes both channels before failure mapping, including its stopped-to-Local route. It saves only canonical expected public path prefixes and a boolean, never arbitrary failed output or private stdin. Every inspect/rollback/restart/commit/Replace attempt resets evidence. Strict preservation keeps every original identity/byte assertion and additionally requires a fresh exact Left report; typed producer adoption retains its independent binding/durability proof. Only a verified live own lease73 may defer reporting until the mandatory inactive inspection. Expected paths are the candidate plus independently changed descendants; no ancestor or pathname-prefix exemption was added. The exact std-only matcher control exposed a whitespace-only reason false positive ([RED](https://git.kayg.org/attachments/1b7f50d2-2086-44ed-bcef-59ffb85747ee)), then passed after requiring actual reason bytes before the closing newline ([GREEN1](https://git.kayg.org/attachments/180409fb-4bd7-4043-80e1-46e81bda783e)). It also covers wrong paths, incomplete reports, embedded path newlines, both output channels and stale evidence. A real-transport retained+nonzero/no-report negative control, private-stdin non-evidence control and unchanged-descendant exclusion control are added but await integrated Cargo qualification. [File hashes and scope record](https://git.kayg.org/attachments/98a2273d-4f19-4c59-9d4e-d6135d1f67c4). The environment-only frozen9 gate remains queued behind existing serialized jobs. No new heavy gate, v10 source capture, or broad matrix run started. Current-source comparison count remains0/8; all96 partitions remain required, with actual Cartesian counts and VM feasibility measurements pending.

kayg commented

2026-10-19 23:54:11 +00:00

Author

Owner

R4 parent refusal reporting: the actual setup guard refused an owned mode-775 parent with exit 71 but omitted its retained path. A shared bc_guard_directory predicate now preserves the existing ownership/type/non-writable-parent checks and reports the exact retained path; strict private-directory mode-700 admission is unchanged. Actual guard controls: GREEN 4 (two repeated unsafe-parent refusals, accepted owned mode-755 parent, rejected symlink); sentinel UID/device/inode/bytes unchanged. The two incomplete positive fixtures omitted required context and are excluded from production evidence. Compiled qualification remains pending.

RED GREEN Excluded fixture attempts

R4 parent refusal reporting: the actual setup guard refused an owned mode-775 parent with exit 71 but omitted its retained path. A shared bc_guard_directory predicate now preserves the existing ownership/type/non-writable-parent checks and reports the exact retained path; strict private-directory mode-700 admission is unchanged. Actual guard controls: GREEN 4 (two repeated unsafe-parent refusals, accepted owned mode-755 parent, rejected symlink); sentinel UID/device/inode/bytes unchanged. The two incomplete positive fixtures omitted required context and are excluded from production evidence. Compiled qualification remains pending. [RED](https://git.kayg.org/attachments/28a12fd9-5190-4bfe-9dc8-731fa0b5d700) [GREEN](https://git.kayg.org/attachments/205041e8-26a4-49e9-aafe-aa25f77e2b1c) [Excluded fixture attempts](https://git.kayg.org/attachments/7ab19e8e-31d5-4ee4-8be2-90e545094322)

kayg commented

2026-10-19 23:56:59 +00:00

Author

Owner

R4 new production finding: upgrade rollback admits its private stage before manager calls, then retire_prepare/retire_contents observes the current tree after those calls without re-admitting the typed phase. Actual pinned-v9 producer replay: fresh stage/join/activate/commit all 0, upgrade stage/join/activate all 0; daemon-reload callback creates an independent mode-600 child and records its UID/device/inode outside stage; rollback returns 0 and deletes it, repeated rollback also returns 0. No raw receipt edits or producer stubs. Compiled regression is queued.

Chosen structural correction: at the shared retirement-publication boundary capture rows, admit the complete typed private phase, require a second inventory to equal those captured rows, and publish only the original captured stream. This fences every retirement caller rather than adding checks around individual manager calls. Unknown or changed entries remain and must be reported. Pending/existing immutable retirement phases retain their original digest authority.

Actual producer RED

R4 new production finding: upgrade rollback admits its private stage before manager calls, then retire_prepare/retire_contents observes the current tree after those calls without re-admitting the typed phase. Actual pinned-v9 producer replay: fresh stage/join/activate/commit all 0, upgrade stage/join/activate all 0; daemon-reload callback creates an independent mode-600 child and records its UID/device/inode outside stage; rollback returns 0 and deletes it, repeated rollback also returns 0. No raw receipt edits or producer stubs. Compiled regression is queued. Chosen structural correction: at the shared retirement-publication boundary capture rows, admit the complete typed private phase, require a second inventory to equal those captured rows, and publish only the original captured stream. This fences every retirement caller rather than adding checks around individual manager calls. Unknown or changed entries remain and must be reported. Pending/existing immutable retirement phases retain their original digest authority. [Actual producer RED](https://git.kayg.org/attachments/c514b173-9a65-4dab-8e55-9513fbbfa666)

kayg commented

2026-10-19 23:58:03 +00:00

Author

Owner

The standalone native_preintent_identity_uses_its_prior_copy_creator test also had incomplete source composition: it loaded the identity admission module but omitted the shared bc_directory, fresh_refuse, and cl_exists definitions. The full9 run therefore returned127 before its intended successful original-identity case.

Only test dependencies changed: real creation-proof, base-creation, and creator-ledger module definitions now precede the existing admission modules. Loading them invokes no producer. All original status and identity/inode/byte-preservation assertions remain unchanged. Direct unchanged eight-case matrix: incomplete source gives eight127 results; complete source gives0/71/71/71 for both bound-root variants, preserving every original observed identity. The original FD stays open during same-byte independent recreation. Rustfmt is clean; Cargo qualification is pending the shared gate. No production behavior or performance claim changed.

The standalone `native_preintent_identity_uses_its_prior_copy_creator` test also had incomplete source composition: it loaded the identity admission module but omitted the shared `bc_directory`, `fresh_refuse`, and `cl_exists` definitions. The full9 run therefore returned127 before its intended successful original-identity case. Only test dependencies changed: real creation-proof, base-creation, and creator-ledger module definitions now precede the existing admission modules. Loading them invokes no producer. All original status and identity/inode/byte-preservation assertions remain unchanged. [Direct unchanged eight-case matrix](https://git.kayg.org/attachments/a1b620e3-ce45-4e36-97b6-1fbd22f50022): incomplete source gives eight127 results; complete source gives0/71/71/71 for both bound-root variants, preserving every original observed identity. The original FD stays open during same-byte independent recreation. Rustfmt is clean; Cargo qualification is pending the shared gate. No production behavior or performance claim changed.

kayg commented

2026-10-20 00:01:14 +00:00

Author

Owner

Prepared complete-matrix feasibility accounting while the genuine late-private retirement fix remains in progress. No new build, actual discovery or VM run was launched.

The planned set remains all 96 partitions: both modes × fresh/genuine-upgrade × framed/separate × ordinary/manual/after × four manager observations. The 36 fresh service supplements remain explicitly synthetic cache observations; the 36 upgrade supplements start from a genuine installation.

For each independently discovered partition with C actual syscall/durability cuts and P named candidate paths, the required product is 3CP mutation tuples, two preservation workflows (6CP logical route-equivalents), plus 3C pristine recovery routes. Actual fixture allocations are recorded separately because strict unchanged-tree batching can reuse original cut identities; every group with legitimate mutations/adoption falls back to both original fresh-fixture workflows in full. Discarded batch work is overhead, never counted completion.

The explicit accounting checker requires all 96 distinct source/artifact/trace/universe-pinned inventories and verifies observed trace/path counts and product arithmetic. Its synthetic controls passed: complete-set arithmetic, and rejection of missing partition, duplicate partition, changed receipt hash and changed trace count. This is accounting qualification only; current-source cut/path counts and runtime projections remain unknown.

The prepared pilot preserves every required final case. It first compares the same finite diagnostic cases through isolated and strict-batch routes, requiring unchanged original tree/identities and exact reset-per-operation Left reports. It then measures an actual whole cut with all P×3 cases when bounded measurement fits the perf-VM lock, recording actual four-worker throughput, fallback groups, original-upgrade warmups, guardian teardown and route counts. All performance projections must use that matched-source VM evidence and actual complete inventories, never the shared-host full-suite duration or obsolete observer samples. Existing START_CUT suffix runs remain diagnostic; final resumed acceptance requires a source/trace/universe-bound union of complete cut receipts.

Raw preparation files remain outside checkout: activation-matrix-feasibility-plan.json, account-activation-product.py and evidence/activation-product-accounting-unit.json. Complete actual matrix execution and current-source observer equivalence remain pending.

Prepared complete-matrix feasibility accounting while the genuine late-private retirement fix remains in progress. No new build, actual discovery or VM run was launched. The planned set remains all 96 partitions: both modes × fresh/genuine-upgrade × framed/separate × ordinary/manual/after × four manager observations. The 36 fresh service supplements remain explicitly synthetic cache observations; the 36 upgrade supplements start from a genuine installation. For each independently discovered partition with C actual syscall/durability cuts and P named candidate paths, the required product is 3CP mutation tuples, two preservation workflows (6CP logical route-equivalents), plus 3C pristine recovery routes. Actual fixture allocations are recorded separately because strict unchanged-tree batching can reuse original cut identities; every group with legitimate mutations/adoption falls back to both original fresh-fixture workflows in full. Discarded batch work is overhead, never counted completion. The explicit accounting checker requires all 96 distinct source/artifact/trace/universe-pinned inventories and verifies observed trace/path counts and product arithmetic. Its synthetic controls passed: complete-set arithmetic, and rejection of missing partition, duplicate partition, changed receipt hash and changed trace count. This is accounting qualification only; current-source cut/path counts and runtime projections remain unknown. The prepared pilot preserves every required final case. It first compares the same finite diagnostic cases through isolated and strict-batch routes, requiring unchanged original tree/identities and exact reset-per-operation Left reports. It then measures an actual whole cut with all P×3 cases when bounded measurement fits the perf-VM lock, recording actual four-worker throughput, fallback groups, original-upgrade warmups, guardian teardown and route counts. All performance projections must use that matched-source VM evidence and actual complete inventories, never the shared-host full-suite duration or obsolete observer samples. Existing START_CUT suffix runs remain diagnostic; final resumed acceptance requires a source/trace/universe-bound union of complete cut receipts. Raw preparation files remain outside checkout: activation-matrix-feasibility-plan.json, account-activation-product.py and evidence/activation-product-accounting-unit.json. Complete actual matrix execution and current-source observer equivalence remain pending.

kayg commented

2026-10-20 00:06:33 +00:00

Author

Owner

Prepared matrix orchestration against the immutable recovery-v10 source only; no build, fixture execution or comparison was launched.

Verified all 72 parent-manifest source hashes. Source manifest SHA256: ad9f6f2e57f7a7e9b33448d7998ff99b32be30054bf03c392c23b61570016dea. Retirement module SHA256: a7716f99f6ba345289a5f5749f6c00cb9a538b207f7296fd13f8f9803d320ffb. Frozen observer environment and per-attempt report witness match the prepared source. The genuine late-private test requires refusal, the original UID/device/inode and bytes, and a fresh exact report on both rollback attempts.

Read-only review confirmed retirement preparation retains the first row capture through typed admission and identical recapture; the low-level inventory writer receives those original bytes, and publication compares the original argument to the current capture before writing. Consumer fixtures supply their own synthetic inventory without substituting for whole-setup admission. This is source review, not a claim that the v10 regression passed.

The prepared runner refuses missing compiler pins or artifact-bound critical results. After the parent critical gate succeeds and scheduling releases, it runs the unchanged setup and cleanup argument-cap controls before all eight matched full/filtered observer comparisons, with immutable staged executables and checkpointed ordered-equivalence receipts. All 96 complete partitions remain planned. Python syntax and shell parsing checks passed for the orchestration scripts; compilation, caps, current-source equivalence, counts and Cartesian execution remain pending.

Prepared matrix orchestration against the immutable recovery-v10 source only; no build, fixture execution or comparison was launched. Verified all 72 parent-manifest source hashes. Source manifest SHA256: ad9f6f2e57f7a7e9b33448d7998ff99b32be30054bf03c392c23b61570016dea. Retirement module SHA256: a7716f99f6ba345289a5f5749f6c00cb9a538b207f7296fd13f8f9803d320ffb. Frozen observer environment and per-attempt report witness match the prepared source. The genuine late-private test requires refusal, the original UID/device/inode and bytes, and a fresh exact report on both rollback attempts. Read-only review confirmed retirement preparation retains the first row capture through typed admission and identical recapture; the low-level inventory writer receives those original bytes, and publication compares the original argument to the current capture before writing. Consumer fixtures supply their own synthetic inventory without substituting for whole-setup admission. This is source review, not a claim that the v10 regression passed. The prepared runner refuses missing compiler pins or artifact-bound critical results. After the parent critical gate succeeds and scheduling releases, it runs the unchanged setup and cleanup argument-cap controls before all eight matched full/filtered observer comparisons, with immutable staged executables and checkpointed ordered-equivalence receipts. All 96 complete partitions remain planned. Python syntax and shell parsing checks passed for the orchestration scripts; compilation, caps, current-source equivalence, counts and Cartesian execution remain pending.

kayg commented

2026-10-20 00:06:34 +00:00

Author

Owner

Current structural correction is frozen as recovery-v10 (72 changed source files, base939407e9fc8fd5633cc0edd0b96822f3173c509b). Retirement preparation captures rows before complete typed-phase admission, requires an identical recapture, and passes the first admitted bytes to publication. Pending/repeated retirement remains bound to the original on-disk digest. Unknown private roots identify their exact retained path. Genuine regression requires nonzero refusal, original UID/device/inode/bytes, and a fresh exact Left report on both rollback attempts. Consumer-only fixtures now explicitly supply their fixed synthetic inventory to the low-level writer; none overrides setup admission.

An intermediate direct overlay preserved the independent file on both attempts (75); it did not qualify reporting or current-source compiled acceptance. A subsequent diagnostic expired before initial activation completed and is explicitly excluded. Current compiled gate is queued, not green. Full-v9 suite also found a fresh-restart success regression (none variant71), now under diagnosis and included in the focused gate.

Current source manifest Intermediate preservation control Excluded control Scope/qualification

Current structural correction is frozen as recovery-v10 (72 changed source files, base939407e9fc8fd5633cc0edd0b96822f3173c509b). Retirement preparation captures rows before complete typed-phase admission, requires an identical recapture, and passes the first admitted bytes to publication. Pending/repeated retirement remains bound to the original on-disk digest. Unknown private roots identify their exact retained path. Genuine regression requires nonzero refusal, original UID/device/inode/bytes, and a fresh exact Left report on both rollback attempts. Consumer-only fixtures now explicitly supply their fixed synthetic inventory to the low-level writer; none overrides setup admission. An intermediate direct overlay preserved the independent file on both attempts (75); it did not qualify reporting or current-source compiled acceptance. A subsequent diagnostic expired before initial activation completed and is explicitly excluded. Current compiled gate is queued, not green. Full-v9 suite also found a fresh-restart success regression (none variant71), now under diagnosis and included in the focused gate. [Current source manifest](https://git.kayg.org/attachments/b48ba290-8cb8-49a5-a250-7a4aa54acfbc) [Intermediate preservation control](https://git.kayg.org/attachments/0df2acaf-2ac4-440f-abaa-d52858e2cb05) [Excluded control](https://git.kayg.org/attachments/a4097a40-73f2-41fc-89b2-539b36c14e3d) [Scope/qualification](https://git.kayg.org/attachments/4285dac5-4f97-4461-99e6-1119035d8a2c)

kayg commented

2026-10-20 00:07:02 +00:00

Author

Owner

Correction to the immediately preceding v10 checkpoint: repeated_fresh_restart_restores_the_previous_state_before_replacing_it passed. The failing none variant71 belongs to the following retained_base_cleanup_keeps_original_data_and_refuses_recreated_custody test. The standalone finish_fresh fixture composition is being diagnosed. Both are included in the focused v10 gate. No production conclusion follows from the earlier mistaken label.

Correction to the immediately preceding v10 checkpoint: repeated_fresh_restart_restores_the_previous_state_before_replacing_it passed. The failing `none` variant71 belongs to the following retained_base_cleanup_keeps_original_data_and_refuses_recreated_custody test. The standalone finish_fresh fixture composition is being diagnosed. Both are included in the focused v10 gate. No production conclusion follows from the earlier mistaken label.

kayg commented

2026-10-20 00:14:10 +00:00

Author

Owner

Resumable R4 source checkpoint: HEAD939407e9fc8fd5633cc0edd0b96822f3173c509b remains unpublished. The72-file source11 overlay is attached (351660B, SHA25656fd3a0bcdf46e821c4d821f2504a938c3a8df394fdcd21e3c6010941c5a5274); reconstruct with git archive that base plus overlay and embedded manifest. It contains current structural retirement admission/reporting and all diagnosed fixture migrations, not a qualified final head. Source11 differs from10 only in the retained-base standalone fixture reader imports. Source10 was canceled before execution (empty log/no children).

Full frozen9 remains running and has9 actual runner failures so far; they are diagnosed old-source guard/fixture cases, covered by current fixes. Its64 library tests and SSH all-target Clippy passed; 2 library diagnostics remain explicitly ignored. Source11 syntax/fmt pass (27 shell modules); new46 file role headers verified. Source11 critical gate queued: gate-recovery-v11.sh,21 selected filters including all raw/private retirement cases, exact reporting, manual-ready/cache/rendezvous factories, retained-base and repeated-restart controls. Compiler pins, matrix caps/eight comparisons/full96 product, final static sizes and final fast are still pending. No push/deploy/completion claim.

Source overlay Archive identity Source manifest Source11 delta Canceled10 receipt

Resumable R4 source checkpoint: HEAD939407e9fc8fd5633cc0edd0b96822f3173c509b remains unpublished. The72-file source11 overlay is attached (351660B, SHA25656fd3a0bcdf46e821c4d821f2504a938c3a8df394fdcd21e3c6010941c5a5274); reconstruct with git archive that base plus overlay and embedded manifest. It contains current structural retirement admission/reporting and all diagnosed fixture migrations, not a qualified final head. Source11 differs from10 only in the retained-base standalone fixture reader imports. Source10 was canceled before execution (empty log/no children). Full frozen9 remains running and has9 actual runner failures so far; they are diagnosed old-source guard/fixture cases, covered by current fixes. Its64 library tests and SSH all-target Clippy passed; 2 library diagnostics remain explicitly ignored. Source11 syntax/fmt pass (27 shell modules); new46 file role headers verified. Source11 critical gate queued: gate-recovery-v11.sh,21 selected filters including all raw/private retirement cases, exact reporting, manual-ready/cache/rendezvous factories, retained-base and repeated-restart controls. Compiler pins, matrix caps/eight comparisons/full96 product, final static sizes and final fast are still pending. No push/deploy/completion claim. [Source overlay](https://git.kayg.org/attachments/a8778acb-b1af-4ae5-ab96-393a45df9163) [Archive identity](https://git.kayg.org/attachments/402e2996-a7bc-4750-b459-f4d9076c82f2) [Source manifest](https://git.kayg.org/attachments/9ebcf1a4-dd19-45db-9194-2a01844c6ea4) [Source11 delta](https://git.kayg.org/attachments/d7aa5617-cc96-4f52-996e-0650e7881632) [Canceled10 receipt](https://git.kayg.org/attachments/f9ead83e-009a-4e90-8b58-18d0ac5ec5cc)

kayg commented

2026-10-20 00:26:16 +00:00

Author

Owner

Direct retirement reporting controls reproduced two gaps on the immutable v11 production module (private_retirement.sh SHA256 a7716f99f6ba345289a5f5749f6c00cb9a538b207f7296fd13f8f9803d320ffb). No source/assertion changes or build were made.

The actual low-level writer was stopped by killing only its own proven controller child after its real parent-directory sync, immediately after pending-directory creation and before any proof write. The fixed synthetic consumer inventory was the permanent fixture helper; whole-stage admission was not stubbed. The unchanged pending control recovered with status0. Independent edit, identical-byte inode recreation with original held, and a newly added newline-containing child each refused twice with status72 and retained UID/device/inode/mode/link-count/SHA exactly, but emitted only Left for the stage ancestor. The strict exact-child report witness is RED. A new owned rootless Podman container repeated those controls and added literal UID1002: the foreign-UID child also remained intact on both refusals and was never reported exactly. No host chown or host system-path mutation occurred.

A separate actual complete inventory publication then recreated the proof with identical bytes at the real second-find worker boundary. The first recovery refused72 and retained the recreated proof and all original stage entries, but emitted no Left diagnostic. The second attempt refused71 and the loader did report the proof exactly. This executed the worker private_read failure; the final private_bound-before-unlink silent exit is a source-review finding, not a separately executed control.

A digest-only pending intent cannot identify which descendant changed. A possible correct reporting-only response enumerates all current retained stage entries with an accurate whole-inventory authentication reason on existing stderr, without reading file contents, following symlinks, deleting, or granting any custody. The strict oracle must not accept arbitrary ancestor reports. Output size grows with pathname count and length; silently truncating unknown entries would not satisfy exact reporting. The worker can reuse one small local reporter for proof-read, proof-bound and identity failures without importing whole setup authority. Implementation and current-source Cargo/full Cartesian verification remain pending.

Direct retirement reporting controls reproduced two gaps on the immutable v11 production module (private_retirement.sh SHA256 a7716f99f6ba345289a5f5749f6c00cb9a538b207f7296fd13f8f9803d320ffb). No source/assertion changes or build were made. The actual low-level writer was stopped by killing only its own proven controller child after its real parent-directory sync, immediately after pending-directory creation and before any proof write. The fixed synthetic consumer inventory was the permanent fixture helper; whole-stage admission was not stubbed. The unchanged pending control recovered with status0. Independent edit, identical-byte inode recreation with original held, and a newly added newline-containing child each refused twice with status72 and retained UID/device/inode/mode/link-count/SHA exactly, but emitted only Left for the stage ancestor. The strict exact-child report witness is RED. A new owned rootless Podman container repeated those controls and added literal UID1002: the foreign-UID child also remained intact on both refusals and was never reported exactly. No host chown or host system-path mutation occurred. A separate actual complete inventory publication then recreated the proof with identical bytes at the real second-find worker boundary. The first recovery refused72 and retained the recreated proof and all original stage entries, but emitted no Left diagnostic. The second attempt refused71 and the loader did report the proof exactly. This executed the worker private_read failure; the final private_bound-before-unlink silent exit is a source-review finding, not a separately executed control. A digest-only pending intent cannot identify which descendant changed. A possible correct reporting-only response enumerates all current retained stage entries with an accurate whole-inventory authentication reason on existing stderr, without reading file contents, following symlinks, deleting, or granting any custody. The strict oracle must not accept arbitrary ancestor reports. Output size grows with pathname count and length; silently truncating unknown entries would not satisfy exact reporting. The worker can reuse one small local reporter for proof-read, proof-bound and identity failures without importing whole setup authority. Implementation and current-source Cargo/full Cartesian verification remain pending.

kayg commented

2026-10-20 00:30:01 +00:00

Author

Owner

The same direct retirement reporting controls are GREEN against a separate immutable five-file repair projection; original RED receipts remain retained. No build, shipping-source edit or oracle relaxation was made by this test slice.

Projection manifest SHA256 c1179cd1192bdff4ce8746b2e3cba79def99a5d1a18c58c4c43487f34e39b059 binds the four actual modules plus permanent consumer fixture. Repaired private_retirement.sh SHA256 is 9375c58fb45c673bc9a3498dfd79ddbc57df0a889786d268b959b1ac21655c39. All five file hashes and the original harness hashes were checked again after execution.

Host pending controls: four variants, seven recovery attempts. Newly owned rootless Podman controls: five variants, nine attempts, including literal UID1002. Unchanged pending recovery still succeeds0. Each edited, identical-byte recreated and newly added newline-containing child, plus the foreign-UID child, now remains exact in UID/device/inode/mode/link-count/SHA and receives an exact Left report on both refusals. No host chown or host system-path mutation occurred.

The worker proof-recreation control now reports the exact proof on BOTH attempts (72 then71), with the recreated proof retained. An independently strengthened replay checked every original stage entry’s UID/device/inode/mode/link-count/SHA: unchanged on both old-source RED and repaired-source GREEN controls. The old worker’s first attempt still reproduces silent refusal under those stronger checks.

Qualification remains limited to fixed small low-level synthetic consumer inventories, not whole manager transactions or every actual cut/path/phase. The final private_bound-before-unlink interposition was not separately executed. No bounded-stderr limit was changed, and these small fixtures do not establish a worst-case diagnostic bound. Current-source compilation, argument caps, generated full/filtered equivalence and the full Cartesian route products remain required.

The same direct retirement reporting controls are GREEN against a separate immutable five-file repair projection; original RED receipts remain retained. No build, shipping-source edit or oracle relaxation was made by this test slice. Projection manifest SHA256 c1179cd1192bdff4ce8746b2e3cba79def99a5d1a18c58c4c43487f34e39b059 binds the four actual modules plus permanent consumer fixture. Repaired private_retirement.sh SHA256 is 9375c58fb45c673bc9a3498dfd79ddbc57df0a889786d268b959b1ac21655c39. All five file hashes and the original harness hashes were checked again after execution. Host pending controls: four variants, seven recovery attempts. Newly owned rootless Podman controls: five variants, nine attempts, including literal UID1002. Unchanged pending recovery still succeeds0. Each edited, identical-byte recreated and newly added newline-containing child, plus the foreign-UID child, now remains exact in UID/device/inode/mode/link-count/SHA and receives an exact Left report on both refusals. No host chown or host system-path mutation occurred. The worker proof-recreation control now reports the exact proof on BOTH attempts (72 then71), with the recreated proof retained. An independently strengthened replay checked every original stage entry’s UID/device/inode/mode/link-count/SHA: unchanged on both old-source RED and repaired-source GREEN controls. The old worker’s first attempt still reproduces silent refusal under those stronger checks. Qualification remains limited to fixed small low-level synthetic consumer inventories, not whole manager transactions or every actual cut/path/phase. The final private_bound-before-unlink interposition was not separately executed. No bounded-stderr limit was changed, and these small fixtures do not establish a worst-case diagnostic bound. Current-source compilation, argument caps, generated full/filtered equivalence and the full Cartesian route products remain required.

kayg commented

2026-10-20 00:38:03 +00:00

Author

Owner

A new producer-backed direct control confirms a separate common-admission reporting gap before the next source freeze. No build or source change was made.

The immutable compiled9 helper supplied its actual SHARED and STAGE_TRANSACTION programs and created a genuine protected stage and immutable creator ledger (status0). The complete CURRENT private-phase validator plus 16 real dependency modules admitted the unchanged stage0. No phase helper, producer receipt or ledger was stubbed. The genuine kind record was independently changed in bytes, mode640, or symlink type. Every variant refused twice71 and retained the exact candidate UID/device/inode/mode/link count/hash or link target, while the original ledger stayed unchanged. None of the six attempts emitted any Left report on either channel. Restoring the original kind restored admission0. The shipping exact lease-retirement helper completed0 during cleanup. This uses an existing canonical record; no activation or invented zero flag was needed.

The proposed subshell reporting wrapper needs care with POSIX shell failure propagation. A second actual producer-backed diagnostic introduced an independent symlink at the public manifest path: normal current admission refused71, but the SAME validator called inside an if condition returned0 and reached a success marker. The candidate remained untouched, restoration admitted0, and the exact owned lease was retired0. This is a diagnostic of the proposed conditional call shape, not a claim that shipping callers currently make that conditional call. The nested manifest_public_validate subshell fails, but its bare invocation in validate_bound_stage is followed by successful checks when errexit is suppressed. An EXIT trap only sees the final status. Adding set-e or guarding only the top-level admission calls does not establish propagation through the whole nested admission closure.

A static caller audit found no documented required exports from the phase scratch globals: creator writers revalidate their own immutable chain, fresh proof derives authenticated rows itself, rollback/inspection rebuild their own original/plan bindings, and retained inspection reclassifies its own retained phase. Status-only isolation appears consistent with those inspected callsites, but positive retained/restart/inspection/rollback execution remains required after any change. All existing exact-path report and custody assertions remain strict. Foreign UID and actual activation-zero-flag cases were not executed in this admission-specific slice; complete generated routes remain pending.

A new producer-backed direct control confirms a separate common-admission reporting gap before the next source freeze. No build or source change was made. The immutable compiled9 helper supplied its actual SHARED and STAGE_TRANSACTION programs and created a genuine protected stage and immutable creator ledger (status0). The complete CURRENT private-phase validator plus 16 real dependency modules admitted the unchanged stage0. No phase helper, producer receipt or ledger was stubbed. The genuine kind record was independently changed in bytes, mode640, or symlink type. Every variant refused twice71 and retained the exact candidate UID/device/inode/mode/link count/hash or link target, while the original ledger stayed unchanged. None of the six attempts emitted any Left report on either channel. Restoring the original kind restored admission0. The shipping exact lease-retirement helper completed0 during cleanup. This uses an existing canonical record; no activation or invented zero flag was needed. The proposed subshell reporting wrapper needs care with POSIX shell failure propagation. A second actual producer-backed diagnostic introduced an independent symlink at the public manifest path: normal current admission refused71, but the SAME validator called inside an if condition returned0 and reached a success marker. The candidate remained untouched, restoration admitted0, and the exact owned lease was retired0. This is a diagnostic of the proposed conditional call shape, not a claim that shipping callers currently make that conditional call. The nested manifest_public_validate subshell fails, but its bare invocation in validate_bound_stage is followed by successful checks when errexit is suppressed. An EXIT trap only sees the final status. Adding set-e or guarding only the top-level admission calls does not establish propagation through the whole nested admission closure. A static caller audit found no documented required exports from the phase scratch globals: creator writers revalidate their own immutable chain, fresh proof derives authenticated rows itself, rollback/inspection rebuild their own original/plan bindings, and retained inspection reclassifies its own retained phase. Status-only isolation appears consistent with those inspected callsites, but positive retained/restart/inspection/rollback execution remains required after any change. All existing exact-path report and custody assertions remain strict. Foreign UID and actual activation-zero-flag cases were not executed in this admission-specific slice; complete generated routes remain pending.

kayg commented

2026-10-20 00:42:26 +00:00

Author

Owner

Admission reporting design is now in module docs and source: run the existing fatal admission body as a standalone subshell, with an EXIT reporter that preserves its exact status. This isolates the caller's lifecycle traps and keeps the original unconditionally invoked errexit model; no conditional wrapper was introduced. No phase globals are consumed outside admission (call-site audit recorded previously). A shared report-only traversal names retained private entries without following links or creating deletion authority; pending retirement uses the same reporter.

Actual pinned9 producer + current complete source dependencies: 6/6 changed kind refusals (bytes/mode/type, twice each) now report the exact candidate on stderr, preserve candidate identity/mode/hash and original ledger, and return71. Unchanged/restored admissions0; exact owned lease cleanup0. receipt.

This is a direct functional control, not a current Cargo/full-route qualification or performance result. The diagnostic conditional-call hazard remains outside the supported call shape; do not claim it was fixed by isolation. Permanent real-producer and caller-trap tests are being added before the next coherent compile.

private_phase SHA256 0fcd856f981b0c2ea079d67241814ded3bb665ce24ffa266c8c704ff35bb815e; creation_proof SHA256 69928af9029add9edbb7e3df8b117cf07620edff77a508e0555957a8a2b3619f.

Admission reporting design is now in module docs and source: run the existing fatal admission body as a standalone subshell, with an EXIT reporter that preserves its exact status. This isolates the caller's lifecycle traps and keeps the original unconditionally invoked errexit model; no conditional wrapper was introduced. No phase globals are consumed outside admission (call-site audit recorded previously). A shared report-only traversal names retained private entries without following links or creating deletion authority; pending retirement uses the same reporter. Actual pinned9 producer + current complete source dependencies: 6/6 changed kind refusals (bytes/mode/type, twice each) now report the exact candidate on stderr, preserve candidate identity/mode/hash and original ledger, and return71. Unchanged/restored admissions0; exact owned lease cleanup0. [receipt](https://git.kayg.org/attachments/daf841e5-4c76-428f-a953-9069e01d5dc5). This is a direct functional control, not a current Cargo/full-route qualification or performance result. The diagnostic conditional-call hazard remains outside the supported call shape; do not claim it was fixed by isolation. Permanent real-producer and caller-trap tests are being added before the next coherent compile. private_phase SHA256 0fcd856f981b0c2ea079d67241814ded3bb665ce24ffa266c8c704ff35bb815e; creation_proof SHA256 69928af9029add9edbb7e3df8b117cf07620edff77a508e0555957a8a2b3619f.

kayg commented

2026-10-20 00:45:48 +00:00

Author

Owner

The obsolete frozen recovery-v9 sweep was explicitly canceled after known failures, preserving its raw output. This is canceled-known-RED, not a full-suite pass. At final cancellation, the install target had started189/283 tests:155 passed,12 failed,21 ignored,1 interrupted,94 undispatched. The earlier assessment was187 started/96 undispatched; two additional tests started before the process tree was frozen. The preceding66 library tests are excluded from these install-only counts.

Cancellation verified the running ELF against the pinned immutable v9 artifact, then checked original PID/start-time and UID for each individually stopped/terminated descendant. No process-group or broad signals were used. The sole current fixture was reached from the test process's held directory descriptor, and its original lease PID/start-time/fd7 matched that exact private stage. The unchanged shipping lease reader retired it successfully and acquired its stage flock; the lease process is absent afterward. Fixture paths/data were retained. Queued independent diagnostic gates and other jobs were untouched. A first read-only descendant snapshot hit a /proc permission race after stopping only the exact root; the continuation used permission-tolerant metadata collection and is disclosed in the receipt.

The coherent current-source suite will run with the separately audited four-worker configuration. Remaining known failing/obsolete v9 fixtures are not waived by cancellation.

Evidence: exact identities, individual signals and lease cleanup, partial install-only summary, complete raw canceled log.

The obsolete frozen recovery-v9 sweep was explicitly canceled after known failures, preserving its raw output. This is **canceled-known-RED, not a full-suite pass**. At final cancellation, the install target had started189/283 tests:155 passed,12 failed,21 ignored,1 interrupted,94 undispatched. The earlier assessment was187 started/96 undispatched; two additional tests started before the process tree was frozen. The preceding66 library tests are excluded from these install-only counts. Cancellation verified the running ELF against the pinned immutable v9 artifact, then checked original PID/start-time and UID for each individually stopped/terminated descendant. No process-group or broad signals were used. The sole current fixture was reached from the test process's held directory descriptor, and its original lease PID/start-time/fd7 matched that exact private stage. The unchanged shipping lease reader retired it successfully and acquired its stage flock; the lease process is absent afterward. Fixture paths/data were retained. Queued independent diagnostic gates and other jobs were untouched. A first read-only descendant snapshot hit a `/proc` permission race after stopping only the exact root; the continuation used permission-tolerant metadata collection and is disclosed in the receipt. The coherent current-source suite will run with the separately audited four-worker configuration. Remaining known failing/obsolete v9 fixtures are not waived by cancellation. Evidence: [exact identities, individual signals and lease cleanup](https://git.kayg.org/attachments/b21ee2f9-9852-41b3-894f-2d4017fcc1ab), [partial install-only summary](https://git.kayg.org/attachments/3c98de38-b717-4be3-95eb-d64c406062d9), [complete raw canceled log](https://git.kayg.org/attachments/8b9adf48-eac6-4240-990a-6cd9693ddcb8).

kayg commented

2026-10-20 00:47:10 +00:00

Author

Owner

Added the permanent real-producer admission regression only in private_preflight_round4.rs: whole_stage_admission_reports_each_retained_kind_and_preserves_caller_traps. File SHA256 1b9a41b1d50d9e0af592d6f0241cfb2d3ba8d427db96aa0cb18133e5237e1465. All preexisting tests in that module remain byte-identical to frozen11.

The test uses actual Fixture.stage and obtains the complete compiled SHARED program through common::program_helper. It reuses Local environment/path mapping and sends public source on stdin. Genuine kind bytes/mode/type are each changed independently and refused twice with exact stderr Left, empty stdout, and unchanged UID/device/inode/mode/link-count/body images for both candidate and original creator ledger. It restores the original and requires admission0 after every variant. Its caller-trap control requires the outer EXIT sentinel on success0 and nested public-manifest refusal71 twice, no continuation after failure, and the private-root retention report; it does not invent a requirement for public-manifest reporting.

Independent frozen12 review confirms the original validator check body is byte-identical after removing the single new local EXIT-trap line. The body runs unconditionally in its own subshell, preserving the existing normal errexit call shape and keeping the caller lifecycle trap outside. Audited consumers rederive their own creator/rollback/retained bindings; no required phase-global export was found. This is source audit, not all-route execution proof. The synthetic conditional-context RED remains explicitly unsupported and is not claimed fixed. The new subshell cost still needs actual VM route measurement.

Rebound all held orchestration to immutable source12 (manifest dfb65f6af891352b2fea8122e9c504ef4985608a37418f2da2754883bb44df20), independently verified 72 manifest paths and 1883 full-projection files. Exactly five files differ from frozen11: the three shared production reporting/admission modules and two test modules. Pin preparation requires artifact-bound critical GREEN including the new selector; unchanged caps precede any eight observer comparisons. No build, fixture test, compiler pin or matrix comparison was launched by this slice. Rustfmt/source syntax checks passed only; current-source compilation, critical execution, counts and full products remain pending.

Added the permanent real-producer admission regression only in private_preflight_round4.rs: whole_stage_admission_reports_each_retained_kind_and_preserves_caller_traps. File SHA256 1b9a41b1d50d9e0af592d6f0241cfb2d3ba8d427db96aa0cb18133e5237e1465. All preexisting tests in that module remain byte-identical to frozen11. The test uses actual Fixture.stage and obtains the complete compiled SHARED program through common::program_helper. It reuses Local environment/path mapping and sends public source on stdin. Genuine kind bytes/mode/type are each changed independently and refused twice with exact stderr Left, empty stdout, and unchanged UID/device/inode/mode/link-count/body images for both candidate and original creator ledger. It restores the original and requires admission0 after every variant. Its caller-trap control requires the outer EXIT sentinel on success0 and nested public-manifest refusal71 twice, no continuation after failure, and the private-root retention report; it does not invent a requirement for public-manifest reporting. Independent frozen12 review confirms the original validator check body is byte-identical after removing the single new local EXIT-trap line. The body runs unconditionally in its own subshell, preserving the existing normal errexit call shape and keeping the caller lifecycle trap outside. Audited consumers rederive their own creator/rollback/retained bindings; no required phase-global export was found. This is source audit, not all-route execution proof. The synthetic conditional-context RED remains explicitly unsupported and is not claimed fixed. The new subshell cost still needs actual VM route measurement. Rebound all held orchestration to immutable source12 (manifest dfb65f6af891352b2fea8122e9c504ef4985608a37418f2da2754883bb44df20), independently verified 72 manifest paths and 1883 full-projection files. Exactly five files differ from frozen11: the three shared production reporting/admission modules and two test modules. Pin preparation requires artifact-bound critical GREEN including the new selector; unchanged caps precede any eight observer comparisons. No build, fixture test, compiler pin or matrix comparison was launched by this slice. Rustfmt/source syntax checks passed only; current-source compilation, critical execution, counts and full products remain pending.

kayg commented

2026-10-20 00:53:07 +00:00

Author

Owner

The frozen env-only9 focused regression compiled with its minimal environment correction, then failed97 during discovery activation. The selected empty-lease cut and rollback assertions were never reached. This result remains RED; it is not a source12 result.

Retained observer metadata identifies the exact origin: RuntimeError from the unchanged configured 55-second observer alarm, mapped by the Python observer to exit97. The failing command was already using the filtered scheduler. It recorded 68,149 entry stops, 68,147 exit stops, 26,366 process roles and 213 mutation/durability cuts before refusal; last global ordinal376 follows creator-head rename375 and the stage fsync for the rendezvous-dir successor. The next pending cleanup mutation had not occurred. The exact generated control flow places subsequent reader validation there; this location is an inference from the last completed boundary, not a per-function profiler result.

Outstanding actors were the main shell and an active execve descendant, neither with fd7. Their retained executable identities map to sh/dash and stat respectively (one deadline sample only). Proven detached leases were already excluded from the traced actor set; all three recorded lease PIDs were verified gone after fixture teardown. No processes were signaled by this read-only investigation. The observer source hash c155e52f263e64ba43abf34474231ad2e40e9c66cc97ad44d14b249bd4f6c331 is identical in the env-only9 and frozen12 source contexts.

Process roles are not exec counts: the counter increments for the root and traced fork/vfork/clone children, not exec. Existing logs contain only fixture-scoped exec records. Across four commands they show tools/awk3172, awk-wire4, payload4, runtime-helper4 and systemctl3. A strict lower bound assigned to the failing command after prior ordinal163 is 2641 AWK executions in2641 distinct roles, plus one each of systemctl/payload/runtime-helper. Twenty-nine scoped AWK execs occur after the final head rename. System cut/stat/SHA/etc executions and function identifiers were never retained, so their histogram and the counts/fraction attributable to cl_validate versus cl_binding_valid cannot be recovered. Nine creator successor roles are visible; these do not count repeated reader calls.

These are host functional guard receipts and metadata counts, not VM benchmark or runtime-projection evidence. No rerun, source change, guard extension or proof-cache change was made. Current-source critical compilation and the complete matched VM observer/case pilots remain required before any performance conclusion or full matrix claim.

The frozen env-only9 focused regression compiled with its minimal environment correction, then failed97 during discovery activation. The selected empty-lease cut and rollback assertions were never reached. This result remains RED; it is not a source12 result. Retained observer metadata identifies the exact origin: RuntimeError from the unchanged configured 55-second observer alarm, mapped by the Python observer to exit97. The failing command was already using the filtered scheduler. It recorded 68,149 entry stops, 68,147 exit stops, 26,366 process roles and 213 mutation/durability cuts before refusal; last global ordinal376 follows creator-head rename375 and the stage fsync for the rendezvous-dir successor. The next pending cleanup mutation had not occurred. The exact generated control flow places subsequent reader validation there; this location is an inference from the last completed boundary, not a per-function profiler result. Outstanding actors were the main shell and an active execve descendant, neither with fd7. Their retained executable identities map to sh/dash and stat respectively (one deadline sample only). Proven detached leases were already excluded from the traced actor set; all three recorded lease PIDs were verified gone after fixture teardown. No processes were signaled by this read-only investigation. The observer source hash c155e52f263e64ba43abf34474231ad2e40e9c66cc97ad44d14b249bd4f6c331 is identical in the env-only9 and frozen12 source contexts. Process roles are not exec counts: the counter increments for the root and traced fork/vfork/clone children, not exec. Existing logs contain only fixture-scoped exec records. Across four commands they show tools/awk3172, awk-wire4, payload4, runtime-helper4 and systemctl3. A strict lower bound assigned to the failing command after prior ordinal163 is 2641 AWK executions in2641 distinct roles, plus one each of systemctl/payload/runtime-helper. Twenty-nine scoped AWK execs occur after the final head rename. System cut/stat/SHA/etc executions and function identifiers were never retained, so their histogram and the counts/fraction attributable to cl_validate versus cl_binding_valid cannot be recovered. Nine creator successor roles are visible; these do not count repeated reader calls. These are host functional guard receipts and metadata counts, not VM benchmark or runtime-projection evidence. No rerun, source change, guard extension or proof-cache change was made. Current-source critical compilation and the complete matched VM observer/case pilots remain required before any performance conclusion or full matrix claim.

kayg commented

2026-10-20 00:55:55 +00:00

Author

Owner

The first frozen v9 diagnostic projection did not run tests: its added fixed-category fixture observation crossed the existing100-line Clippy limit. That failed source/log remain unchanged. A separate immutable v2 adds only a documented, diagnostic-local allowance; production is byte-identical to v9, transport execution/receipts/assertions are unchanged, and the original60s process deadline remains.

Both exact test filters then executed from one compiler-pinned v2 artifact SHA256 167fd52e68acc53abbaed835951daf52f5e7933dd5f4107cf418ffa9992ca6e8:

full_payload_restaging_preserves_the_running_session_build: GREEN, all original bridge/payload/commit assertions retained; fixed observation saw upload/join/install/start/linger. No arbitrary process messages/private input are logged. This one replay does not erase the prior frozen9 timeout or establish a performance budget.
late_publication_round4::upgrade_rollback_keeps_private_data_created_during_manager_reload: expected actual old-source RED; rollback returns Ok and deletes the independent private file (refused=false kept=false). The wrapper accumulates failures and confirms BOTH filters executed, exit1. The parent owns the current-source admission fix and its separate qualification.

These are diagnostic functional results, not build-host performance acceptance or a full-suite pass.

Evidence: original Clippy failure, both exact filter results, immutable v2 source identity/delta.

The first frozen v9 diagnostic projection did not run tests: its added fixed-category fixture observation crossed the existing100-line Clippy limit. That failed source/log remain unchanged. A separate immutable v2 adds only a documented, diagnostic-local allowance; production is byte-identical to v9, transport execution/receipts/assertions are unchanged, and the original60s process deadline remains. Both exact test filters then executed from one compiler-pinned v2 artifact SHA256 `167fd52e68acc53abbaed835951daf52f5e7933dd5f4107cf418ffa9992ca6e8`: - `full_payload_restaging_preserves_the_running_session_build`: GREEN, all original bridge/payload/commit assertions retained; fixed observation saw upload/join/install/start/linger. No arbitrary process messages/private input are logged. This one replay does not erase the prior frozen9 timeout or establish a performance budget. - `late_publication_round4::upgrade_rollback_keeps_private_data_created_during_manager_reload`: expected actual old-source RED; rollback returns Ok and deletes the independent private file (`refused=false kept=false`). The wrapper accumulates failures and confirms BOTH filters executed, exit1. The parent owns the current-source admission fix and its separate qualification. These are diagnostic functional results, not build-host performance acceptance or a full-suite pass. Evidence: [original Clippy failure](https://git.kayg.org/attachments/9b98e7ec-4f5b-4ffa-8ed0-ccf3626e1187), [both exact filter results](https://git.kayg.org/attachments/fc1d8213-c54a-431a-b8e8-4f4d33162780), [immutable v2 source identity/delta](https://git.kayg.org/attachments/21bb2b66-fb80-49a6-adce-78cd56a740bc).

kayg commented

2026-10-20 01:02:21 +00:00

Author

Owner

Prepared current13 VM owned-container staging plan only; no VM connection, ELF patch, container, build or measurement was executed. Source manifest SHA256 08fa1ba5f8ab4d81ac56b40ddc6b7723aa6e0e5c2e990cc66075175f1aef0c7e; compiler-pinned install 5ef30252b469c665d367fba2a381a04d8179181793a217c50f8121168adf5279, helper 7ac6ac684583390b6003d42e628a5d0c517e42d8609ced9086249321ec59b505.

The plan preserves originals and records future patched-copy/ELF-provider hashes separately. A fixture-copied helper requires absolute interpreter AND library search path /opt/readd/lib; a relative search path beside the executable fails after the fixture relocates it. Both observer variants must use identical native helper bytes and complete ordered-cut/tree equivalence across all eight baseline flows. Current optimized private_write remains fixed in any future grammar-only comparison; no cache was adopted.

Qualification remains explicit: ordinary UID1001 execution is planned, but the existing foreign-UID mutation harness requires a UID0 controller. It does not establish creator1001→foreign1002 coverage. Patched SHA/provider closure, all-eight comparison, actual96-partition inventory/product, and VM timings remain unexecuted. Critical current13 controls must finish GREEN before any execution release.

Preparation receipt

Prepared current13 VM owned-container staging plan only; no VM connection, ELF patch, container, build or measurement was executed. Source manifest SHA256 `08fa1ba5f8ab4d81ac56b40ddc6b7723aa6e0e5c2e990cc66075175f1aef0c7e`; compiler-pinned install `5ef30252b469c665d367fba2a381a04d8179181793a217c50f8121168adf5279`, helper `7ac6ac684583390b6003d42e628a5d0c517e42d8609ced9086249321ec59b505`. The plan preserves originals and records future patched-copy/ELF-provider hashes separately. A fixture-copied helper requires absolute interpreter AND library search path `/opt/readd/lib`; a relative search path beside the executable fails after the fixture relocates it. Both observer variants must use identical native helper bytes and complete ordered-cut/tree equivalence across all eight baseline flows. Current optimized private_write remains fixed in any future grammar-only comparison; no cache was adopted. Qualification remains explicit: ordinary UID1001 execution is planned, but the existing foreign-UID mutation harness requires a UID0 controller. It does not establish creator1001→foreign1002 coverage. Patched SHA/provider closure, all-eight comparison, actual96-partition inventory/product, and VM timings remain unexecuted. Critical current13 controls must finish GREEN before any execution release. [Preparation receipt](https://git.kayg.org/attachments/1ae87745-e2ae-493e-967b-e10a55d43488)

kayg commented

2026-10-20 01:09:47 +00:00

Author

Owner

Producer-backed current13 regression diagnosis: private_retirement_round4::commit_resumes_after_active_transaction_files_begin_retiring fails on its THIRD commit, after the second commit successfully resumes retirement and the original stage-absence assertion passes. It is not a failure to resume the active retirement.

The pinned13 exact test trace shows: first commit reaches the original real activating-unlink interruption; second commit validates the immutable retirement proof, finishes all individual removals, and exits0; third commit validates the active manifest's exact binding/creator alias, then asks rollback_match_one to read $base/.bootstrap-manifest. The captured receipt selector has no public-active role, returns1, and completed idempotent commit returns71. Existing line523 assertion is correct and remains unchanged.

Recommendation to the parent implementation owner: capture the already creator-bound active receipt through the existing authenticated private_read and pass those captured rows through the existing inline row reader. Do not restore a generic raw-path fallback. No production or assertion changes were made in this diagnosis; a current-source fix/qualification remains pending.

Separate correction: an initial chat diagnosis of two other private-retirement failures as stdout/stderr fixture adapters was wrong. Their existing stderr assertions correctly expose exact retained-path mismatches; those assertions must remain exact. The parent is addressing reporting at the shared control fence.

Evidence: phase/cause and pinned-source identity, final selector trace, original exact test failure. Diagnostic host execution duration is not performance acceptance.

Producer-backed current13 regression diagnosis: `private_retirement_round4::commit_resumes_after_active_transaction_files_begin_retiring` fails on its THIRD commit, after the second commit successfully resumes retirement and the original stage-absence assertion passes. It is not a failure to resume the active retirement. The pinned13 exact test trace shows: first commit reaches the original real activating-unlink interruption; second commit validates the immutable retirement proof, finishes all individual removals, and exits0; third commit validates the active manifest's exact binding/creator alias, then asks `rollback_match_one` to read `$base/.bootstrap-manifest`. The captured receipt selector has no public-active role, returns1, and completed idempotent commit returns71. Existing line523 assertion is correct and remains unchanged. Recommendation to the parent implementation owner: capture the already creator-bound active receipt through the existing authenticated `private_read` and pass those captured rows through the existing inline row reader. Do not restore a generic raw-path fallback. No production or assertion changes were made in this diagnosis; a current-source fix/qualification remains pending. Separate correction: an initial chat diagnosis of two other private-retirement failures as stdout/stderr fixture adapters was wrong. Their existing stderr assertions correctly expose exact retained-path mismatches; those assertions must remain exact. The parent is addressing reporting at the shared control fence. Evidence: [phase/cause and pinned-source identity](https://git.kayg.org/attachments/afca6f66-6fae-47d6-a25a-c39fcd940d5c), [final selector trace](https://git.kayg.org/attachments/4d6d0e6b-daf6-4c0e-8b0a-e04fa1c2d3c0), [original exact test failure](https://git.kayg.org/attachments/2fb5b95d-0600-4f25-9a65-72434984213b). Diagnostic host execution duration is not performance acceptance.

kayg commented

2026-10-20 01:25:00 +00:00

Author

Owner

Additive literal-writer test slice prepared; production unchanged by this slice. Shared pipe client now serves remote ownership tests and SSH fixtures, using the existing owned-container helper/protocol. ForeignEdit/ForeignRecreate preserve the original UID1001 inode and use a real UID1002 writer (DAC_OVERRIDE only). The controller retains capabilities0x3 for observation/restoration; production fixture child exec drops effective/permitted/inheritable/ambient capabilities and sets NoNewPrivs1. CapBnd remains0x3, explicitly distinguished from effective privileges. Root UID0 cases stay separately labeled.

Direct owned-container helper control: old helper rejects the exact install fixture family (RED); updated helper passes file same-inode edits, recursive same-content directory recreation without following symlinks, link/socket recreations and distinct namespace edits, newline paths, and five malformed/out-of-scope request controls. Original/foreign actors were reaped; all owned containers removed. No host fixture chown. The existing remote helper smoke still passes.

Receipts/accounting now require five additive variants: edit, recreate, owner change, foreign edit, foreign recreate. Required total is 2*K*C*P+3*C, K=5. Synthetic96 accounting accepts that arithmetic and rejects old three-variant receipts; these are synthetic controls, not actual discovery. New foreign cases require every actually changed descendant's exact fresh Left report. Existing three-variant assertions remain. Selected rustfmt and diff checks pass; Python helper/launcher compile checks pass. Rust integration has NOT been Cargo-qualified; parent source14 gate will compile/replay it.

Separate source13 VM staging-only control passes with immutable original install SHA5ef30252…f5279, original helper7ac6ac68…9b505 and patched helperf62d4f53…27cbb. Exact glibc2.44/library providers verified. Helper executes directly from its original staged location and after private relocation; actual relocated anonymous identity writer succeeds under UID1001 on container overlayfs with mode600/nlink1. The install executable lists tests via the explicit loader. First extra identity probe used a data path beside stage and correctly failed71; the retained v2 control uses shipping-required stage/state. No timing, observer workload, all-eight equivalence or full Cartesian execution occurred. Source13 critical observer/workflow failures remain separate unresolved evidence.

Source/artifact hashes
Original helper RED
Updated helper GREEN
Synthetic five-variant accounting
VM staging functional control

Additive literal-writer test slice prepared; production unchanged by this slice. Shared pipe client now serves remote ownership tests and SSH fixtures, using the existing owned-container helper/protocol. ForeignEdit/ForeignRecreate preserve the original UID1001 inode and use a real UID1002 writer (DAC_OVERRIDE only). The controller retains capabilities0x3 for observation/restoration; production fixture child exec drops effective/permitted/inheritable/ambient capabilities and sets NoNewPrivs1. CapBnd remains0x3, explicitly distinguished from effective privileges. Root UID0 cases stay separately labeled. Direct owned-container helper control: old helper rejects the exact install fixture family (RED); updated helper passes file same-inode edits, recursive same-content directory recreation without following symlinks, link/socket recreations and distinct namespace edits, newline paths, and five malformed/out-of-scope request controls. Original/foreign actors were reaped; all owned containers removed. No host fixture chown. The existing remote helper smoke still passes. Receipts/accounting now require five additive variants: edit, recreate, owner change, foreign edit, foreign recreate. Required total is `2*K*C*P+3*C`, K=5. Synthetic96 accounting accepts that arithmetic and rejects old three-variant receipts; these are synthetic controls, not actual discovery. New foreign cases require every actually changed descendant's exact fresh Left report. Existing three-variant assertions remain. Selected rustfmt and diff checks pass; Python helper/launcher compile checks pass. Rust integration has NOT been Cargo-qualified; parent source14 gate will compile/replay it. Separate source13 VM staging-only control passes with immutable original install SHA5ef30252…f5279, original helper7ac6ac68…9b505 and patched helperf62d4f53…27cbb. Exact glibc2.44/library providers verified. Helper executes directly from its original staged location and after private relocation; actual relocated anonymous identity writer succeeds under UID1001 on container overlayfs with mode600/nlink1. The install executable lists tests via the explicit loader. First extra identity probe used a data path beside stage and correctly failed71; the retained v2 control uses shipping-required stage/state. No timing, observer workload, all-eight equivalence or full Cartesian execution occurred. Source13 critical observer/workflow failures remain separate unresolved evidence. [Source/artifact hashes](https://git.kayg.org/attachments/2a2188c5-e2cd-4d2c-9f58-0c2739beba0c) [Original helper RED](https://git.kayg.org/attachments/85a16438-2a09-47cb-ac9c-5b2200ab6f0d) [Updated helper GREEN](https://git.kayg.org/attachments/4ca95098-2f7b-44c4-9f08-77e2ff52ba89) [Synthetic five-variant accounting](https://git.kayg.org/attachments/eb8a951a-8110-4e55-bd9a-97587e7f7d86) [VM staging functional control](https://git.kayg.org/attachments/5e91e0e7-9344-4949-86fc-ae5bb2e57970)

kayg commented

2026-10-20 01:29:54 +00:00

Author

Owner

Bounded independent read-only review of recovery-v14-source (HEAD ancestry 497e03657). Root-supplied 72-path freeze manifest SHA256: 3bfa85b8006a34845d853144ea51eed3151a08a581b40a97ba48d61411809727. Verified file SHA256 values:

private_retirement.sh da60e8b5d7479a3fe3bfde9e75ae51947fdc39b30fe5e9b098989e6d2a9d6ebd
fresh_cleanup.sh ef6dac493b7b7bc7732cfadae4009db2c0ff1ba463676f853b72f25f2968ae67
creator_ledger.sh 4f946d7ba2052622fb03a4b6cf5602ed6365fb9488020dfc285beedb94b1d9ee
install.rs f74d6b574aca9e33ce7e250f65f2e9331799721ee4f610bead8136ef96f34144

P1, source-only counterexample: private_retirement.sh:68 reconstructs the expected pending pathname, but leaves retire_pending empty if absent at admission. Recreate that exact empty directory afterward: retire_intent returns immediately and subsequent parent/child controls cannot detect or report it. This reviewer ran no mutating fixture; the root job assigned a focused regression and fix.

Source-only fresh-state follow-up: fresh_cleanup.sh:89 supplies empty pending/base control coordinates to retire_worker. Original base rows are checked in the ancestor walk, but the final pre-unlink control predicate checks only the outside proof. Replacement during that last proof check needs a focused control; no end-to-end failure is claimed. Assigned to the root job's boundary worker.

P2, pre-existing grammar behavior: two canonical binding strings separated by a newline return success in both v13 and v14 cl_binding_valid (pure-shell checks: status 0). V14's bounded shell-local cache intentionally preserves v13's rowwise grammar for the matched comparison; this is not introduced by the cache. Later file predicates still run. Canonical single-record tightening belongs to a separately tested logical fix after that comparison.

No additional finding in install.rs:1760-1767's completed no-stage inline reader: its rows come from the checked captured body and it exits without restoring a generic current-path reader. Supplied current-green-v2 evidence covers 8/8 direct controls with exact diagnostics and unchanged stage/control objects; this is not whole-matrix evidence.

D243: the brief requires comparison against the branch merge base, not a new allowance over the round-4 starting SHA. Reported unadopted native8 candidate: +62,112 B versus 58760f49d, +102,016 B versus dev merge base c00c6364. Historical round-3 growth is already included in PROCESS section 7's exact ceilings and supplies no credit. The cumulative result exceeds the 64 KB band; no implicit exception or size compliance is claimed. Further reduction is required.

No production edits, builds, remote sessions or final completion claim from this review. Remaining controls and full gates stay with the root job; issues remain open.

Bounded independent read-only review of recovery-v14-source (HEAD ancestry 497e03657). Root-supplied 72-path freeze manifest SHA256: `3bfa85b8006a34845d853144ea51eed3151a08a581b40a97ba48d61411809727`. Verified file SHA256 values: ```text private_retirement.sh da60e8b5d7479a3fe3bfde9e75ae51947fdc39b30fe5e9b098989e6d2a9d6ebd fresh_cleanup.sh ef6dac493b7b7bc7732cfadae4009db2c0ff1ba463676f853b72f25f2968ae67 creator_ledger.sh 4f946d7ba2052622fb03a4b6cf5602ed6365fb9488020dfc285beedb94b1d9ee install.rs f74d6b574aca9e33ce7e250f65f2e9331799721ee4f610bead8136ef96f34144 ``` P1, source-only counterexample: private_retirement.sh:68 reconstructs the expected pending pathname, but leaves retire_pending empty if absent at admission. Recreate that exact empty directory afterward: retire_intent returns immediately and subsequent parent/child controls cannot detect or report it. This reviewer ran no mutating fixture; the root job assigned a focused regression and fix. Source-only fresh-state follow-up: fresh_cleanup.sh:89 supplies empty pending/base control coordinates to retire_worker. Original base rows are checked in the ancestor walk, but the final pre-unlink control predicate checks only the outside proof. Replacement during that last proof check needs a focused control; no end-to-end failure is claimed. Assigned to the root job's boundary worker. P2, pre-existing grammar behavior: two canonical binding strings separated by a newline return success in both v13 and v14 cl_binding_valid (pure-shell checks: status 0). V14's bounded shell-local cache intentionally preserves v13's rowwise grammar for the matched comparison; this is not introduced by the cache. Later file predicates still run. Canonical single-record tightening belongs to a separately tested logical fix after that comparison. No additional finding in install.rs:1760-1767's completed no-stage inline reader: its rows come from the checked captured body and it exits without restoring a generic current-path reader. Supplied current-green-v2 evidence covers 8/8 direct controls with exact diagnostics and unchanged stage/control objects; this is not whole-matrix evidence. D243: the brief requires comparison against the branch merge base, not a new allowance over the round-4 starting SHA. Reported unadopted native8 candidate: +62,112 B versus 58760f49d, +102,016 B versus dev merge base c00c6364. Historical round-3 growth is already included in PROCESS section 7's exact ceilings and supplies no credit. The cumulative result exceeds the 64 KB band; no implicit exception or size compliance is claimed. Further reduction is required. No production edits, builds, remote sessions or final completion claim from this review. Remaining controls and full gates stay with the root job; issues remain open.

kayg commented

2026-10-20 01:32:55 +00:00

Author

Owner

Round4 checkpoint; incomplete, no push/deploy. Head497e036577b94d2960176f01155eee415cfdbc84. Source13 critical artifact5ef30252b469c665d367fba2a381a04d8179181793a217c50f8121168adf5279:42/48 pass,6 fail; full raw failure logs attached below. Three are observer/workflow deadlines, three are retirement exact-path/completed-third-commit failures. Assertions/deadlines unchanged. Current immutable14c includes shared base/pending/proof checks before each worker mutation, a captured-inline completed-state reader, stronger stage-identity regressions, additive literal1001→1002 controls and bounded pure-grammar memoization. Direct original13 vs current shared controls: old5/8 exact reports and6/8 unchanged stages; current8/8 exact reports, unchanged stages and independent controls. These are narrow controls, not the full matrix. Independent review subsequently found proof-only missing-pending-coordinate gap; failing real retirement regression now reproduced; subsequent fix excluded from14c.

Resumable72-path source overlay361,509B SHA2569b25a08eba6b67d651a7b99c9b929671c356f42aa0b303521594f93b4f72a88e; manifestd8773eec4d75ad2109d3ff0fb638ed7e9fc46f772576492e0273c26c8ff9a183. Reconstruct git archive497e036577b94d2960176f01155eee415cfdbc84 plus overlay. Earlier checkpoint SHAs remain mapped by tree-preserving unpublished-message repair: full map.38/38 commit bodies now end Refs231/235; every rewritten commit tree identical. Latest3 module commits ad707e0 (compaction invariant), d7eca624 (rollback identity),497e036 (rollback proof) each passed exact-projection fmt/shell syntax/Clippy and11 pinned raw-authority regressions, as recorded in their step comments.

14/14b stopped before artifact pins on3 equivalent test-only lint issues; corrected without changing assertion meaning.14c SSH all-target Clippy passes; remote gate first lacked its existing test-support and tokio/rt-multi-thread test closure, now rerunning with that closure. Matched cache control differs only creator_ledger.sh; compiler pins and whole-flow VM A/B pending. No current full8/full96 Cartesian qualification, final static size or final fast gate claimed.

recovery-v14c-source-overlay.tar.gz
recovery-v14c-checkpoint.json
recovery-v14c-source.json
recovery-v13-critical-results.json
private-control-fence-v13-red.json
private-control-fence-current-green-v2.json
recovery-v13-activation_boundaries-generated_empty_lease_requires_exact_kernel_lock_retirement.log
recovery-v13-earlier_binary_cache_is_refreshed_before_owned_recovery.log
recovery-v13-negotiated_transfer_delivers_the_invitation_after_a_buffering_head.log
recovery-v13-private_retirement_round4-commit_resumes_after_active_transaction_files_begin_retiring.log
recovery-v13-private_retirement_round4-late_pending_recreation_is_kept_at_each_control_retirement_step.log
recovery-v13-private_retirement_round4-retirement_proof_is_rechecked_after_the_initial_inventory.log

Pure-grammar memoization experiment, current private_write bytes identical between variants; no filesystem decisions cached. Perf VM4CPU/CPUWeight10000, actual immutable writer-created ledgers,40 concurrent readers ×4 samples/variant:8-hop control/candidate medians2.285498/2.059122s, CPU8.833575/7.971554s;64-hop15.484816/14.255225s, CPU60.574813/55.452651s. Balanced adjacent wall ratios0.899198/0.914618. Individual9-sample emit medians206.906/190.550ms and1388.069/1305.933ms.651 grammar samples+176 warmed keys pass reference equivalence; edited/recreated filesystem objects still refuse. Cache bound8192B/process (conditional40shells327680B retained syntax storage, excluding shell/allocator overhead). wait4 maxima are largest-descendant maxima, NOT whole-tree RSS/PSS or aggregate bounds. Reader benefit alone does not establish whole setup/observer acceptance. Existing rowwise newline grammar defect predates cache, tracked separately by review.

measured summary, functional corpus, 8-hop raw JSON, 8-hop raw log, 64-hop raw JSON, 64-hop raw log.

Round4 checkpoint; incomplete, no push/deploy. Head497e036577b94d2960176f01155eee415cfdbc84. Source13 critical artifact5ef30252b469c665d367fba2a381a04d8179181793a217c50f8121168adf5279:42/48 pass,6 fail; full raw failure logs attached below. Three are observer/workflow deadlines, three are retirement exact-path/completed-third-commit failures. Assertions/deadlines unchanged. Current immutable14c includes shared base/pending/proof checks before each worker mutation, a captured-inline completed-state reader, stronger stage-identity regressions, additive literal1001→1002 controls and bounded pure-grammar memoization. Direct original13 vs current shared controls: old5/8 exact reports and6/8 unchanged stages; current8/8 exact reports, unchanged stages and independent controls. These are narrow controls, not the full matrix. Independent review subsequently found proof-only missing-pending-coordinate gap; failing real retirement regression now reproduced; subsequent fix excluded from14c. Resumable72-path source overlay361,509B SHA2569b25a08eba6b67d651a7b99c9b929671c356f42aa0b303521594f93b4f72a88e; manifestd8773eec4d75ad2109d3ff0fb638ed7e9fc46f772576492e0273c26c8ff9a183. Reconstruct git archive497e036577b94d2960176f01155eee415cfdbc84 plus overlay. Earlier checkpoint SHAs remain mapped by tree-preserving unpublished-message repair: [full map](https://git.kayg.org/attachments/b32d712f-e27f-45ed-b68b-750435697b35).38/38 commit bodies now end Refs231/235; every rewritten commit tree identical. Latest3 module commits ad707e0 (compaction invariant), d7eca624 (rollback identity),497e036 (rollback proof) each passed exact-projection fmt/shell syntax/Clippy and11 pinned raw-authority regressions, as recorded in their step comments. 14/14b stopped before artifact pins on3 equivalent test-only lint issues; corrected without changing assertion meaning.14c SSH all-target Clippy passes; remote gate first lacked its existing test-support and tokio/rt-multi-thread test closure, now rerunning with that closure. Matched cache control differs only creator_ledger.sh; compiler pins and whole-flow VM A/B pending. No current full8/full96 Cartesian qualification, final static size or final fast gate claimed. [recovery-v14c-source-overlay.tar.gz](https://git.kayg.org/attachments/9748a44e-bd03-4aab-bc40-46c53ba1fcbf) [recovery-v14c-checkpoint.json](https://git.kayg.org/attachments/4c1c6144-35f3-4270-8434-0878bad46efd) [recovery-v14c-source.json](https://git.kayg.org/attachments/dafff49c-d986-4fce-8857-fb9af3c3becd) [recovery-v13-critical-results.json](https://git.kayg.org/attachments/702303fd-9de3-4686-8e16-44e5bfda598e) [private-control-fence-v13-red.json](https://git.kayg.org/attachments/1efec796-6d51-4bb1-8536-66639780d4a5) [private-control-fence-current-green-v2.json](https://git.kayg.org/attachments/d556f2c9-8e20-4630-8e43-d01a3608b8bb) [recovery-v13-activation_boundaries-generated_empty_lease_requires_exact_kernel_lock_retirement.log](https://git.kayg.org/attachments/1db3b364-186d-4dac-9501-31f87d702140) [recovery-v13-earlier_binary_cache_is_refreshed_before_owned_recovery.log](https://git.kayg.org/attachments/902069f0-e720-4e1d-b55f-ba3d7bb63668) [recovery-v13-negotiated_transfer_delivers_the_invitation_after_a_buffering_head.log](https://git.kayg.org/attachments/bc40602f-7bc2-4ca0-aba2-b7df3aca7199) [recovery-v13-private_retirement_round4-commit_resumes_after_active_transaction_files_begin_retiring.log](https://git.kayg.org/attachments/e8273657-2752-49a6-addd-482bf1100606) [recovery-v13-private_retirement_round4-late_pending_recreation_is_kept_at_each_control_retirement_step.log](https://git.kayg.org/attachments/533b6cc4-b8f2-4ba4-bd2b-a520ee39941a) [recovery-v13-private_retirement_round4-retirement_proof_is_rechecked_after_the_initial_inventory.log](https://git.kayg.org/attachments/82e483de-446f-4bb9-8112-9fcc496c2953) Pure-grammar memoization experiment, current private_write bytes identical between variants; no filesystem decisions cached. Perf VM4CPU/CPUWeight10000, actual immutable writer-created ledgers,40 concurrent readers ×4 samples/variant:8-hop control/candidate medians2.285498/2.059122s, CPU8.833575/7.971554s;64-hop15.484816/14.255225s, CPU60.574813/55.452651s. Balanced adjacent wall ratios0.899198/0.914618. Individual9-sample emit medians206.906/190.550ms and1388.069/1305.933ms.651 grammar samples+176 warmed keys pass reference equivalence; edited/recreated filesystem objects still refuse. Cache bound8192B/process (conditional40shells327680B retained syntax storage, excluding shell/allocator overhead). wait4 maxima are largest-descendant maxima, NOT whole-tree RSS/PSS or aggregate bounds. Reader benefit alone does not establish whole setup/observer acceptance. Existing rowwise newline grammar defect predates cache, tracked separately by review. [measured summary](https://git.kayg.org/attachments/88e431dc-f826-4a2b-b55e-9ec1adf43932), [functional corpus](https://git.kayg.org/attachments/1e272863-96a5-448c-b89a-2ca02c6f9612), [8-hop raw JSON](https://git.kayg.org/attachments/0451b751-993f-4e72-a3a4-29f70be3c029), [8-hop raw log](https://git.kayg.org/attachments/982a5d23-81b9-4323-9583-8114ef20affe), [64-hop raw JSON](https://git.kayg.org/attachments/6133a651-9890-490f-b2e4-0c5cac1fffee), [64-hop raw log](https://git.kayg.org/attachments/1cf291c3-49be-457d-8700-e60174770965).

kayg commented

2026-10-20 01:33:22 +00:00

Author

Owner

Separate grammar correction proposal, before source edits: original and cached cl_binding_valid accept embedded newlines and alternate colon/dash separator placements although every producer and immutable filename uses one canonical uid:device:inode-hash record. Review reproduced a two-line value accepted in both13 and14; later filesystem checks still refuse, no removal bypass demonstrated. Tighten this validator to exactly one canonical ASCII record, retain20-digit nonnegative UID/device and nonzero inode bounds plus64 lowercase hash digits. Producers/storage/action contracts remain unchanged; accepted unexpected-input set becomes narrower. Add failing permanent samples before the change. Implement with bounded quoted shell field operations, without integer arithmetic on20-digit fields or another external process/library. This is separate from immutable14c pure-cache A/B; no performance acceptance inferred. All current filesystem observations remain in place. Rejected: silently changing grammar inside the cache experiment, or retaining the known multiline acceptance solely to save source changes. D17/D198/D243; #231/#235.

kayg commented

2026-10-20 01:41:23 +00:00

Author

Owner

Matched native candidate8 measurement is complete; the candidate remains unadopted.

The six immutable release-test ELFs from the matched control/candidate sources ran on the owned performance VM in ABBA then BAAB order. All 136 fresh-process runs across 17 dimensions exited0: typed codec 1024/8192, actual verified TLS redemption/join and refusals on both runtime kinds, durable identity publication, runtime inspect/retire at 0/50/1000 sessions, manifest cleanup at 0/50/1000/bounded 2766 objects and independent recreation, receive adapter, and two 1000-node authenticated health cases. Each VM process held the fair performance lock with CPUWeight 10000; artifacts were staged beforehand. No host timing is used.

Costs are disclosed, not inferred away: 8 KiB encoding increased6.113→15.821µs (2.59x). Actual two-worker journaled join median 127.014→128.764ms (1.014x); current-thread 130.069→125.343ms (0.964x). Bounded2766-object cleanup 187.592→189.852ms (1.012x). At 1000 sessions inspect 1.333→1.352ms and retirement 1.360→1.367ms. Receive callback 55.216→56.443ns (1.022x), pooled p9559.707→61.252ns; this adapter-only probe excludes authentication and physical I/O. Both health cases maintained 1000/1000 live and zero guard exits in every process. Their elapsed fresh-process medians were authenticated mesh 8.744→9.235s and adaptive 8.214→8.228s; these are health-test durations, not packet-latency distributions. Journal filesystem probe 8 KiB medians of four reported process p50s 81.335→82.663ms; medians of reported process p95s 93.635→99.782ms, with no pooled p95 claim.

Memory scope remains narrow: explicitly owned Manifest/Vec/PathBuf capacities were identical, max 733254 B per transient removal helper (conditional 40 simultaneous helpers 29330160 B). This excludes allocator/kernel/fixture memory and does not describe resident daemons. Rusage records the largest waited child/descendant peak, not whole-tree RSS/PSS, allocator-exclusive bytes, or per-session memory. The shared HTTP driver adds one temporary box per connection; RSS does not establish its allocation cost.

Provenance correction: the first v2 harness refused execution 126 before any benchmark because root extraction preserved host UID1001/mode500, unmapped inside the ordinaryUID namespace. That refusal is retained. The v3 staging fix uses --no-same-owner; all six ELF/probe-source hashes remain unchanged and ordinary UID1001 admission is explicit. No failed v2 timing is counted.

D243 correction to my earlier task-base interpretation: candidate static 21327760 B SHA647ff9ec136166391f0bdf42fd093ab6d72798533208820c6713323f386a5214 is +62112 B versus named task base 587, but +102016 B cumulatively versus dev merge base c00. The latter exceeds 65536 B by 36480 B. Passing component measurements does not authorize adoption, and final source/dictionary/helper changes still require refreshed both-architecture exact bytes and contributor accounting. No profile or compilation-boundary change has entered live source.

All 136 raw case logs, staging/source manifests and harness, final remaining-case summary, per-file SHA inventory. The archive also contains earlier codec/TLS/cleanup/runtime summaries with exact sample scopes.

Matched native candidate8 measurement is complete; the candidate remains unadopted. The six immutable release-test ELFs from the matched control/candidate sources ran on the owned performance VM in ABBA then BAAB order. All 136 fresh-process runs across 17 dimensions exited0: typed codec 1024/8192, actual verified TLS redemption/join and refusals on both runtime kinds, durable identity publication, runtime inspect/retire at 0/50/1000 sessions, manifest cleanup at 0/50/1000/bounded 2766 objects and independent recreation, receive adapter, and two 1000-node authenticated health cases. Each VM process held the fair performance lock with CPUWeight 10000; artifacts were staged beforehand. No host timing is used. Costs are disclosed, not inferred away: 8 KiB encoding increased6.113→15.821µs (2.59x). Actual two-worker journaled join median 127.014→128.764ms (1.014x); current-thread 130.069→125.343ms (0.964x). Bounded2766-object cleanup 187.592→189.852ms (1.012x). At 1000 sessions inspect 1.333→1.352ms and retirement 1.360→1.367ms. Receive callback 55.216→56.443ns (1.022x), pooled p9559.707→61.252ns; this adapter-only probe excludes authentication and physical I/O. Both health cases maintained 1000/1000 live and zero guard exits in every process. Their elapsed fresh-process medians were authenticated mesh 8.744→9.235s and adaptive 8.214→8.228s; these are health-test durations, not packet-latency distributions. Journal filesystem probe 8 KiB medians of four reported process p50s 81.335→82.663ms; medians of reported process p95s 93.635→99.782ms, with no pooled p95 claim. Memory scope remains narrow: explicitly owned Manifest/Vec/PathBuf capacities were identical, max 733254 B per transient removal helper (conditional 40 simultaneous helpers 29330160 B). This excludes allocator/kernel/fixture memory and does not describe resident daemons. Rusage records the largest waited child/descendant peak, not whole-tree RSS/PSS, allocator-exclusive bytes, or per-session memory. The shared HTTP driver adds one temporary box per connection; RSS does not establish its allocation cost. Provenance correction: the first v2 harness refused execution 126 before any benchmark because root extraction preserved host UID1001/mode500, unmapped inside the ordinaryUID namespace. That refusal is retained. The v3 staging fix uses --no-same-owner; all six ELF/probe-source hashes remain unchanged and ordinary UID1001 admission is explicit. No failed v2 timing is counted. D243 correction to my earlier task-base interpretation: candidate static 21327760 B SHA647ff9ec136166391f0bdf42fd093ab6d72798533208820c6713323f386a5214 is +62112 B versus named task base 587, but +102016 B cumulatively versus dev merge base c00. The latter exceeds 65536 B by 36480 B. Passing component measurements does not authorize adoption, and final source/dictionary/helper changes still require refreshed both-architecture exact bytes and contributor accounting. No profile or compilation-boundary change has entered live source. [All 136 raw case logs, staging/source manifests and harness](https://git.kayg.org/attachments/8c57225d-41e3-4e52-ae06-8c3a20281d6a), [final remaining-case summary](https://git.kayg.org/attachments/b1bbbf97-edd1-4781-a9af-5582f615d4f2), [per-file SHA inventory](https://git.kayg.org/attachments/54ad9bd8-0a2c-42ba-b413-12fc2a248f94). The archive also contains earlier codec/TLS/cleanup/runtime summaries with exact sample scopes.

kayg commented

2026-10-20 01:45:13 +00:00

Author

Owner

Shared retirement custody slice prepared on addhost-readd-r4, current HEAD 28714f86c73d3a7e7bb3d023234e6cd1d10fcd93; no commit by this worker. Only private_retirement.sh and private_retirement_round4.rs changed in this slice.

Three actual direct controls establish the changes:

Proof-only admission reconstructed the canonical pending pathname but discarded it when absent. Recreating an empty directory after the real read-only find pass then returned0 and deleted the entire original stage/proof. The fix retains that original coordinate through all worker arguments and final cleanup, allowing genuine missing completed steps while rejecting a new inode. New permanent regression checks three attempts, exact pending Left, and complete original stage/control plus independent directory images.
Fresh-state workers authenticated only the outside proof at their final control fence. A real stat wrapper returned the last original ancestor observation, then moved original state/data beneath a replacement base or state directory. The old worker refused72/reported afterward but had already deleted the original file. The shared worker now checks original base AND state from authenticated captured rows in both passes and before unlink/rmdir, reusing retire_match. New permanent regression preserves original file/proof and independent/held containers across three attempts per variant. fresh_cleanup.sh is unchanged; no new parser, worker argument or producer schema.
An outside proof recreated with identical bytes was reported as its unchanged peer because peer comparison preceded original outside authentication. Outside custody is now authenticated first, with the existing final proof check retained. Existing edit/same_bytes/extra_alias assertions remain unchanged.

Final direct receipts: proof-only3 refusal attempts plus positive; fresh base/state6 refusal attempts plus positive; outside-proof edits/recreation/alias6 exact OUTSIDE reports; all10 discovered real rm/rmdir cuts resume twice (20 calls). All direct metadata/report assertions pass. Selected sh -n, rustfmt --check, and git diff --check pass. This is direct-source consumer evidence, NOT Cargo/full-suite, full syscall matrix, or performance acceptance. Coherent source15 compiler/cap gates remain pending. Cleanup-only extra proof/base/state checks are unmeasured; no deadline/cap/cache relaxation.

Final module SHA256 683707c67de6ffc8fd2ad6eb76bcc6635ee3a46d8dca9cf3be9872d2bdb5fc5f; test SHA256 9bc78436af0bf53a614a29911b7c2cad4639d5f3b5ec88442d19cb9ee10507b8.

Source-ready summary
Proof-only RED
Proof-only GREEN
Fresh scope RED
Fresh scope GREEN
Proof report RED
Proof report GREEN
Deletion-cut recovery

Shared retirement custody slice prepared on `addhost-readd-r4`, current HEAD `28714f86c73d3a7e7bb3d023234e6cd1d10fcd93`; no commit by this worker. Only private_retirement.sh and private_retirement_round4.rs changed in this slice. Three actual direct controls establish the changes: - Proof-only admission reconstructed the canonical pending pathname but discarded it when absent. Recreating an empty directory after the real read-only find pass then returned0 and deleted the entire original stage/proof. The fix retains that original coordinate through all worker arguments and final cleanup, allowing genuine missing completed steps while rejecting a new inode. New permanent regression checks three attempts, exact pending Left, and complete original stage/control plus independent directory images. - Fresh-state workers authenticated only the outside proof at their final control fence. A real stat wrapper returned the last original ancestor observation, then moved original state/data beneath a replacement base or state directory. The old worker refused72/reported afterward but had already deleted the original file. The shared worker now checks original base AND state from authenticated captured rows in both passes and before unlink/rmdir, reusing retire_match. New permanent regression preserves original file/proof and independent/held containers across three attempts per variant. fresh_cleanup.sh is unchanged; no new parser, worker argument or producer schema. - An outside proof recreated with identical bytes was reported as its unchanged peer because peer comparison preceded original outside authentication. Outside custody is now authenticated first, with the existing final proof check retained. Existing edit/same_bytes/extra_alias assertions remain unchanged. Final direct receipts: proof-only3 refusal attempts plus positive; fresh base/state6 refusal attempts plus positive; outside-proof edits/recreation/alias6 exact OUTSIDE reports; all10 discovered real rm/rmdir cuts resume twice (20 calls). All direct metadata/report assertions pass. Selected `sh -n`, `rustfmt --check`, and `git diff --check` pass. This is direct-source consumer evidence, NOT Cargo/full-suite, full syscall matrix, or performance acceptance. Coherent source15 compiler/cap gates remain pending. Cleanup-only extra proof/base/state checks are unmeasured; no deadline/cap/cache relaxation. Final module SHA256 `683707c67de6ffc8fd2ad6eb76bcc6635ee3a46d8dca9cf3be9872d2bdb5fc5f`; test SHA256 `9bc78436af0bf53a614a29911b7c2cad4639d5f3b5ec88442d19cb9ee10507b8`. [Source-ready summary](https://git.kayg.org/attachments/8d93c44d-8e70-4cb4-a63a-ebc427e89bb7) [Proof-only RED](https://git.kayg.org/attachments/4ecf4721-72f9-4418-a287-6a23c51cae70) [Proof-only GREEN](https://git.kayg.org/attachments/7dc95f2c-096c-4723-813e-bb7f0fcbd356) [Fresh scope RED](https://git.kayg.org/attachments/80cc4fdb-5fd5-4d9e-ac83-2987bc2abbbd) [Fresh scope GREEN](https://git.kayg.org/attachments/7b1daeac-39a1-457d-9637-f6c9dea00636) [Proof report RED](https://git.kayg.org/attachments/efafd9f9-0ee4-4c8a-81af-ec167467a1b6) [Proof report GREEN](https://git.kayg.org/attachments/ab814c05-c3b7-449b-92fb-c3e3d48b13c3) [Deletion-cut recovery](https://git.kayg.org/attachments/831708e2-f0cc-4320-a57d-15b36bec97d0)

kayg commented

2026-10-20 01:50:45 +00:00

Author

Owner

Harness correction proposed before editing: current full-ptrace whole-flow controls for original/cache/canonical sources reach the NEW observer55s watchdog with roughly1million syscall entry/exit stops,7,725–8,607 processes and67–82 Install mutations. These are incomplete traces, not production latency or completed equivalence. The new syscall_observer.py55s is absent from owner prompt/CLAUDE/PROCESS/R3 changes; the historical60s Local negotiated transport deadline comes from74d3f095e and was copied around the new observer. Independent source/history review confirms this distinction.

Add an explicit full-install observer profile with finite150s per-actor watchdog and155s instrumented negotiated transport bound. Only Boundaries full-syscall mode selects it. Ordinary observer calls retain55s; filtered tracing retains55s/60s; normal Local remains60s; all R3 watchdogs and assertions remain unchanged. Full ordered syscall/path/stat receipts, exact metadata/final namespace comparison, original cut list and mutation preservation assertions remain mandatory. Real production sleep180 lease, acquisition60 and production attempt180 stay unchanged; lease expiry is still a failure, never normalized away. Complete VM control receipts and independent unobserved production measurements remain required. Reject extending shipping limits or treating slower tracing as product performance acceptance. Earlier root assumption that55s itself was an owner requirement was unsupported; retain every earlier RED receipt. D17/D243; #231/#235.

Harness correction proposed before editing: current full-ptrace whole-flow controls for original/cache/canonical sources reach the NEW observer55s watchdog with roughly1million syscall entry/exit stops,7,725–8,607 processes and67–82 Install mutations. These are incomplete traces, not production latency or completed equivalence. The new syscall_observer.py55s is absent from owner prompt/CLAUDE/PROCESS/R3 changes; the historical60s Local negotiated transport deadline comes from74d3f095e and was copied around the new observer. Independent source/history review confirms this distinction. Add an explicit full-install observer profile with finite150s per-actor watchdog and155s instrumented negotiated transport bound. Only Boundaries full-syscall mode selects it. Ordinary observer calls retain55s; filtered tracing retains55s/60s; normal Local remains60s; all R3 watchdogs and assertions remain unchanged. Full ordered syscall/path/stat receipts, exact metadata/final namespace comparison, original cut list and mutation preservation assertions remain mandatory. Real production sleep180 lease, acquisition60 and production attempt180 stay unchanged; lease expiry is still a failure, never normalized away. Complete VM control receipts and independent unobserved production measurements remain required. Reject extending shipping limits or treating slower tracing as product performance acceptance. Earlier root assumption that55s itself was an owner requirement was unsupported; retain every earlier RED receipt. D17/D243; #231/#235.

kayg commented

2026-10-20 02:00:29 +00:00

Author

Owner

Focused current controls, no full-product/size acceptance: literalUID1001 controller→UID1002 independent writer tests both pass from compiler-pinned14d install artifact177a509d2eb6f5e89b43945a6de054067d30c4b2ee542371b1b075e731afe497. The first proves ordinary child CapEff/Prm/Inh/Amb0 and NoNewPrivs1 while actual writer retains DAC_OVERRIDEonly; the second exercises restore/reapply across file/directory/link/socket and5 change variants. Each owned writer/test/client reaped and CID inspect absent, artifact unchanged. These are host functional controls, not timings or the installation Cartesian product.

Canonical binding correction: permanent multiline/mixed-separator regression RED before change, focused controls GREEN after;10,242 independent canonical-reference samples match (1,063 accepted/9,179 refused). Complete ordinary ledger gate14d and15:1passed/1explicitlyignored. Raw old failure retained. New full-install observer-profile configuration/mutation control passes; its first draft test used a wrong receipt-field name and that ERROR log is retained too. Whole profile source16 gate and VM equivalence remain pending.

Size candidate9 shared private-read helper REJECTED: actual stripped staticx86_64=21,328,016B SHA2567c9d574da6bba980ac658cdc0297fda9394ab4ac8acdffb68acfae0ebe219814,256B larger than exact native8(21,327,760B), despite59 native tests passing(3ignored). No runtime measurement/adoption for a non-reducing candidate. Independent enrollment outlines10 stopped on one needless reference in a moved helper;10b changes only that equivalent lint defect and is queued. Native8 itself remains unadopted because cumulative+102,016B exceeds64KiB; neither task-base comparison nor historical R3 approval supplies a new allowance.

Stable15 compiler artifactd501c074110969a4dd60a7f8f9432e9a04d492a09cc7142f39cf137bfa1c159d/helperab19015b370aed2483cc7fe58d7f77e0d3b1b7737abbe107bffc6b04dfeaf5d9: fmt+both affected all-target Clippy+64SSH library tests/2ignored+ledger ordinary+3 actual remote ownership tests/1ignored pass. Maximum generated argument130,317B (<131,071); corrected remote namespace positively requires3 tests, earlier14c zero-test filter is not proof. Focused15 critical regressions still running; no complete gate claim.

focused-controls-and-native9-rejection.json
literal-install-session-caps-v14d.log
literal-install-mutation-restore-v14d.log
canonical-binding-red.log
canonical-binding-green.log
canonical-binding-properties.json
observer-profile-functional.log
observer-profile-functional-v2.log
management9-shared-read-z-size.log
management9-shared-read-z-size.map.gz

Focused current controls, no full-product/size acceptance: literalUID1001 controller→UID1002 independent writer tests both pass from compiler-pinned14d install artifact177a509d2eb6f5e89b43945a6de054067d30c4b2ee542371b1b075e731afe497. The first proves ordinary child CapEff/Prm/Inh/Amb0 and NoNewPrivs1 while actual writer retains DAC_OVERRIDEonly; the second exercises restore/reapply across file/directory/link/socket and5 change variants. Each owned writer/test/client reaped and CID inspect absent, artifact unchanged. These are host functional controls, not timings or the installation Cartesian product. Canonical binding correction: permanent multiline/mixed-separator regression RED before change, focused controls GREEN after;10,242 independent canonical-reference samples match (1,063 accepted/9,179 refused). Complete ordinary ledger gate14d and15:1passed/1explicitlyignored. Raw old failure retained. New full-install observer-profile configuration/mutation control passes; its first draft test used a wrong receipt-field name and that ERROR log is retained too. Whole profile source16 gate and VM equivalence remain pending. Size candidate9 shared private-read helper REJECTED: actual stripped staticx86_64=21,328,016B SHA2567c9d574da6bba980ac658cdc0297fda9394ab4ac8acdffb68acfae0ebe219814,256B larger than exact native8(21,327,760B), despite59 native tests passing(3ignored). No runtime measurement/adoption for a non-reducing candidate. Independent enrollment outlines10 stopped on one needless reference in a moved helper;10b changes only that equivalent lint defect and is queued. Native8 itself remains unadopted because cumulative+102,016B exceeds64KiB; neither task-base comparison nor historical R3 approval supplies a new allowance. Stable15 compiler artifactd501c074110969a4dd60a7f8f9432e9a04d492a09cc7142f39cf137bfa1c159d/helperab19015b370aed2483cc7fe58d7f77e0d3b1b7737abbe107bffc6b04dfeaf5d9: fmt+both affected all-target Clippy+64SSH library tests/2ignored+ledger ordinary+3 actual remote ownership tests/1ignored pass. Maximum generated argument130,317B (<131,071); corrected remote namespace positively requires3 tests, earlier14c zero-test filter is not proof. Focused15 critical regressions still running; no complete gate claim. [focused-controls-and-native9-rejection.json](https://git.kayg.org/attachments/2a5f25fb-20b8-4d8e-8ac9-6bd75240302a) [literal-install-session-caps-v14d.log](https://git.kayg.org/attachments/72b90d42-43a0-495e-9a95-b17638b7bed2) [literal-install-mutation-restore-v14d.log](https://git.kayg.org/attachments/daaf8c8d-541d-4c58-b444-0dfa37bba8f1) [canonical-binding-red.log](https://git.kayg.org/attachments/89ec3a26-9329-4496-bedd-70f9ec5fd92f) [canonical-binding-green.log](https://git.kayg.org/attachments/c5723c15-facc-4dbf-8e24-63240b24cfba) [canonical-binding-properties.json](https://git.kayg.org/attachments/feaeefe1-6efd-410e-ab89-3b7c5af38680) [observer-profile-functional.log](https://git.kayg.org/attachments/e5ef0ea9-2823-4c2f-adea-d1295a27d156) [observer-profile-functional-v2.log](https://git.kayg.org/attachments/fa08f9dc-2e0a-44b6-8032-a8061ddace57) [management9-shared-read-z-size.log](https://git.kayg.org/attachments/a8ef6760-958a-4cd0-8859-951316180e2b) [management9-shared-read-z-size.map.gz](https://git.kayg.org/attachments/d411af2f-92d1-4a57-a756-d68d8fc904f8)

kayg commented

2026-10-20 02:16:07 +00:00

Author

Owner

Checkpoint at ab4802145d. Source16b reconstructs from git archive 28714f86c7 plus attached overlay, SHA256 bb212f19a99c35c85d1e589d40809307c3989da7ddab07a1881ef96fff1ac105; source manifest 87ed6abe74a5ffa5df392b11d526898cae06fc344076d956afbc76c1af4e8f63. Production source is identical to source15. Only the new observer support changes: explicit full-install profile150s/negotiated155s; ordinary/filtered55s/60s unchanged; actual lease180s, production deadlines and all R3 assertions unchanged. Source16 first failed test-function Clippy104/100lines;16b outlines equivalent profile selection without an allowance. Its gate is queued; no16b VM success claimed.

Source15 focused results53/54 pass: all17 private-retirement controls,11 raw-authority controls and ordinary workflow regressions pass. Only empty-lease full-observer55s timeout remains. Command maximum130317B below131071. SSH library64pass2ignored; ordinary ledger1pass1ignored; actual remote ownership selector3pass1ignored.

Canonical binding parser VM matched40-reader balanced batches:8-hop median wall2.5682394495→2.213723335s (paired ratio0.8619584);64-hop19.7389247505→16.9450847315s (paired0.8628459). Corpus10242/10242 agrees with canonical ASCII reference. Exact original filesystem/hash/link checks retained. This is reader-only evidence; prior full-flow55s failures remain recorded, and full eight-flow equivalence plus96-partition product are pending. Reported wait4 RSS is a largest-descendant maximum, not aggregate process memory.

M9 shared-read size experiment21328016B, +256 vsM8: rejected. M10b enrollment outline21331024B, +3264 vsM8: rejected. Neither adopted. Last dormant rollback_files gate also found2 failing14c controls; module not committed, diagnosis underway. Final branch gate and size compliance are pending.

recovery-v16b-source-overlay.tar.gz
recovery-v16b-resume-checkpoint.json
recovery-v16b-source.json
recovery-v15-critical-results.json
recovery-v16.log
canonical-binding-measured-summary.json
creator-ledger-canonical-8.json
creator-ledger-canonical-64.json
creator-ledger-canonical-8.log
creator-ledger-canonical-64.log

Checkpoint at ab4802145d1562039d4027893aabd52137574a5e. Source16b reconstructs from git archive 28714f86c73d3a7e7bb3d023234e6cd1d10fcd93 plus attached overlay, SHA256 bb212f19a99c35c85d1e589d40809307c3989da7ddab07a1881ef96fff1ac105; source manifest 87ed6abe74a5ffa5df392b11d526898cae06fc344076d956afbc76c1af4e8f63. Production source is identical to source15. Only the new observer support changes: explicit full-install profile150s/negotiated155s; ordinary/filtered55s/60s unchanged; actual lease180s, production deadlines and all R3 assertions unchanged. Source16 first failed test-function Clippy104/100lines;16b outlines equivalent profile selection without an allowance. Its gate is queued; no16b VM success claimed. Source15 focused results53/54 pass: all17 private-retirement controls,11 raw-authority controls and ordinary workflow regressions pass. Only empty-lease full-observer55s timeout remains. Command maximum130317B below131071. SSH library64pass2ignored; ordinary ledger1pass1ignored; actual remote ownership selector3pass1ignored. Canonical binding parser VM matched40-reader balanced batches:8-hop median wall2.5682394495→2.213723335s (paired ratio0.8619584);64-hop19.7389247505→16.9450847315s (paired0.8628459). Corpus10242/10242 agrees with canonical ASCII reference. Exact original filesystem/hash/link checks retained. This is reader-only evidence; prior full-flow55s failures remain recorded, and full eight-flow equivalence plus96-partition product are pending. Reported wait4 RSS is a largest-descendant maximum, not aggregate process memory. M9 shared-read size experiment21328016B, +256 vsM8: rejected. M10b enrollment outline21331024B, +3264 vsM8: rejected. Neither adopted. Last dormant rollback_files gate also found2 failing14c controls; module not committed, diagnosis underway. Final branch gate and size compliance are pending. [recovery-v16b-source-overlay.tar.gz](https://git.kayg.org/attachments/0aa3ae5f-bb04-43a0-9c11-f37afdc1c5aa) [recovery-v16b-resume-checkpoint.json](https://git.kayg.org/attachments/a4031f42-20d7-4737-a85d-4d9e70d735e4) [recovery-v16b-source.json](https://git.kayg.org/attachments/93837579-3e33-47b0-b6ab-114ee6d01ef2) [recovery-v15-critical-results.json](https://git.kayg.org/attachments/d25609a4-1ca5-4281-866d-011e228675b1) [recovery-v16.log](https://git.kayg.org/attachments/105323ec-aa1d-4fc4-b1f5-785d02f4d957) [canonical-binding-measured-summary.json](https://git.kayg.org/attachments/b43119a6-3961-473d-97f2-69537269e55a) [creator-ledger-canonical-8.json](https://git.kayg.org/attachments/9f741ac2-2eaf-49a0-802d-df344c76913f) [creator-ledger-canonical-64.json](https://git.kayg.org/attachments/e09e8193-8726-4b07-ba63-18b0ed9be235) [creator-ledger-canonical-8.log](https://git.kayg.org/attachments/8694e012-77ca-4553-9dad-b5547eb9b5ad) [creator-ledger-canonical-64.log](https://git.kayg.org/attachments/1913398f-aa16-43d1-9903-943be0251cb5)

kayg commented

2026-10-20 02:19:14 +00:00

Author

Owner

Completed shared literal-user test client at 1fe014108f. Exact HEAD-plus3-file projection: fmt, SSH/remote all-target Clippy pass; real ownership selector3pass1ignored. Explicit independentUID1002 writer slice1pass over42 actual mutation cuts/3024 attempted cases/1680 changed cases;1008 exact-kind recreations,156 in-place edits,516 same-inode owner changes,1884 repeated reports,1476 repeated refusals,0 silent reports. ControllerUID1001 capabilities3, independent writerUID1002 capabilities2; all owned child PIDs and container absent after run; unstripped ELF5e86e90d1b3aa949c90f2c34f4702513e7ddd5d5b4c95beed1f8e5c8e6790933 unchanged. Test support only; installer activation/oracle/final head gate remain pending.

atomic-shared-writer.log
atomic-shared-writer-foreign.log
atomic-shared-writer-artifact.json
atomic-shared-writer-source.json

Completed shared literal-user test client at 1fe014108f64f851d8a778301c3deb7ba0c7efa0. Exact HEAD-plus3-file projection: fmt, SSH/remote all-target Clippy pass; real ownership selector3pass1ignored. Explicit independentUID1002 writer slice1pass over42 actual mutation cuts/3024 attempted cases/1680 changed cases;1008 exact-kind recreations,156 in-place edits,516 same-inode owner changes,1884 repeated reports,1476 repeated refusals,0 silent reports. ControllerUID1001 capabilities3, independent writerUID1002 capabilities2; all owned child PIDs and container absent after run; unstripped ELF5e86e90d1b3aa949c90f2c34f4702513e7ddd5d5b4c95beed1f8e5c8e6790933 unchanged. Test support only; installer activation/oracle/final head gate remain pending. [atomic-shared-writer.log](https://git.kayg.org/attachments/7dacf735-ebcb-4fa0-bb8f-3d6480d2b41b) [atomic-shared-writer-foreign.log](https://git.kayg.org/attachments/a98d9730-ec17-4a31-b804-56ae381db288) [atomic-shared-writer-artifact.json](https://git.kayg.org/attachments/c09571f0-6b5a-4aeb-aeb8-251cc54ab1b3) [atomic-shared-writer-source.json](https://git.kayg.org/attachments/74ea7e70-38fb-49ff-a92b-33936f696d79)

kayg commented

2026-10-20 02:26:15 +00:00

Author

Owner

Three measured scratch-only reductions are rejected; none adopted. Against provisionalM8 staticx86=21327760B: M9 bounded private-reader sharing21328016B (+256); M10b enrollment outlines21331024B (+3264); M11 exceptional SSH-observation boxing21327536B (-224), insufficient benefit for an added exceptional-path allocation and extra review surface. M11 v2 fmt/all-targetSSHClippy/library64pass2ignored and named transport correctness targets pass, CLIClippy/static build pass. FirstM11 attempt failed two loopback socket tests because its harness mistakenly created an isolated network namespace with loopback down; v2 removes only that network namespace, preserving source and UID/mount isolation. Original failure retained. No size/performance acceptance or cap change claimed.

management9-shared-read-z-size.log
management10b-enrollment-outlines-z-size.log
management11-observation-outline-z-size.log
management11-observation-outline-z-size-v2.log

Three measured scratch-only reductions are rejected; none adopted. Against provisionalM8 staticx86=21327760B: M9 bounded private-reader sharing21328016B (+256); M10b enrollment outlines21331024B (+3264); M11 exceptional SSH-observation boxing21327536B (-224), insufficient benefit for an added exceptional-path allocation and extra review surface. M11 v2 fmt/all-targetSSHClippy/library64pass2ignored and named transport correctness targets pass, CLIClippy/static build pass. FirstM11 attempt failed two loopback socket tests because its harness mistakenly created an isolated network namespace with loopback down; v2 removes only that network namespace, preserving source and UID/mount isolation. Original failure retained. No size/performance acceptance or cap change claimed. [management9-shared-read-z-size.log](https://git.kayg.org/attachments/f66745ab-d907-4da4-9530-67cf4aac31b8) [management10b-enrollment-outlines-z-size.log](https://git.kayg.org/attachments/1b63e1b3-acd4-4339-8b44-1f8d91dc6775) [management11-observation-outline-z-size.log](https://git.kayg.org/attachments/cc1441d7-f71c-46e5-be1a-d4e88076ffc2) [management11-observation-outline-z-size-v2.log](https://git.kayg.org/attachments/cac770e0-e718-4323-bc1b-f70e8aa24c7f)

kayg commented

2026-10-20 02:27:10 +00:00

Author

Owner

P2 finding and narrow correction from the independent v16b source review (#231/#235, D17/D134).

An upgrade's manifest_state producer built its prior-directory identity using stat -c with literal backslash-t characters, then compared it literally against canonical TAB-separated receipt rows. An original manifest-owned state subdirectory therefore became retention-only a in the new copied-state manifest instead of d; native removal would retain that install-created directory. No deletion of independent data was demonstrated.

A permanent direct regression now runs the actual manifest_authority.sh producer and private_write.sh bound reader over real original/copied inodes. It verifies inherited a, copied regular r, copied symlink k, and identity f controls; the unchanged original-owned directory must transfer d custody to the new copied inode. A second case moves/recreates the original directory while retaining the immutable original receipt: the copied directory must remain a. Both cases preserve receipt bytes and directory fixtures.

RED: frozen recovery-v16b-source manifest_authority.sh SHA256 f3ae54dac42a3d07fb779130161d0b4aac28a9dd3c7484ebcc6d7ad2a0f76bd1; 2 cases run, exactly the intended d-versus-a assertion fails (exit1). GREEN: current uncommitted correction SHA256 aed96408ed4329e95edd05fa53add825f3d38763960de8f6827948e83fd5f078; 2 cases pass (exit0). Same test bytes SHA256 75c0f87e973eec10130ff5aad1bbcfe5a3e51d653ab13075ceece6c33a92dc24. The correction uses real TABs and documents the canonical-field invariant; the quoted child source remains one physical line.

Files: crates/plugins/ssh/tests/manifest_state.rs, manifest_state_test.py; production correction only crates/plugins/ssh/src/manifest_authority.sh. Shell syntax and Rustfmt checks pass. This is a direct producer regression, not a completed end-to-end upgrade/removal or exhaustive interruption proof. The native wrapper has not yet been compiled; root owns the queued build/gate. Working branch addhost-readd-r4, observed HEAD 1fe014108f; correction is uncommitted and no final completion claim is made.

Exact RED/GREEN hashes, RED output, GREEN output.

P2 finding and narrow correction from the independent v16b source review (#231/#235, D17/D134). An upgrade's manifest_state producer built its prior-directory identity using stat -c with literal backslash-t characters, then compared it literally against canonical TAB-separated receipt rows. An original manifest-owned state subdirectory therefore became retention-only `a` in the new copied-state manifest instead of `d`; native removal would retain that install-created directory. No deletion of independent data was demonstrated. A permanent direct regression now runs the actual manifest_authority.sh producer and private_write.sh bound reader over real original/copied inodes. It verifies inherited `a`, copied regular `r`, copied symlink `k`, and identity `f` controls; the unchanged original-owned directory must transfer `d` custody to the new copied inode. A second case moves/recreates the original directory while retaining the immutable original receipt: the copied directory must remain `a`. Both cases preserve receipt bytes and directory fixtures. RED: frozen recovery-v16b-source manifest_authority.sh SHA256 f3ae54dac42a3d07fb779130161d0b4aac28a9dd3c7484ebcc6d7ad2a0f76bd1; 2 cases run, exactly the intended d-versus-a assertion fails (exit1). GREEN: current uncommitted correction SHA256 aed96408ed4329e95edd05fa53add825f3d38763960de8f6827948e83fd5f078; 2 cases pass (exit0). Same test bytes SHA256 75c0f87e973eec10130ff5aad1bbcfe5a3e51d653ab13075ceece6c33a92dc24. The correction uses real TABs and documents the canonical-field invariant; the quoted child source remains one physical line. Files: crates/plugins/ssh/tests/manifest_state.rs, manifest_state_test.py; production correction only crates/plugins/ssh/src/manifest_authority.sh. Shell syntax and Rustfmt checks pass. This is a direct producer regression, not a completed end-to-end upgrade/removal or exhaustive interruption proof. The native wrapper has not yet been compiled; root owns the queued build/gate. Working branch addhost-readd-r4, observed HEAD 1fe014108f64f851d8a778301c3deb7ba0c7efa0; correction is uncommitted and no final completion claim is made. [Exact RED/GREEN hashes](https://git.kayg.org/attachments/9a0915d8-894d-4dd6-8e33-fd1c91c39718), [RED output](https://git.kayg.org/attachments/1e9d4965-d354-4d13-9762-5fada25e8f70), [GREEN output](https://git.kayg.org/attachments/13dc5d6f-06de-428a-bd36-448385e3df59).

kayg commented

2026-10-20 02:27:18 +00:00

Author

Owner

Test-only comparator allocation-generation proposal (#231/#235), before implementation.

The completed v16b VM traces each contain496 ordered mutations with identical syscall/process counts, but the global raw(uid,device,inode) bijection rejects a legal allocator history. At ordinal2 the full trace allocates empty directory self-marker2097232 (filtered2097265); successful rmdir49 removes it. Filtered capsule-root2097263 is separately removed by successful rmdir52. At ordinal53 a NEW empty lease regular file gets full2097232/filtered2097263, is unlinked68, then NEW runtime directory69 reuses those integers. Its rename94 preserves that new directory through sessions. These allocation lifetimes do not overlap. Rawtuple equality across dead allocations is not object identity.

Introduce a comparison-only lifetime index from successful recorded new-allocation births and actual alias mutations. mkdir/symlink/named creating-open/anonymous O_TMPFILE birth can introduce a new generation after prior named aliases have retired; mere pathname absence never does. Rename and hardlink transfer/add aliases to the existing generation, while FD-only continuation retains its original generation without a new birth. Validate simultaneous alias/type/link/content consistency and retain every generation rather than deleting old mappings. Unknown or ambiguous histories fail closed. New-birth evidence cannot excuse an existing live alias being rebound.

Pair generation identities bijectively across runs. Resolve original receipt rows through their recorded path/digest and allocation interval, not simply the currently reused rawtuple. Preserve historical receipt identities and SHA reconstruction, including predecessor bindings and prefixes; a prefix can match a completed receipt only in the same original allocation generation. Resolve identity-bearing marker/header fields from their original generation (and full digest where present), so a later allocation cannot rewrite an earlier manifest binding. Keep all existing UID/type/mode/nlink/digest/path/event/final-namespace checks.

Fail first with a permanent deterministic trace derived from directory-rmdir→file-create→unlink→directory, using different allocator reuse patterns in the two arms. Required controls include successful nonoverlapping reuse, preserved rename/hardlink identity, overlapping alias collapse refusal, retained live inode rebinding refusal, FD-only continuation refusal if rebound, and an improper historical manifest binding refusal. Run the unchanged existing selfchecks and replay the exact complete v16b raw payload before another VM comparison. No production/source/lease limit changes, no new dependencies, no incomplete-equivalence claim. Seven remaining axes remain held.

Test-only comparator allocation-generation proposal (#231/#235), before implementation. The completed v16b VM traces each contain496 ordered mutations with identical syscall/process counts, but the global raw(uid,device,inode) bijection rejects a legal allocator history. At ordinal2 the full trace allocates empty directory self-marker2097232 (filtered2097265); successful rmdir49 removes it. Filtered capsule-root2097263 is separately removed by successful rmdir52. At ordinal53 a NEW empty lease regular file gets full2097232/filtered2097263, is unlinked68, then NEW runtime directory69 reuses those integers. Its rename94 preserves that new directory through sessions. These allocation lifetimes do not overlap. Rawtuple equality across dead allocations is not object identity. Introduce a comparison-only lifetime index from successful recorded new-allocation births and actual alias mutations. mkdir/symlink/named creating-open/anonymous O_TMPFILE birth can introduce a new generation after prior named aliases have retired; mere pathname absence never does. Rename and hardlink transfer/add aliases to the existing generation, while FD-only continuation retains its original generation without a new birth. Validate simultaneous alias/type/link/content consistency and retain every generation rather than deleting old mappings. Unknown or ambiguous histories fail closed. New-birth evidence cannot excuse an existing live alias being rebound. Pair generation identities bijectively across runs. Resolve original receipt rows through their recorded path/digest and allocation interval, not simply the currently reused rawtuple. Preserve historical receipt identities and SHA reconstruction, including predecessor bindings and prefixes; a prefix can match a completed receipt only in the same original allocation generation. Resolve identity-bearing marker/header fields from their original generation (and full digest where present), so a later allocation cannot rewrite an earlier manifest binding. Keep all existing UID/type/mode/nlink/digest/path/event/final-namespace checks. Fail first with a permanent deterministic trace derived from directory-rmdir→file-create→unlink→directory, using different allocator reuse patterns in the two arms. Required controls include successful nonoverlapping reuse, preserved rename/hardlink identity, overlapping alias collapse refusal, retained live inode rebinding refusal, FD-only continuation refusal if rebound, and an improper historical manifest binding refusal. Run the unchanged existing selfchecks and replay the exact complete v16b raw payload before another VM comparison. No production/source/lease limit changes, no new dependencies, no incomplete-equivalence claim. Seven remaining axes remain held.

kayg commented

2026-10-20 02:29:48 +00:00

Author

Owner

Source18 checkpoint (not final acceptance): manifest ec5486c2cd0fe848d71f366d582a1d351faf9d47778d5eb434be709d99763f0f. Production changes from16b ONLY canonical literal-TAB manifest_state correction, with independent RED/GREEN producer controls already attached. Test-only permanent retention_report and recovery_fixture extractions preserve implementation/assertions; original installation fixture no longer depends on the future mutation-observer/focused-test families. Two rollback controls now use genuine producer phase cuts instead of matching encoded-wire plaintext or directly editing immutable creator rows. Source17 first failed all-target Clippy similar_names(state/stage), before compiler pins; source18 names the new local transaction_dir, with no lint allowance/assertion change. Source18 full ordinary integration gate is queued. Existing16b compiled source remains immutable for matched observer work.

First16b full/filtered workflow both complete with identical mutation/process counts; comparator correctly remains RED pending lifetime-model correction: kernel reuses a freed directory inode for a lease file and then another directory; global rawinode bijection joins different lifetimes. Remaining7 axes held; recorded receipts/negative alias controls precede any comparator correction. No final matrix, performance, size or full-head gate claim.

recovery-v17.log
retention-report-extraction.json
recovery-fixture-extraction-ready.json
rollback-fixture-source17-ready.json
recovery-v18-source.json

Source18 checkpoint (not final acceptance): manifest ec5486c2cd0fe848d71f366d582a1d351faf9d47778d5eb434be709d99763f0f. Production changes from16b ONLY canonical literal-TAB manifest_state correction, with independent RED/GREEN producer controls already attached. Test-only permanent retention_report and recovery_fixture extractions preserve implementation/assertions; original installation fixture no longer depends on the future mutation-observer/focused-test families. Two rollback controls now use genuine producer phase cuts instead of matching encoded-wire plaintext or directly editing immutable creator rows. Source17 first failed all-target Clippy similar_names(state/stage), before compiler pins; source18 names the new local transaction_dir, with no lint allowance/assertion change. Source18 full ordinary integration gate is queued. Existing16b compiled source remains immutable for matched observer work. First16b full/filtered workflow both complete with identical mutation/process counts; comparator correctly remains RED pending lifetime-model correction: kernel reuses a freed directory inode for a lease file and then another directory; global rawinode bijection joins different lifetimes. Remaining7 axes held; recorded receipts/negative alias controls precede any comparator correction. No final matrix, performance, size or full-head gate claim. [recovery-v17.log](https://git.kayg.org/attachments/34e24ec3-6359-483a-bf70-8f35d22f2d61) [retention-report-extraction.json](https://git.kayg.org/attachments/7c86d0cd-5788-4136-8a36-4dc33cfc22c5) [recovery-fixture-extraction-ready.json](https://git.kayg.org/attachments/3fee3e34-bc25-4255-88fb-18f3d499fc97) [rollback-fixture-source17-ready.json](https://git.kayg.org/attachments/34c4e19b-bdd1-41e1-8f88-8d32a19ae48a) [recovery-v18-source.json](https://git.kayg.org/attachments/b255fd17-3dae-431b-ae5b-634952f657ed)

kayg commented

2026-10-20 02:38:25 +00:00

Author

Owner

Correction and proposed same-execution filter coverage oracle

The v16b first Rootless/fresh/separate comparison completed both full and filtered workflows. Both recorded 496 actual mutation/durability boundaries. The original global inode bijection first failed because the allocator legitimately reused a retired inode for new directory/file/directory lifetimes. A generation-aware prototype passed that conflict and then correctly retained a second RED at ordinal 449: private_retirement::retire_resume uses find -depth and the independent fixture allocations enumerate different created-record names first. The earlier assumption that these independent executions must have identical total mutation order was incorrect. This is not a demonstrated production defect. Neither the raw order difference nor its receipts will be sorted, ignored, or normalized away. The remaining seven axes remain unexecuted.

Evidence: observer-v16b-first-comparison.json (the original 3,273,959-byte complete comparison), observer-v16b-identity-conflict.json, observer-v16b-retirement-order.json, observer-generation-red.log, observer-generation-existing-controls2.log, and observer-generation-v16b-replay-initial.log. Full actor install time was 142.500688 seconds under the explicitly approved test-only 150-second full-install profile; filtered install was 39.510868 seconds under its unchanged ordinary 55-second profile. These are instrumented functional durations, not production latency measurements. The actual lease remains 180 seconds.

Proposed stronger coverage claim

Run the independent full PTRACE_SYSCALL tracer with the EXACT existing install_prefilter() BPF installed in the same owned actor. Continue obtaining every ordinary entry/exit stop and serializing writers exactly as the full observer currently does. Also request PTRACE_O_TRACESECCOMP, so the kernel emits PTRACE_EVENT_SECCOMP only when that installed filter selects TRACE. Do not independently reimplement the BPF decision in Python.

For the owned bootstrap installation of the filter, require the actual successful PR_SET_SECCOMP return and a witnessed initial exec before admitting the workload. Every task inherits the same filter; existing ptrace fork/clone ancestry handling remains authoritative. At the ordinary full syscall entry, create a per-task monotonically increasing call identity and the original syscall number/effective arguments. The later SECCOMP stop must match that SAME in-flight call and may only mark it witnessed. It must never reclassify it, overwrite its pending operation, advance its call counter, release a writer, or add a boundary. Repeated/missing/mismatched/orphan witnesses fail closed. Raw argument values are compared in memory only, never written to receipts or logs. For the existing real short-write modifier, match the kernel's effective count after PTRACE_POKEUSER, retaining the requested/effective count receipt already in use.

Before recording or cutting ANY full-observed mutation/durability boundary, require the matching real kernel witness. This includes forced same-byte writes/renames, anonymous open/write/fsync/link, failed attempted path operations that produce a cut, and the full observer's dirty-inotify fallback for otherwise unclassified syscalls. Also require the witness on every classified mutation/durability attempt, even when a failure yields no cut. Thus an erroneously ALLOWed writer fails on its actual full entry/exit rather than disappearing with the filtered schedule. Every emitted cut retains its own exact order and carries a boolean witness plus an opaque task/call identity. No source contents, stdin, argv, or syscall pointer arguments are retained.

The filtered mode remains a separate independent complete generated workflow, under its existing scheduling/profile/deadline. Its production assertions and final typed public identity graph must match the intended completed outcome. This no longer asserts that raw readdir order is equal across independent allocations. Full same-execution coverage plus eight actual full/filtered completed workflows replaces that invalid cross-fixture-order assumption. Full 96-product interruption/preservation coverage is a separate required qualification and is not claimed by these eight cases.

Failing controls before implementation

Actual owned mkdir/write/fsync/link/rename/unlink/rmdir plus anonymous short-write/link must all produce matched real witnesses while their original full ordered trace is retained.
Deliberately omit one actual writing syscall from a test-only filter: the full observer must refuse at its first actual attempted mutation; filtered declaration counts alone cannot satisfy it.
Corrupt only the pending witness call identity/number/effective arguments, duplicate a witness, or omit/orphan a witness: refuse without manufacturing a cut.
A failed writing attempt still requires its matching witness; an unrelated read-only ALLOWed syscall must not be falsely demanded as a mutation witness.
Forked writers inherit the filter and their own call identity; two identical syscall numbers in distinct tasks cannot satisfy each other.
Existing independent same-lifetime alias/type/uid/digest/link mismatches, historical receipt rebinding, and generation/lifetime negative controls remain strict. A fresh allocation after proven prior retirement is the positive allocator-reuse control; rename/link/FD continuation is not a new allocation.
Existing real cut replay, anonymous short writes, owned lease cleanup, profile/config refusal, captured receipt, and unknown-path controls remain unchanged.

Scope and qualification

This is test-only observer/integration-oracle work. Proposed files: syscall_observer.py, syscall_observer_test.py, observer_equivalence.py (retain strict ordered comparator as a diagnostic and complete generation controls), activation_equivalence.rs, and only the existing scheduler-session plumbing needed to opt into audited full tracing. No production ordering, parser, protocol, R3 assertion, ordinary 60-second transport, ordinary/filtered 55-second observer, approved 150/155-second full profile, or real 180-second lease changes. No new library, engine, or feature. The parent must approve the exact implementation scope before edits. Kernel event sequencing will be established by actual selfchecks on the supported Linux x86_64 fixture; no portability claim beyond it.

# Correction and proposed same-execution filter coverage oracle The v16b first Rootless/fresh/separate comparison completed both full and filtered workflows. Both recorded 496 actual mutation/durability boundaries. The original global inode bijection first failed because the allocator legitimately reused a retired inode for new directory/file/directory lifetimes. A generation-aware prototype passed that conflict and then correctly retained a second RED at ordinal 449: private_retirement::retire_resume uses find -depth and the independent fixture allocations enumerate different created-record names first. The earlier assumption that these independent executions must have identical total mutation order was incorrect. This is not a demonstrated production defect. Neither the raw order difference nor its receipts will be sorted, ignored, or normalized away. The remaining seven axes remain unexecuted. Evidence: observer-v16b-first-comparison.json (the original 3,273,959-byte complete comparison), observer-v16b-identity-conflict.json, observer-v16b-retirement-order.json, observer-generation-red.log, observer-generation-existing-controls2.log, and observer-generation-v16b-replay-initial.log. Full actor install time was 142.500688 seconds under the explicitly approved test-only 150-second full-install profile; filtered install was 39.510868 seconds under its unchanged ordinary 55-second profile. These are instrumented functional durations, not production latency measurements. The actual lease remains 180 seconds. ## Proposed stronger coverage claim Run the independent full PTRACE_SYSCALL tracer with the EXACT existing install_prefilter() BPF installed in the same owned actor. Continue obtaining every ordinary entry/exit stop and serializing writers exactly as the full observer currently does. Also request PTRACE_O_TRACESECCOMP, so the kernel emits PTRACE_EVENT_SECCOMP only when that installed filter selects TRACE. Do not independently reimplement the BPF decision in Python. For the owned bootstrap installation of the filter, require the actual successful PR_SET_SECCOMP return and a witnessed initial exec before admitting the workload. Every task inherits the same filter; existing ptrace fork/clone ancestry handling remains authoritative. At the ordinary full syscall entry, create a per-task monotonically increasing call identity and the original syscall number/effective arguments. The later SECCOMP stop must match that SAME in-flight call and may only mark it witnessed. It must never reclassify it, overwrite its pending operation, advance its call counter, release a writer, or add a boundary. Repeated/missing/mismatched/orphan witnesses fail closed. Raw argument values are compared in memory only, never written to receipts or logs. For the existing real short-write modifier, match the kernel's effective count after PTRACE_POKEUSER, retaining the requested/effective count receipt already in use. Before recording or cutting ANY full-observed mutation/durability boundary, require the matching real kernel witness. This includes forced same-byte writes/renames, anonymous open/write/fsync/link, failed attempted path operations that produce a cut, and the full observer's dirty-inotify fallback for otherwise unclassified syscalls. Also require the witness on every classified mutation/durability attempt, even when a failure yields no cut. Thus an erroneously ALLOWed writer fails on its actual full entry/exit rather than disappearing with the filtered schedule. Every emitted cut retains its own exact order and carries a boolean witness plus an opaque task/call identity. No source contents, stdin, argv, or syscall pointer arguments are retained. The filtered mode remains a separate independent complete generated workflow, under its existing scheduling/profile/deadline. Its production assertions and final typed public identity graph must match the intended completed outcome. This no longer asserts that raw readdir order is equal across independent allocations. Full same-execution coverage plus eight actual full/filtered completed workflows replaces that invalid cross-fixture-order assumption. Full 96-product interruption/preservation coverage is a separate required qualification and is not claimed by these eight cases. ## Failing controls before implementation 1. Actual owned mkdir/write/fsync/link/rename/unlink/rmdir plus anonymous short-write/link must all produce matched real witnesses while their original full ordered trace is retained. 2. Deliberately omit one actual writing syscall from a test-only filter: the full observer must refuse at its first actual attempted mutation; filtered declaration counts alone cannot satisfy it. 3. Corrupt only the pending witness call identity/number/effective arguments, duplicate a witness, or omit/orphan a witness: refuse without manufacturing a cut. 4. A failed writing attempt still requires its matching witness; an unrelated read-only ALLOWed syscall must not be falsely demanded as a mutation witness. 5. Forked writers inherit the filter and their own call identity; two identical syscall numbers in distinct tasks cannot satisfy each other. 6. Existing independent same-lifetime alias/type/uid/digest/link mismatches, historical receipt rebinding, and generation/lifetime negative controls remain strict. A fresh allocation after proven prior retirement is the positive allocator-reuse control; rename/link/FD continuation is not a new allocation. 7. Existing real cut replay, anonymous short writes, owned lease cleanup, profile/config refusal, captured receipt, and unknown-path controls remain unchanged. ## Scope and qualification This is test-only observer/integration-oracle work. Proposed files: syscall_observer.py, syscall_observer_test.py, observer_equivalence.py (retain strict ordered comparator as a diagnostic and complete generation controls), activation_equivalence.rs, and only the existing scheduler-session plumbing needed to opt into audited full tracing. No production ordering, parser, protocol, R3 assertion, ordinary 60-second transport, ordinary/filtered 55-second observer, approved 150/155-second full profile, or real 180-second lease changes. No new library, engine, or feature. The parent must approve the exact implementation scope before edits. Kernel event sequencing will be established by actual selfchecks on the supported Linux x86_64 fixture; no portability claim beyond it.

kayg commented

2026-10-20 02:47:43 +00:00

Author

Owner

Exact source18b kernel empty-lease control PASS on named locked perf VM:1 actual selected test, unchanged filtered actor55s/transport60s and real lease180s, owned container removed, lock released; raw receipts attached. The build-host4-worker ordinary suite hit that newly authored tracing safety watchdog at discovery line307/status97. This is not a #118 baseline exception and is not claimed as a green host suite. Per owner requirement that instrumented timing budgets run only on the perf VM, this NEW test will be explicitly ignored by default with a required locked-VM gate; every assertion and budget remains unchanged, and future compiled source must execute it positively using --ignored. Existing R3 tests and annotations stay unchanged. Other new generated tracing matrices already use required explicit slice gates. This changes execution location, not acceptance criteria. Initial raw .tar upload received422, corrected to gzip without content changes; no authentication error.

observer-v18b-current-rootless-fresh-separate-lease.log
observer-v18b-current-rootless-fresh-separate-lease-receipts.tar.gz
observer-v18b-transfer.json

Exact source18b kernel empty-lease control PASS on named locked perf VM:1 actual selected test, unchanged filtered actor55s/transport60s and real lease180s, owned container removed, lock released; raw receipts attached. The build-host4-worker ordinary suite hit that newly authored tracing safety watchdog at discovery line307/status97. This is not a #118 baseline exception and is not claimed as a green host suite. Per owner requirement that instrumented timing budgets run only on the perf VM, this NEW test will be explicitly ignored by default with a required locked-VM gate; every assertion and budget remains unchanged, and future compiled source must execute it positively using --ignored. Existing R3 tests and annotations stay unchanged. Other new generated tracing matrices already use required explicit slice gates. This changes execution location, not acceptance criteria. Initial raw .tar upload received422, corrected to gzip without content changes; no authentication error. [observer-v18b-current-rootless-fresh-separate-lease.log](https://git.kayg.org/attachments/046571ef-ab00-4e3e-b601-57d778a250cb) [observer-v18b-current-rootless-fresh-separate-lease-receipts.tar.gz](https://git.kayg.org/attachments/d4fe6f5a-2e87-46e5-80d0-ab938b49b6f9) [observer-v18b-transfer.json](https://git.kayg.org/attachments/d73ea530-5e6f-4ea4-88b0-c643be309488)

kayg commented

2026-10-20 02:57:32 +00:00

Author

Owner

Test-only same-execution coverage implementation is ready for the next coherent compiler-pinned snapshot; this is not an eight-axis or full-product completion claim.

The previous independent-total-order assumption was incorrect. The original complete v16b raw comparison still refuses at ordinal 449, where legitimate directory enumeration selects a different private child. No production ordering was changed, and no recorded event was sorted or discarded. The allocator-generation change also retains live-alias, rename/link/FD continuation, historical receipt, and six-inode future-base binding refusal controls.

Full tracing now installs the exact existing BPF while retaining every PTRACE_SYSCALL entry/exit stop. A real kernel seccomp stop can only witness its exact pending owned task/call/number/effective arguments; it cannot reclassify or create a second cut. Every actual mutation attempt and recorded cut, including the dirty fallback and anonymous producer operations, requires the witness. A real test filter that incorrectly ALLOWs write causes refusal. Missing/duplicate/orphan/task/call/number/argument witness controls refuse. Per-command completed audit statistics detect omitted cut receipts. Independent filtered workflows must finish and their complete independently statted final identity graph must agree, including exact manifest target UID/inode/type/hash relations and reconstructed receipt bytes.

Final direct verification, verbatim:

............................................
----------------------------------------------------------------------
Ran 44 tests in 23.647s

OK
METRIC name=syscall_observer_anonymous writes=3 boundaries=7 cuts_verified=7
METRIC name=syscall_observer_prefixes writes=5 processes=5 boundaries=11 cuts_verified=11

Rust formatting and Python AST parsing also pass. No Cargo build or new VM workflow has executed for these four test-only files. The existing actual full/filtered shortened-write controls both pass; only the full observer claims exact effective-argument filter completeness. The old v16b data cannot be retroactively certified: it has no actual kernel audit witnesses/statistics and did not independently stat the fixture root.

Original R3 assertions, ordinary/filtered 55/60-second profiles, approved full 150/155-second profile, and actual 180-second lease are unchanged. Remaining seven axes and full interruption/preservation products remain pending compiler pins and VM qualification.

Receipts: initial kernel-witness RED, final 44-test log, exact four source hashes and retained RED/refusal replay, original complete v16b comparison, allocator lifetime proof, unchanged ordering RED, pre-code correction/design.

Test-only same-execution coverage implementation is ready for the next coherent compiler-pinned snapshot; this is not an eight-axis or full-product completion claim. The previous independent-total-order assumption was incorrect. The original complete v16b raw comparison still refuses at ordinal 449, where legitimate directory enumeration selects a different private child. No production ordering was changed, and no recorded event was sorted or discarded. The allocator-generation change also retains live-alias, rename/link/FD continuation, historical receipt, and six-inode future-base binding refusal controls. Full tracing now installs the exact existing BPF while retaining every PTRACE_SYSCALL entry/exit stop. A real kernel seccomp stop can only witness its exact pending owned task/call/number/effective arguments; it cannot reclassify or create a second cut. Every actual mutation attempt and recorded cut, including the dirty fallback and anonymous producer operations, requires the witness. A real test filter that incorrectly ALLOWs write causes refusal. Missing/duplicate/orphan/task/call/number/argument witness controls refuse. Per-command completed audit statistics detect omitted cut receipts. Independent filtered workflows must finish and their complete independently statted final identity graph must agree, including exact manifest target UID/inode/type/hash relations and reconstructed receipt bytes. Final direct verification, verbatim: ``` ............................................ ---------------------------------------------------------------------- Ran 44 tests in 23.647s OK METRIC name=syscall_observer_anonymous writes=3 boundaries=7 cuts_verified=7 METRIC name=syscall_observer_prefixes writes=5 processes=5 boundaries=11 cuts_verified=11 ``` Rust formatting and Python AST parsing also pass. No Cargo build or new VM workflow has executed for these four test-only files. The existing actual full/filtered shortened-write controls both pass; only the full observer claims exact effective-argument filter completeness. The old v16b data cannot be retroactively certified: it has no actual kernel audit witnesses/statistics and did not independently stat the fixture root. Original R3 assertions, ordinary/filtered 55/60-second profiles, approved full 150/155-second profile, and actual 180-second lease are unchanged. Remaining seven axes and full interruption/preservation products remain pending compiler pins and VM qualification. Receipts: [initial kernel-witness RED](https://git.kayg.org/attachments/244ed2e2-6055-4045-8efa-5aad113db71e), [final 44-test log](https://git.kayg.org/attachments/aa4a2382-8d6e-4607-b03e-883cba734969), [exact four source hashes and retained RED/refusal replay](https://git.kayg.org/attachments/b3546d30-e35b-425b-9705-0b0932f59877), [original complete v16b comparison](https://git.kayg.org/attachments/4a6f2815-449d-4de6-9f1e-50c308fb2f6e), [allocator lifetime proof](https://git.kayg.org/attachments/f6e4045a-aa4e-4188-b79b-eda37fb0d8f1), [unchanged ordering RED](https://git.kayg.org/attachments/ad20b514-ed7a-4d91-a161-bb6e8b4e7aa5), [pre-code correction/design](https://git.kayg.org/attachments/d64a6372-f638-4d30-9f53-9fa47635b29d).

kayg commented

2026-10-20 03:01:22 +00:00

Author

Owner

D243 measured experiment M12, no adoption: three narrow native8 outline candidates yielded+256/+3264/-224B; all rejected. Next measure ONLY the existing CLI binary package at opt-level=s. Default workspace/dependency profiles stay unchanged, including transport/mesh/crypto3 and existing server/agent/SSH settings. Hypothesis: operator dispatch/metadata contributes avoidable size. This is not assumed cold: independent source review is identifying concrete CLI steady data paths and required actual VM probes before any acceptance. No new library/engine/dependency, no changed limits or checks, no owner ceiling change. Frozen native8 control remains21327760B (+62112 taskbase587/+102016 devbasec00); final coherent x86/ARM, resolved features, all functional/latency/scale gates and cumulative size acceptance remain pending.

kayg commented

2026-10-20 03:12:42 +00:00

Author

Owner

Source20 frozen: manifest SHA256 dc90372e6bb9b90e3bbfa48df8204df695fd835f2c23c52f95ab82bfd9e21a83. Production is byte-identical to18b/19. Two test-only corrections: precreate original700 ancestor chain so the interrupted-transaction hook selects the intended base capsule (all original recovery assertions retained, plus exit42); compute empty service-flag SHA instead of the incorrect62-character literal. Exact file-backed permanent service control is RED before/GREEN after: Enabled/Active/Both accept empty600 files and all3 refuse nonempty digest. Tiny standalone rustc harness executed exact current types/validator/control; compiled Cargo gate remains pending. Source20 full ordinary suite queued; source19 kernel-witness compile/profile and VM qualification remain separate. No final acceptance claim.

service-flag-digest-red.log
service-flag-digest-green.log
service-flag-digest-repair-ready.json
recovery-v20-source.json

Source20 frozen: manifest SHA256 dc90372e6bb9b90e3bbfa48df8204df695fd835f2c23c52f95ab82bfd9e21a83. Production is byte-identical to18b/19. Two test-only corrections: precreate original700 ancestor chain so the interrupted-transaction hook selects the intended base capsule (all original recovery assertions retained, plus exit42); compute empty service-flag SHA instead of the incorrect62-character literal. Exact file-backed permanent service control is RED before/GREEN after: Enabled/Active/Both accept empty600 files and all3 refuse nonempty digest. Tiny standalone rustc harness executed exact current types/validator/control; compiled Cargo gate remains pending. Source20 full ordinary suite queued; source19 kernel-witness compile/profile and VM qualification remain separate. No final acceptance claim. [service-flag-digest-red.log](https://git.kayg.org/attachments/0d9315ea-2e99-4e8b-b8f7-bc9d7bd95407) [service-flag-digest-green.log](https://git.kayg.org/attachments/2ede3bad-d04e-41a9-a92a-ced15206f937) [service-flag-digest-repair-ready.json](https://git.kayg.org/attachments/dbbd4cb3-2653-466f-b1a2-5ba08698e3f4) [recovery-v20-source.json](https://git.kayg.org/attachments/45b5198c-35c0-4e05-ba50-3a428950b169)

kayg commented

2026-10-20 03:16:42 +00:00

Author

Owner

Source20 gate scope refinement before execution (log empty): keep fmt/all-target Clippy, compiler pins/caps,44 observer controls and report/manifest controls; replace the duplicate broad ordinary suite with positive exact selectors for the interrupted-transaction fixture and the new file-backed service SHA control. Then run SSHlib/creator-ledger/previous-attempt/recovery-support targets that source18b set-e will skip. Production identical18b; source18b broad suite still running its final R3 edit test. The actual shipping activation projection will independently run every original installer integration test; final fast remains required at committedHEAD. This is no fullordinary-green claim or waived failure.

kayg commented

2026-10-20 03:18:11 +00:00

Author

Owner

Source18b broad ordinary installer run finished non-green. All3 R3 installer regressions pass;272 passed,2 failed,23 ignored. The2 failures are generated_empty_lease_requires_exact_kernel_lock_retirement (55s observer watchdog on shared build host; exact18b case separately passed positive1 on locked perf VM, receipts already attached) and review_interrupted_transaction_receipt_allows_owned_cleanup (hook selected earlier parent capsule; original700 ancestors correction in immutable20, original assertions unchanged and exit42 added). No baseline exception or final acceptance claimed. Source19/current VM qualification and20 positive correction gate are queued.

Verbatim final gate result (functional host transcript; not performance evidence):

failures:
    activation_boundaries::generated_empty_lease_requires_exact_kernel_lock_retirement
    review_interrupted_transaction_receipt_allows_owned_cleanup

test result: FAILED. 272 passed; 2 failed; 23 ignored; 0 measured; 0 filtered out; finished in 2465.39s

recovery-v18b.log

Source18b broad ordinary installer run finished non-green. All3 R3 installer regressions pass;272 passed,2 failed,23 ignored. The2 failures are generated_empty_lease_requires_exact_kernel_lock_retirement (55s observer watchdog on shared build host; exact18b case separately passed positive1 on locked perf VM, receipts already attached) and review_interrupted_transaction_receipt_allows_owned_cleanup (hook selected earlier parent capsule; original700 ancestors correction in immutable20, original assertions unchanged and exit42 added). No baseline exception or final acceptance claimed. Source19/current VM qualification and20 positive correction gate are queued. Verbatim final gate result (functional host transcript; not performance evidence): ``` failures: activation_boundaries::generated_empty_lease_requires_exact_kernel_lock_retirement review_interrupted_transaction_receipt_allows_owned_cleanup test result: FAILED. 272 passed; 2 failed; 23 ignored; 0 measured; 0 filtered out; finished in 2465.39s ``` [recovery-v18b.log](https://git.kayg.org/attachments/4cb5b2e2-7a63-49df-a6ef-90d6db2d035c)

kayg commented

2026-10-20 03:27:09 +00:00

Author

Owner

Source19 compile/profile milestone GREEN (not shippingHEAD/VM/exhaustive acceptance). Both all-targetSSH and remote(agent,test-support,tokio/rt-multi-thread) Clippy pass; unchangedRoot/Rootless/longDNS argv cap;44 direct Pythonobserver controls; compiledselfcheck positive1; retentioncontrols3; realmanifestproducerRustwrapper1/directPython2. Installartifact SHA256 194cac45ad2e1b6d05fece458cb3d677cfe32c4c3ba6b49ac25d0dec9db1ff71 (82690280B); helper a1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8; source manifest 2c2969aa3a2afdcfea729bd243fb1f8d02f4f05e8f5291694ae51edd468dd7d8. Marker RECOVERY_V19_WITNESS_COMPILE_PROFILE_GREEN. VM staging attempt failed on metadata KeyError:a before any transfer/lock/measurement; correcting onlystaging, exactsource/binarypins unchanged. All8VM qualification routes and96product remain pending.

recovery-v19.log

Source19 compile/profile milestone GREEN (not shippingHEAD/VM/exhaustive acceptance). Both all-targetSSH and remote(agent,test-support,tokio/rt-multi-thread) Clippy pass; unchangedRoot/Rootless/longDNS argv cap;44 direct Pythonobserver controls; compiledselfcheck positive1; retentioncontrols3; realmanifestproducerRustwrapper1/directPython2. Installartifact SHA256 194cac45ad2e1b6d05fece458cb3d677cfe32c4c3ba6b49ac25d0dec9db1ff71 (82690280B); helper a1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8; source manifest 2c2969aa3a2afdcfea729bd243fb1f8d02f4f05e8f5291694ae51edd468dd7d8. Marker RECOVERY_V19_WITNESS_COMPILE_PROFILE_GREEN. VM staging attempt failed on metadata KeyError:a before any transfer/lock/measurement; correcting onlystaging, exactsource/binarypins unchanged. All8VM qualification routes and96product remain pending. [recovery-v19.log](https://git.kayg.org/attachments/692b9923-f19c-47ad-a859-ff86ed46fb67)

kayg commented

2026-10-20 03:33:34 +00:00

Author

Owner

Source19 actual VM qualification stopped fail-closed before its first mutation: the full observer demanded a filter witness for a read-only terminal query. The exact lease control passed; the first full/filtered workflow is RED and the remaining seven remain unrun. No production latency or coverage acceptance follows.

A tiny actual syscall reproduction identifies nr16 ioctl(TCGETS, 0x5401) on watched regular fd3 opened O_RDONLY. The query fails ENOTTY, has force=false, changes neither original inode nor public bytes, and records zero mutation cuts. The existing exact filter intentionally ALLOWs this existing READ_ONLY_IOCTL member. The newly added unconditional attempted-mutation witness check incorrectly treated its watched descriptor as an attempted mutation. This is observer classification, not an omitted mutation syscall in the filter.

The bounded correction excludes only existing READ_ONLY_IOCTL members from that early attempted-mutation check. The record() check remains mandatory for every actual recorded cut, including any unexpected dirty ioctl fallback. All existing filter omission/spoof/args/task/call negative controls remain. Add a permanent real O_RDONLY/TCGETS/ENOTTY control followed by a real file write; require query identity/bytes preservation, no invented ioctl cut, and actual same-call kernel witness on the write and its replayed cut. Add a direct dirty-fallback witness refusal control. No source19 snapshot changes, no BPF policy change, no clock/lease change, no production edits.

Receipts: evidence/observer-v19-ioctl-tiny-red.json; failed first workflow archive SHA256 6baed9ef2802a9c1ffe449d13c824d23d75aafcb576bdd83b21f2fc2a2462dd8; lease archive SHA256 76bbdc653033853cbaa0c1d801419384c222dbec2e748752e71073810fdcae06. Both owned containers were removed and the VM performance lock was released between cases.

Source19 actual VM qualification stopped fail-closed before its first mutation: the full observer demanded a filter witness for a read-only terminal query. The exact lease control passed; the first full/filtered workflow is RED and the remaining seven remain unrun. No production latency or coverage acceptance follows. A tiny actual syscall reproduction identifies nr16 ioctl(TCGETS, 0x5401) on watched regular fd3 opened O_RDONLY. The query fails ENOTTY, has force=false, changes neither original inode nor public bytes, and records zero mutation cuts. The existing exact filter intentionally ALLOWs this existing READ_ONLY_IOCTL member. The newly added unconditional attempted-mutation witness check incorrectly treated its watched descriptor as an attempted mutation. This is observer classification, not an omitted mutation syscall in the filter. The bounded correction excludes only existing READ_ONLY_IOCTL members from that early attempted-mutation check. The record() check remains mandatory for every actual recorded cut, including any unexpected dirty ioctl fallback. All existing filter omission/spoof/args/task/call negative controls remain. Add a permanent real O_RDONLY/TCGETS/ENOTTY control followed by a real file write; require query identity/bytes preservation, no invented ioctl cut, and actual same-call kernel witness on the write and its replayed cut. Add a direct dirty-fallback witness refusal control. No source19 snapshot changes, no BPF policy change, no clock/lease change, no production edits. Receipts: evidence/observer-v19-ioctl-tiny-red.json; failed first workflow archive SHA256 6baed9ef2802a9c1ffe449d13c824d23d75aafcb576bdd83b21f2fc2a2462dd8; lease archive SHA256 76bbdc653033853cbaa0c1d801419384c222dbec2e748752e71073810fdcae06. Both owned containers were removed and the VM performance lock was released between cases.

kayg commented

2026-10-20 03:34:48 +00:00

Author

Owner

Completed canonical state-directory producer correction at 69cd8a0502. Exact HEAD-plus3files gate passes fmt, all-target SSH Clippy, SSH library tests and actual producer2-case direct/Rust-wrapper gates. Original d custody survives to the newly copied inode; a/r/k/f controls unchanged; recreated original directory remains a, receipt/fixture identities preserved. Earlier RED/GREEN evidence is attached above. Activation/final-head acceptance remain pending.

atomic-state-directory.log
atomic-state-directory-source.json

Completed canonical state-directory producer correction at 69cd8a0502ef92997bb67f86149d6d0cc97e1778. Exact HEAD-plus3files gate passes fmt, all-target SSH Clippy, SSH library tests and actual producer2-case direct/Rust-wrapper gates. Original d custody survives to the newly copied inode; a/r/k/f controls unchanged; recreated original directory remains a, receipt/fixture identities preserved. Earlier RED/GREEN evidence is attached above. Activation/final-head acceptance remain pending. [atomic-state-directory.log](https://git.kayg.org/attachments/e2f3d0e7-e019-4cb9-b172-51066b92d7a5) [atomic-state-directory-source.json](https://git.kayg.org/attachments/34bc8ae2-941b-4051-a014-53f7bd9bd5bb)

kayg commented

2026-10-20 03:35:05 +00:00

Author

Owner

Completed independent retention witness at b6f1e4f9e4. Exact projected fmt/all-target SSH Clippy and3 explicit witness controls pass. Exact path/reason/newline, stdout/stderr, per-attempt reset, every descendant and private-stdin negative assertions remain unchanged from source18b. No shipping behavior or future observer family activated; installer/final-head gates remain pending.

atomic-retention-report.log
atomic-retention-report-source.json

Completed independent retention witness at b6f1e4f9e4590d27067a5c16bcd6de81efc26e28. Exact projected fmt/all-target SSH Clippy and3 explicit witness controls pass. Exact path/reason/newline, stdout/stderr, per-attempt reset, every descendant and private-stdin negative assertions remain unchanged from source18b. No shipping behavior or future observer family activated; installer/final-head gates remain pending. [atomic-retention-report.log](https://git.kayg.org/attachments/700c89f3-dde8-4b01-bb7d-2e161ecc2b22) [atomic-retention-report-source.json](https://git.kayg.org/attachments/23aadfb1-0ad1-4a73-ba28-a21c512deda3)

kayg commented

2026-10-20 03:35:58 +00:00

Author

Owner

Completed prerequisite dictionary at 727ef7b51b. Replace infrequent complete names with shared phase prefixes. Keep127 entries, the same canonical representation and exact decoded bytes. Reject widening the command budget or storing duplicate recovery programs. This is the dictionary-only prerequisite; active producer composition must independently pass its command caps. Exact projection fmt/all-target SSH Clippy/library and nonempty selected controls pass. Final active installer and branch-head acceptance remain pending.

atomic-current-dictionary.log
atomic-current-dictionary-source.json

Completed prerequisite dictionary at 727ef7b51bbebfaaa60ae535bf3d8721c46466c9. Replace infrequent complete names with shared phase prefixes. Keep127 entries, the same canonical representation and exact decoded bytes. Reject widening the command budget or storing duplicate recovery programs. This is the dictionary-only prerequisite; active producer composition must independently pass its command caps. Exact projection fmt/all-target SSH Clippy/library and nonempty selected controls pass. Final active installer and branch-head acceptance remain pending. [atomic-current-dictionary.log](https://git.kayg.org/attachments/ba641e56-8900-44ac-bd45-9b911d217592) [atomic-current-dictionary-source.json](https://git.kayg.org/attachments/4d48f0eb-1e38-4781-ae1b-33a4715a94fd)

kayg commented

2026-10-20 03:37:46 +00:00

Author

Owner

Source19 VM result: exact ignored lease control passed one actual test. The first full-witness/filtered workflow stopped fail-closed with status97 before its first mutation; zero of eight workflow axes qualify, remaining seven unrun, and full96 unexecuted. Exact source19 compiler test SHA194cac45ad2e1b6d05fece458cb3d677cfe32c4c3ba6b49ac25d0dec9db1ff71 and helper SHAa1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8. Both owned containers were removed; each case released perf.lock before copying/hashing/analyzing receipts.

The permanent ioctl regression was run before the correction: four full-mode subcases failed missing-witness while filtered counterparts passed. The correction affects only the premature attempted-mutation check for existing READ_ONLY_IOCTL queries. The actual record() witness fence is unchanged. Real failed TCGETS/ENOTTY and successful FIONREAD on O_RDONLY regular descriptors now preserve original bytes/inodes; subsequent real writes and generated write-cut replays retain actual kernel witnesses in full and filtered schedulers. An independently changed image at the read-only ioctl fallback still refuses missing evidence before recording a cut. Omitted-write and task/call/nr/arguments/spoof negative controls remain strict.

Final serialized direct verification, verbatim:

..............................................
----------------------------------------------------------------------
Ran 46 tests in 16.760s

OK
METRIC name=syscall_observer_anonymous writes=3 boundaries=7 cuts_verified=7
METRIC name=syscall_observer_prefixes writes=5 processes=5 boundaries=11 cuts_verified=11

No production/BPF/comparator/source19 snapshot edits. Source21 preparation contains only the corrected test observer and its regressions alongside separately coordinated test fixtures; all eight current workflow qualifications plus current lease qualification remain mandatory. New staging/watch scripts are prepared but explicitly disabled until the coherent source21 compiler/profile marker and exact pins arrive. Ordinary55/60, full150/155, and real lease180 are unchanged. Instrumented case times are functional harness results, not production latency. No memory acceptance claim.

Receipts:
observer-v19-current-rootless-fresh-separate-lease-receipts.tar.gz
observer-v19-current-rootless-fresh-separate-equivalence-receipts.tar.gz
observer-v19-ioctl-tiny-red.json
observer-v19-readonly-ioctl-regression-red.log
observer-v19-readonly-ioctl-final46.log
observer-v21-readonly-ioctl-ready.json

Source19 VM result: exact ignored lease control passed one actual test. The first full-witness/filtered workflow stopped fail-closed with status97 before its first mutation; zero of eight workflow axes qualify, remaining seven unrun, and full96 unexecuted. Exact source19 compiler test SHA194cac45ad2e1b6d05fece458cb3d677cfe32c4c3ba6b49ac25d0dec9db1ff71 and helper SHAa1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8. Both owned containers were removed; each case released perf.lock before copying/hashing/analyzing receipts. The permanent ioctl regression was run before the correction: four full-mode subcases failed missing-witness while filtered counterparts passed. The correction affects only the premature attempted-mutation check for existing READ_ONLY_IOCTL queries. The actual record() witness fence is unchanged. Real failed TCGETS/ENOTTY and successful FIONREAD on O_RDONLY regular descriptors now preserve original bytes/inodes; subsequent real writes and generated write-cut replays retain actual kernel witnesses in full and filtered schedulers. An independently changed image at the read-only ioctl fallback still refuses missing evidence before recording a cut. Omitted-write and task/call/nr/arguments/spoof negative controls remain strict. Final serialized direct verification, verbatim: ``` .............................................. ---------------------------------------------------------------------- Ran 46 tests in 16.760s OK METRIC name=syscall_observer_anonymous writes=3 boundaries=7 cuts_verified=7 METRIC name=syscall_observer_prefixes writes=5 processes=5 boundaries=11 cuts_verified=11 ``` No production/BPF/comparator/source19 snapshot edits. Source21 preparation contains only the corrected test observer and its regressions alongside separately coordinated test fixtures; all eight current workflow qualifications plus current lease qualification remain mandatory. New staging/watch scripts are prepared but explicitly disabled until the coherent source21 compiler/profile marker and exact pins arrive. Ordinary55/60, full150/155, and real lease180 are unchanged. Instrumented case times are functional harness results, not production latency. No memory acceptance claim. Receipts: [observer-v19-current-rootless-fresh-separate-lease-receipts.tar.gz](https://git.kayg.org/attachments/f93b2650-e573-4ea4-b61b-dfb0e7a9b2be) [observer-v19-current-rootless-fresh-separate-equivalence-receipts.tar.gz](https://git.kayg.org/attachments/a25009e7-762a-496f-b161-d1f9f06dcf88) [observer-v19-ioctl-tiny-red.json](https://git.kayg.org/attachments/5bba3767-e818-4ad5-8621-77a3bc1a9fd6) [observer-v19-readonly-ioctl-regression-red.log](https://git.kayg.org/attachments/28ad5c87-50b2-4b61-b6a2-4c61e1d90d4e) [observer-v19-readonly-ioctl-final46.log](https://git.kayg.org/attachments/41acadd8-c849-4098-ad42-a8139c025a16) [observer-v21-readonly-ioctl-ready.json](https://git.kayg.org/attachments/a5bd21cc-5231-4059-a1bd-5df65444defd)

kayg commented

2026-10-20 03:43:41 +00:00

Author

Owner

Reporting finding/proposal before code: actual source20 canonical inventory accepts132 owned nodes; editing kind triggers the real private admission refusal (71), leaves all132 nodes, and emits21,495 stderr bytes (14,103 with normal rootful prefix). This is direct producer/count admission, not fully generated-stage or real-transport proof. Real process::execute rejects >8192; Local non-Negotiated currently captures unbounded. Current reporter also traverses arbitrary independent additions before the late1024 check. Raw receipts below.

Chosen additive direction: one canonical typed whole-private-tree retention record at the fatal admission boundary, binding exact path-byte SHA256 and current directory UID/device/inode plus explicit ALL_CURRENT_DESCENDANTS semantics. This collectively reports that exact directory and all current descendants kept; it does not claim an enumerated-tree hash, original creation authority, or literal individual path output. No recursive reporting scan, path adoption, deletion, default8KiB increase or dependency addition. Nested diagnostics within this boundary are private/suppressed; one small fixed record plus a fixed public failure category replaces the unbounded transcript. Missing/non-directory roots cannot claim subtree coverage. Existing individual Left records remain valid elsewhere.

Tests retain every independent descendant held inode/type/UID/bytes assertion and all original exact-line negative controls. Collective coverage requires an explicitly known setup coordinate, exact path digest/root identity before and after refusal, no symlink referents or lexical-prefix/.. coverage, current-attempt reset, canonical bounded single record and no conflicting/duplicate scopes. It never licenses deletion. New malformed/recreated/unrelated-scope controls and fully generated-stage + real process transport RED precede producer changes. Human output uses only an allowlisted fixed explanation that the private setup directory and all its contents were kept; no raw remote diagnostic/path bytes enter public logs. All3 R3 tests remain unchanged. Final real-transport, command-cap, size and VM gates remain required. This is a reporting representation contract addition; no existing gate is relabeled green.

source20-stderr-report-producer.json
source20-stderr-report-producer.log

Reporting finding/proposal before code: actual source20 canonical inventory accepts132 owned nodes; editing kind triggers the real private admission refusal (71), leaves all132 nodes, and emits21,495 stderr bytes (14,103 with normal rootful prefix). This is direct producer/count admission, not fully generated-stage or real-transport proof. Real process::execute rejects >8192; Local non-Negotiated currently captures unbounded. Current reporter also traverses arbitrary independent additions before the late1024 check. Raw receipts below. Chosen additive direction: one canonical typed whole-private-tree retention record at the fatal admission boundary, binding exact path-byte SHA256 and current directory UID/device/inode plus explicit ALL_CURRENT_DESCENDANTS semantics. This collectively reports that exact directory and all current descendants kept; it does not claim an enumerated-tree hash, original creation authority, or literal individual path output. No recursive reporting scan, path adoption, deletion, default8KiB increase or dependency addition. Nested diagnostics within this boundary are private/suppressed; one small fixed record plus a fixed public failure category replaces the unbounded transcript. Missing/non-directory roots cannot claim subtree coverage. Existing individual Left records remain valid elsewhere. Tests retain every independent descendant held inode/type/UID/bytes assertion and all original exact-line negative controls. Collective coverage requires an explicitly known setup coordinate, exact path digest/root identity before and after refusal, no symlink referents or lexical-prefix/.. coverage, current-attempt reset, canonical bounded single record and no conflicting/duplicate scopes. It never licenses deletion. New malformed/recreated/unrelated-scope controls and fully generated-stage + real process transport RED precede producer changes. Human output uses only an allowlisted fixed explanation that the private setup directory and all its contents were kept; no raw remote diagnostic/path bytes enter public logs. All3 R3 tests remain unchanged. Final real-transport, command-cap, size and VM gates remain required. This is a reporting representation contract addition; no existing gate is relabeled green. [source20-stderr-report-producer.json](https://git.kayg.org/attachments/5aec7ed2-f6d4-4c7a-8824-e84d2d1b5c8f) [source20-stderr-report-producer.log](https://git.kayg.org/attachments/503bc68d-1ffe-4eaa-890a-553ae1ec7d89)

kayg commented

2026-10-20 03:45:10 +00:00

Author

Owner

Completed prerequisite rollback at f24414073b. Describe snapshot restoration, independent replacement refusal and private-anchor retirement from original typed records. Reentry retains the original before-image; reject pathname or equal copied bytes as fresh removal authority. This is a dormant module; activation is a separate producer-consumer change. Exact projection fmt/all-target SSH Clippy/library and nonempty selected controls pass. Final active installer and branch-head acceptance remain pending.

atomic-current-rollback.log
atomic-current-rollback-source.json

Completed prerequisite rollback at f24414073b0ef57c0ff862bdcbb83a325cdea0e8. Describe snapshot restoration, independent replacement refusal and private-anchor retirement from original typed records. Reentry retains the original before-image; reject pathname or equal copied bytes as fresh removal authority. This is a dormant module; activation is a separate producer-consumer change. Exact projection fmt/all-target SSH Clippy/library and nonempty selected controls pass. Final active installer and branch-head acceptance remain pending. [atomic-current-rollback.log](https://git.kayg.org/attachments/80714635-c7ca-4e48-af55-33aac0523368) [atomic-current-rollback-source.json](https://git.kayg.org/attachments/7ef3eaf3-c691-4817-afe5-bd98e8d45b10)

kayg commented

2026-10-20 03:45:20 +00:00

Author

Owner

Completed separate bootstrap contract documentation at d60653a27f. One-file exact projection and whitespace gate pass. Contract design was proposed on this issue before implementation; matching producer-consumer activation remains pending and no runtime acceptance is inferred from this docs gate.

atomic-bootstrap-contract.log
manifest.json

Completed separate bootstrap contract documentation at d60653a27f16944bea7f67a2ad145283e1368219. One-file exact projection and whitespace gate pass. Contract design was proposed on this issue before implementation; matching producer-consumer activation remains pending and no runtime acceptance is inferred from this docs gate. [atomic-bootstrap-contract.log](https://git.kayg.org/attachments/1725af11-9a37-4620-8143-db2df97fc85e) [manifest.json](https://git.kayg.org/attachments/1ddea594-3a6d-468a-8b50-9d09539c4140)

kayg commented

2026-10-20 03:58:49 +00:00

Author

Owner

Authorized bounded independent diagnostic: source21 remains OVERALL RED because recovery_support::cleanup_holds_runtime_lock_until_all_receipts_retire exits72 while its synthetic creator-ledger phase migration is pending. This is not an overall GREEN substitute. The same immutable source21 passed both all-target Clippy gates, unchanged command caps, Python46 and compiled observer selfcheck, report controls, manifest-state control, and corrected main/service positive tests.

Use exact compiler pins and a separate subset receipt (evidence/observer-v21-diagnostic-subset.json) to execute ONLY a fresh source21 ignored lease control followed, if it passes, by the FIRST Rootless/fresh/separate full-witness+filtered-outcome workflow. The new diagnostic driver contains no remaining-seven loop. Other seven remain UNRUN regardless of diagnostic result. Final corrected22+ HEAD must still independently qualify all eight and the exact lease case. No source19 pass is reused.

Source21 manifest804a3d9e71354b43b0a05341075eb7caf009882f07e6fa4bf6bd9f8968e6498e; compiler manifest2199d7208b6f7958d9b594ece05138935bd3dfc87e65b1ec135e9cbb5612610a; test ELF17ec5c6f7660fd823ed6c7a864174467229c14297b5090eb88137963252b90fe; helpera1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8. Production21 matches18b/19/20. No binaries/source snapshots modified.

Stopped only the original idle source21 watcher PID3559695/start73014590 through its identity-pinned pidfd, after verifying no children; no VM21 case had run. Separate diag1 scripts/staging paths preserve the failed overall gate and old watcher records. Artifact hashing/copy/staging occurs outside perf.lock. Each actual case has its own lock/ISO owner timestamp/CPUWeight10000, original55/60 ordinary+filtered and150/155 full profile, real lease180 unchanged, positive ignored test count mandatory. No production-latency/memory/full96 acceptance claim.

Authorized bounded independent diagnostic: source21 remains OVERALL RED because recovery_support::cleanup_holds_runtime_lock_until_all_receipts_retire exits72 while its synthetic creator-ledger phase migration is pending. This is not an overall GREEN substitute. The same immutable source21 passed both all-target Clippy gates, unchanged command caps, Python46 and compiled observer selfcheck, report controls, manifest-state control, and corrected main/service positive tests. Use exact compiler pins and a separate subset receipt (evidence/observer-v21-diagnostic-subset.json) to execute ONLY a fresh source21 ignored lease control followed, if it passes, by the FIRST Rootless/fresh/separate full-witness+filtered-outcome workflow. The new diagnostic driver contains no remaining-seven loop. Other seven remain UNRUN regardless of diagnostic result. Final corrected22+ HEAD must still independently qualify all eight and the exact lease case. No source19 pass is reused. Source21 manifest804a3d9e71354b43b0a05341075eb7caf009882f07e6fa4bf6bd9f8968e6498e; compiler manifest2199d7208b6f7958d9b594ece05138935bd3dfc87e65b1ec135e9cbb5612610a; test ELF17ec5c6f7660fd823ed6c7a864174467229c14297b5090eb88137963252b90fe; helpera1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8. Production21 matches18b/19/20. No binaries/source snapshots modified. Stopped only the original idle source21 watcher PID3559695/start73014590 through its identity-pinned pidfd, after verifying no children; no VM21 case had run. Separate diag1 scripts/staging paths preserve the failed overall gate and old watcher records. Artifact hashing/copy/staging occurs outside perf.lock. Each actual case has its own lock/ISO owner timestamp/CPUWeight10000, original55/60 ordinary+filtered and150/155 full profile, real lease180 unchanged, positive ignored test count mandatory. No production-latency/memory/full96 acceptance claim.

kayg commented

2026-10-20 04:04:32 +00:00

Author

Owner

Permanent generated-stage + real bounded-process RED (#231/#235): the actual old install and upgrade JOIN generated a valid 158-node private stage from 128 retained state files. Admission succeeded before the independent kind edit. Its actual refusal producer emitted 27,517 stderr bytes/status 71; process::execute returned None and The SSH output exceeded its safety limit. All 158 independently held identities/types/metadata/bytes were unchanged before the expected Some(71) regression failed. Small actual generated-stage control: 30 nodes, 6,013 bytes, status 71, 1/1 passed. Large: 0 passed / 1 intended failure; Clippy and matching artifact compiler gates passed.

Frozen source21 + only the new test and scratch declaration: source manifest SHA256 742cb95b086b72fea8352f6a134f36df44a12136784e8ff1eeafbbf4313d7269; test SHA256 487113d814d324e4d155447dea5642636c578ea07ed4ab2ef9a5c9bef18e26fb. Full helper/test ELF hashes are in the attached receipt. This qualifies only native initial whole-stage admission/refusal, with no production correction in this baseline; no global stderr, real SSH, VM timing, size, or completion claim. The bounded additive correction remains separately tracked.

retention-transport-source21-red-v3-finding.md
retention-transport-source21-red-v3-gate.log
retention-transport-source21-red-v3-results.json
retention-transport-source21-red-v3-source.json
retention-transport-source21-red-v3-test.txt

Permanent generated-stage + real bounded-process RED (#231/#235): the actual old install and upgrade JOIN generated a valid 158-node private stage from 128 retained state files. Admission succeeded before the independent kind edit. Its actual refusal producer emitted 27,517 stderr bytes/status 71; process::execute returned `None` and `The SSH output exceeded its safety limit.` All 158 independently held identities/types/metadata/bytes were unchanged before the expected `Some(71)` regression failed. Small actual generated-stage control: 30 nodes, 6,013 bytes, status 71, 1/1 passed. Large: 0 passed / 1 intended failure; Clippy and matching artifact compiler gates passed. Frozen source21 + only the new test and scratch declaration: source manifest SHA256 `742cb95b086b72fea8352f6a134f36df44a12136784e8ff1eeafbbf4313d7269`; test SHA256 `487113d814d324e4d155447dea5642636c578ea07ed4ab2ef9a5c9bef18e26fb`. Full helper/test ELF hashes are in the attached receipt. This qualifies only native initial whole-stage admission/refusal, with no production correction in this baseline; no global stderr, real SSH, VM timing, size, or completion claim. The bounded additive correction remains separately tracked. [retention-transport-source21-red-v3-finding.md](https://git.kayg.org/attachments/41cbaaa3-c924-4ddf-95e2-7115ad8e4020) [retention-transport-source21-red-v3-gate.log](https://git.kayg.org/attachments/ec6b8069-69e2-4406-a57f-3fd4478e0cb5) [retention-transport-source21-red-v3-results.json](https://git.kayg.org/attachments/4ae542b4-ce4e-47d3-9673-984f9d501021) [retention-transport-source21-red-v3-source.json](https://git.kayg.org/attachments/2bab7a49-3a11-45c0-bbc6-0e9f9fcc4c49) [retention-transport-source21-red-v3-test.txt](https://git.kayg.org/attachments/09823bcc-3760-44b4-bb85-1a94b5bdce53)

kayg commented

2026-10-20 04:06:15 +00:00

Author

Owner

Recovery fixture diagnosis and test-only correction; no production ownership relaxation.

The frozen source21 recovery_support target reported 10 passed, 1 failed, 1 ignored. cleanup_holds_runtime_lock_until_all_receipts_retire reached both original live-runtime status73 assertions, then failed the original cleanup0 assertion with status72 after its holder exited.

A pinned21 direct control separated authority stages: the old manually assembled stage contained only kind. Its original factory proof passed inventory matching0, but pure stage admission failed72 because fresh_stage_phase requires the immutable creator ledger. Missing transaction/creator records must not be adopted. The live runtime lock still correctly returned73 for inspection and rollback; after release, cleanup72 preserved its proof.

The corrected fixture runs the exact compiled STAGE_TRANSACTION prefix ending immediately before its final lease-start call, verifies real stage admission0, and captures all original flat genesis entries in the factory's completed immutable proof. The fixture's actual fd6 holder and original lock-held/status73/partial-receipt/socket/proof assertions remain unchanged. It now reaches cleanup0 and proof removal after holder exit. No schema stubs, invented creator anchors, current-path adoption or production changes are involved.

Qualified checks: exact frozen21 selected Rust test RED (cleanup72), exact corrected selected Rust test GREEN (1 passed, 0 failed, 11 filtered), plus paired pinned21 real shell/runtime-helper control. These are standalone rustc/dependency-ELF and direct-shell functional checks, not a full Cargo target or benchmark. Source22 must still execute the entire recovery_support target and normal gates.

Source SHA256: b0b3d367e7d2656d9c21148b170dc0b9a67f91a6ba7260e5c849c7a98537b769.

Direct pinned producer/lock receipt, isolated unit provenance, original unit RED, corrected unit GREEN.

Recovery fixture diagnosis and test-only correction; no production ownership relaxation. The frozen source21 recovery_support target reported 10 passed, 1 failed, 1 ignored. `cleanup_holds_runtime_lock_until_all_receipts_retire` reached both original live-runtime status73 assertions, then failed the original cleanup0 assertion with status72 after its holder exited. A pinned21 direct control separated authority stages: the old manually assembled stage contained only `kind`. Its original factory proof passed inventory matching0, but pure stage admission failed72 because `fresh_stage_phase` requires the immutable creator ledger. Missing transaction/creator records must not be adopted. The live runtime lock still correctly returned73 for inspection and rollback; after release, cleanup72 preserved its proof. The corrected fixture runs the exact compiled STAGE_TRANSACTION prefix ending immediately before its final lease-start call, verifies real stage admission0, and captures all original flat genesis entries in the factory's completed immutable proof. The fixture's actual fd6 holder and original lock-held/status73/partial-receipt/socket/proof assertions remain unchanged. It now reaches cleanup0 and proof removal after holder exit. No schema stubs, invented creator anchors, current-path adoption or production changes are involved. Qualified checks: exact frozen21 selected Rust test RED (cleanup72), exact corrected selected Rust test GREEN (1 passed, 0 failed, 11 filtered), plus paired pinned21 real shell/runtime-helper control. These are standalone rustc/dependency-ELF and direct-shell functional checks, not a full Cargo target or benchmark. Source22 must still execute the entire recovery_support target and normal gates. Source SHA256: `b0b3d367e7d2656d9c21148b170dc0b9a67f91a6ba7260e5c849c7a98537b769`. [Direct pinned producer/lock receipt](https://git.kayg.org/attachments/79812bae-fd22-43b6-9e65-e9c0323b72c8), [isolated unit provenance](https://git.kayg.org/attachments/b7e60a24-beb7-48c1-8284-009c29482453), [original unit RED](https://git.kayg.org/attachments/d569a1fd-3858-4255-9cd2-d9fe3a33a78d), [corrected unit GREEN](https://git.kayg.org/attachments/7bb912fe-5d6f-4c84-8539-9ebca6fffaaa).

kayg commented

2026-10-20 04:06:28 +00:00

Author

Owner

M12 size comparison correction; no source/profile adoption.

The first M12 CLI-package opt-level="s" artifact retained symbol tables: 24,550,048 B. Comparing it with stripped M8 was invalid. Distinct strip --strip-all copy: 19,832,168 B, SHA256 3eaae7566c32a20c17a2bccb976467c1ed4f9d0a006ef33c311f60407cbccd6f; M8 stripped: 21,327,760 B. The original artifact and failed comparison receipts remain.

M12b adds only explicit strip=true to the existing CLI package override (workspace release already requests stripping). Same static shipping recipe now produces a stripped 19,832,176 B artifact, SHA256 2e550c42d130430389f33db8fb6e26e80cb44555072cd5b1fd6d775ab8c28178: -1,495,584 B versus M8; -1,433,472 B versus task base 58760f49d; -1,393,568 B versus dev merge base c00c6364e. readelf confirms no .symtab or .debug_info. Recipe gate ends MANAGEMENT12B_EXPLICIT_STRIP_RECIPE_GREEN. This is an experimental source, not the current branch or final D243 gate.

Functional test harness corrections are separate: a current-user-only mount namespace makes system-root ancestors appear unmapped, so the immutable CLI unit ELF was replayed under the real UID/root metadata. The first outside replay inherited pin mode 0500 and failed its image-strip test; mode 0700 matches the private test artifact's required write permission. Same SHA256 throughout. Final replay: 101 passed, 0 failed, 2 ignored; the candidate graph-reading test separately passed once inside its exact source namespace. Both ignored timing measurements still need the VM. All earlier failures retained; no assertions skipped and no #118 exception claimed.

The broad CLI package profile changes hot entry wrappers. Size alone does not qualify it. Building one common pinned server test launcher next, then matched actual CLI measurements on the perf VM; existing runtime dimensions and uncovered server/removal workload gaps remain explicit.

management12b-cli-s-size.log
management12-cli-s-unit-outside-v3.log
management12-cli-s-stripped-size.json
management12-cli-s-unit-mode-correction.json

M12 size comparison correction; no source/profile adoption. The first M12 CLI-package `opt-level="s"` artifact retained symbol tables: 24,550,048 B. Comparing it with stripped M8 was invalid. Distinct `strip --strip-all` copy: 19,832,168 B, SHA256 3eaae7566c32a20c17a2bccb976467c1ed4f9d0a006ef33c311f60407cbccd6f; M8 stripped: 21,327,760 B. The original artifact and failed comparison receipts remain. M12b adds only explicit `strip=true` to the existing CLI package override (workspace release already requests stripping). Same static shipping recipe now produces a stripped 19,832,176 B artifact, SHA256 2e550c42d130430389f33db8fb6e26e80cb44555072cd5b1fd6d775ab8c28178: -1,495,584 B versus M8; -1,433,472 B versus task base 58760f49d; -1,393,568 B versus dev merge base c00c6364e. `readelf` confirms no `.symtab` or `.debug_info`. Recipe gate ends `MANAGEMENT12B_EXPLICIT_STRIP_RECIPE_GREEN`. This is an experimental source, not the current branch or final D243 gate. Functional test harness corrections are separate: a current-user-only mount namespace makes system-root ancestors appear unmapped, so the immutable CLI unit ELF was replayed under the real UID/root metadata. The first outside replay inherited pin mode 0500 and failed its image-strip test; mode 0700 matches the private test artifact's required write permission. Same SHA256 throughout. Final replay: 101 passed, 0 failed, 2 ignored; the candidate graph-reading test separately passed once inside its exact source namespace. Both ignored timing measurements still need the VM. All earlier failures retained; no assertions skipped and no #118 exception claimed. The broad CLI package profile changes hot entry wrappers. Size alone does not qualify it. Building one common pinned server test launcher next, then matched actual CLI measurements on the perf VM; existing runtime dimensions and uncovered server/removal workload gaps remain explicit. [management12b-cli-s-size.log](https://git.kayg.org/attachments/31458648-3d45-4343-980c-d11abb77edcf) [management12-cli-s-unit-outside-v3.log](https://git.kayg.org/attachments/4007bca4-93cc-40c6-83be-2aab4abc14b7) [management12-cli-s-stripped-size.json](https://git.kayg.org/attachments/dc3c089a-4a12-490d-acb7-0fd5b64c9680) [management12-cli-s-unit-mode-correction.json](https://git.kayg.org/attachments/b61b7ee8-8fdb-46e5-84d8-6c831c1ffa24)

kayg commented

2026-10-20 04:11:05 +00:00

Author

Owner

Completed parser-module step: 6da2af4f83. Adds the canonical borrowed collective-retention parser and public exports only; no producer/phase activation or remote-text exposure. Five permanent parser cases, exact numeric endpoints/overflow/canonical spelling/digest and every truncation. Exact HEAD projection: fmt GREEN; SSH all-target Clippy GREEN; library 63 passed, 0 failed, 2 ignored. Final fast/static/whole-workflow verification remains pending.

atomic-setup-tree-parser-gate.log
atomic-setup-tree-parser-source.json

Completed parser-module step: 6da2af4f83bf77f7baf22887b1b98ea32c4fdfd3. Adds the canonical borrowed collective-retention parser and public exports only; no producer/phase activation or remote-text exposure. Five permanent parser cases, exact numeric endpoints/overflow/canonical spelling/digest and every truncation. Exact HEAD projection: fmt GREEN; SSH all-target Clippy GREEN; library 63 passed, 0 failed, 2 ignored. Final fast/static/whole-workflow verification remains pending. [atomic-setup-tree-parser-gate.log](https://git.kayg.org/attachments/d499975b-cfed-4655-9e86-e2e229ba1f18) [atomic-setup-tree-parser-source.json](https://git.kayg.org/attachments/fec6ee3d-a495-4b45-a6ee-354499ef0112)

kayg commented

2026-10-20 04:13:32 +00:00

Author

Owner

Completed two separate logical steps:

bbb4622f9e: fixed local classification sentence only; remote coordinates/digest/raw bytes never serialized, mixed/partial/duplicate and SSH connection failures cannot claim retention. Fmt + all-target SSH Clippy GREEN; library63pass/0fail/2ignored; classification1pass/0fail.
002f64ad13: collective emitter only, no recursive scan. Nonfollowing current setup-directory UID/dev/inode fenced around raw-path hashing; missing/file/symlink/unrelated roots claim nothing. Fmt + shell syntax + all-target SSH Clippy GREEN; library63pass/0fail/2ignored; exact emitter1pass/0fail. Initial projected test had an extra final blank line: original fmt failure retained, corrected v2 gate passes.

Admission stderr/descriptor isolation and actual generated bounded-process GREEN remain separate pending steps; no whole-command bound or final gate claim.

atomic-setup-tree-classification-gate.log

atomic-setup-tree-emitter-gate-v2.log
atomic-setup-tree-emitter-source-v2.json

Completed two separate logical steps: - bbb4622f9e8a20786d2b07ee712633641819a872: fixed local classification sentence only; remote coordinates/digest/raw bytes never serialized, mixed/partial/duplicate and SSH connection failures cannot claim retention. Fmt + all-target SSH Clippy GREEN; library63pass/0fail/2ignored; classification1pass/0fail. - 002f64ad136b6f5e9953e90d8e806978bd2dd1ef: collective emitter only, no recursive scan. Nonfollowing current setup-directory UID/dev/inode fenced around raw-path hashing; missing/file/symlink/unrelated roots claim nothing. Fmt + shell syntax + all-target SSH Clippy GREEN; library63pass/0fail/2ignored; exact emitter1pass/0fail. Initial projected test had an extra final blank line: original fmt failure retained, corrected v2 gate passes. Admission stderr/descriptor isolation and actual generated bounded-process GREEN remain separate pending steps; no whole-command bound or final gate claim. [atomic-setup-tree-classification-gate.log](https://git.kayg.org/attachments/4d157df4-1418-448a-a4c0-f3144c406d7a) [atomic-setup-tree-emitter-gate-v2.log](https://git.kayg.org/attachments/0000f41f-54c5-4c98-99b4-256a8d8f9aa0) [atomic-setup-tree-emitter-source-v2.json](https://git.kayg.org/attachments/b1820591-0672-4b9e-8822-24183ae08280)

kayg commented

2026-10-20 04:15:15 +00:00

Author

Owner

DIAGNOSTIC21 finding: fresh exact lease control passed one actual ignored test. The first Rootless/fresh/separate full-witness workflow is RED at the unchanged150-second Install actor bound. It recorded415 actual mutation/durability cuts; filtered workflow never started and other7 axes remain UNRUN. Overall21 gate remains RED; full96 remains unexecuted. Owned containers were removed and perf.lock released before receipt inspection/copy/hashing.

Actual completed full commands before Install:0.318295s,12.062721s,3.495209s. Install actor stopped at150.000174s:26,298 owned processes;1,579,833 entry stops;1,553,535 exit stops;68,544 actual kernel filter witnesses;252 local cuts after163 earlier cuts. These are VM instrumented functional results, not production latency. No timer/lease was enlarged or normalized.

Immutable trace places the deadline after launcher publication cut414 and creation of replacing-unit flag cut415, before unit publication. Production path is ACTIVATE→publication_replace unit→publication_original/publication_authority_load, authenticating before-image and full creation_rows_emit/cl_validate. Retained owned exec controls total1279:1264 tools/awk,4 awk-wire,4 payload,4 runtime-helper,3 systemctl;163fsync and11flock controls. Last10 controlled execs are tools/awk. Exact external stat/sha/all-read syscall process families were not retained; they cannot be retrospectively invented. No same-artifact untraced whole Install VM completion measurement exists in these receipts, so the timeout alone cannot establish production slowness or quantify observer overhead.

Authorized next diagnostic: a scratch-only21 test projection (shipping source closure byte-identical21, explicit new test source+ELF pins) will exercise the same activate/complete workflow through true ordinary Local versus actual seccomp. It will retain static phase timings, outcomes/identity-graph proofs, exact source/artifact provenance and honest Linux wait4 RSS scope; no Bash DEBUG mode relabeled NONE. All original clocks/lease remain. Other7 and final22+ full8 qualification remain separate requirements.

Separate scratch-only capture-bookkeeping candidate: reuse syscall-info storage and parse validated-length fields directly, avoiding fresh ctypes buffers and repeated128-byte .raw copies on every stop. Keep every entry/exit stop, scheduler/serialization, witnesses, argument ownership, cuts and frame bounds. Add truncation/stale-tail/op/PID/args negative controls before considering any adoption. No LIVE optimization edits, mutable evidence cache, production change, or claimed saving.

Receipts:
observer-v21-diag1-current-rootless-fresh-separate-lease-receipts.tar.gz
observer-v21-diag1-current-rootless-fresh-separate-equivalence-receipts.tar.gz
observer-v21-diag1-attribution.json
observer-v21-diagnostic-subset.json
observer-v21-diag1-summary.json

DIAGNOSTIC21 finding: fresh exact lease control passed one actual ignored test. The first Rootless/fresh/separate full-witness workflow is RED at the unchanged150-second Install actor bound. It recorded415 actual mutation/durability cuts; filtered workflow never started and other7 axes remain UNRUN. Overall21 gate remains RED; full96 remains unexecuted. Owned containers were removed and perf.lock released before receipt inspection/copy/hashing. Actual completed full commands before Install:0.318295s,12.062721s,3.495209s. Install actor stopped at150.000174s:26,298 owned processes;1,579,833 entry stops;1,553,535 exit stops;68,544 actual kernel filter witnesses;252 local cuts after163 earlier cuts. These are VM instrumented functional results, not production latency. No timer/lease was enlarged or normalized. Immutable trace places the deadline after launcher publication cut414 and creation of replacing-unit flag cut415, before unit publication. Production path is ACTIVATE→publication_replace unit→publication_original/publication_authority_load, authenticating before-image and full creation_rows_emit/cl_validate. Retained owned exec controls total1279:1264 tools/awk,4 awk-wire,4 payload,4 runtime-helper,3 systemctl;163fsync and11flock controls. Last10 controlled execs are tools/awk. Exact external stat/sha/all-read syscall process families were not retained; they cannot be retrospectively invented. No same-artifact untraced whole Install VM completion measurement exists in these receipts, so the timeout alone cannot establish production slowness or quantify observer overhead. Authorized next diagnostic: a scratch-only21 test projection (shipping source closure byte-identical21, explicit new test source+ELF pins) will exercise the same activate/complete workflow through true ordinary Local versus actual seccomp. It will retain static phase timings, outcomes/identity-graph proofs, exact source/artifact provenance and honest Linux wait4 RSS scope; no Bash DEBUG mode relabeled NONE. All original clocks/lease remain. Other7 and final22+ full8 qualification remain separate requirements. Separate scratch-only capture-bookkeeping candidate: reuse syscall-info storage and parse validated-length fields directly, avoiding fresh ctypes buffers and repeated128-byte .raw copies on every stop. Keep every entry/exit stop, scheduler/serialization, witnesses, argument ownership, cuts and frame bounds. Add truncation/stale-tail/op/PID/args negative controls before considering any adoption. No LIVE optimization edits, mutable evidence cache, production change, or claimed saving. Receipts: [observer-v21-diag1-current-rootless-fresh-separate-lease-receipts.tar.gz](https://git.kayg.org/attachments/222fb549-6039-4161-b0ad-cfe13b5f3e6a) [observer-v21-diag1-current-rootless-fresh-separate-equivalence-receipts.tar.gz](https://git.kayg.org/attachments/b4fab4c3-aa89-4115-877c-a481b72abcd7) [observer-v21-diag1-attribution.json](https://git.kayg.org/attachments/282a128d-2d26-4310-b1ca-d27a9ee70867) [observer-v21-diagnostic-subset.json](https://git.kayg.org/attachments/3de555a3-68df-46da-82c3-15c5b61a99ac) [observer-v21-diag1-summary.json](https://git.kayg.org/attachments/9843ae58-d339-4963-9a29-962973a97a82)

kayg commented

2026-10-20 04:16:36 +00:00

Author

Owner

Completed admission-report step 2cb59ceef4. Existing pure-admission subshell saves stderr locally, suppresses nested diagnostics and emits one collective record on failure. Original status, caller fd5 open/closed state, fd6-9 identities/locks and both EXIT traps all retained. Exact HEAD projection: fmt, shell syntax and all-target SSH Clippy GREEN; library63 passed/0 failed/2 ignored, real-shell descriptor+emitter2 passed/0 failed. No whole retirement-worker output bound claim.

Coherent source22 first gate stopped at Clippy: new no-read-permission test used decimal0 in Permissions::from_mode. Corrected only to octal0o0, preserving the assertion and all production bytes; source22/RED log retained, immutable source23 replays the complete gate.

atomic-setup-tree-admission-gate.log
atomic-setup-tree-admission-source.json

Completed admission-report step 2cb59ceef408e4bae6cf1460f1495f9ec8c8f204. Existing pure-admission subshell saves stderr locally, suppresses nested diagnostics and emits one collective record on failure. Original status, caller fd5 open/closed state, fd6-9 identities/locks and both EXIT traps all retained. Exact HEAD projection: fmt, shell syntax and all-target SSH Clippy GREEN; library63 passed/0 failed/2 ignored, real-shell descriptor+emitter2 passed/0 failed. No whole retirement-worker output bound claim. Coherent source22 first gate stopped at Clippy: new no-read-permission test used decimal0 in Permissions::from_mode. Corrected only to octal0o0, preserving the assertion and all production bytes; source22/RED log retained, immutable source23 replays the complete gate. [atomic-setup-tree-admission-gate.log](https://git.kayg.org/attachments/075d28a5-5b68-4848-92ba-caf436846547) [atomic-setup-tree-admission-source.json](https://git.kayg.org/attachments/fb03b0b0-c563-4a5b-bc6c-b0706ac4ef6d)

kayg commented

2026-10-20 04:21:47 +00:00

Author

Owner

Finding in the new stderr-isolation step: a retained non-directory .bootstrap-lock cannot emit the directory-only collective frame, so suppression swallowed its original exact point report. Direct actual-shell RED: status71, stderr0B, original UID/dev/inode/mode and bytes unchanged. This is reporting loss, not deletion.

Added a permanent regular-file/symlink control requiring an exact point report, no subtree claim, unchanged node identity/bytes and untouched independent referent. Candidate fallback captures only the bounded directory record; otherwise reports the exact retained setup node. Direct GREEN: both node types status71,179B point report, all identity/byte checks pass. Separate exact-HEAD permanent Rust RED/GREEN+Clippy gate queued; coherent23 does not include this subsequent correction. No missing/symlink root gains descendant coverage.

non-directory-retention-red.json
non-directory-retention-green.json

Finding in the new stderr-isolation step: a retained non-directory `.bootstrap-lock` cannot emit the directory-only collective frame, so suppression swallowed its original exact point report. Direct actual-shell RED: status71, stderr0B, original UID/dev/inode/mode and bytes unchanged. This is reporting loss, not deletion. Added a permanent regular-file/symlink control requiring an exact point report, no subtree claim, unchanged node identity/bytes and untouched independent referent. Candidate fallback captures only the bounded directory record; otherwise reports the exact retained setup node. Direct GREEN: both node types status71,179B point report, all identity/byte checks pass. Separate exact-HEAD permanent Rust RED/GREEN+Clippy gate queued; coherent23 does not include this subsequent correction. No missing/symlink root gains descendant coverage. [non-directory-retention-red.json](https://git.kayg.org/attachments/62cb7466-e883-40d4-b7d2-1128b337ee74) [non-directory-retention-green.json](https://git.kayg.org/attachments/7296fa4f-5b07-44ee-ac80-4e93ae658aaa)

kayg commented

2026-10-20 04:23:47 +00:00

Author

Owner

Actual shipping-CLI qualification stopped on a baseline functional failure; no M12b regression or performance acceptance claim.

The immutable pair was staged and fully hashed outside the perf lock: M8 SHA 647ff9ec136166391f0bdf42fd093ab6d72798533208820c6713323f386a5214 (21,327,760B), M12b SHA 2e550c42d130430389f33db8fb6e26e80cb44555072cd5b1fd6d775ab8c28178 (19,832,176B). All1,883 source files match except the CLI package {opt-level="s",strip=true} Cargo profile. The common release server harness is unchanged SHA 70d883d9ced1e77de5a2876eb0452b8d35169c15d6d148174345863062a8692f; its explicit loader/provider closure and frozen driver sources are pinned. Four primary selectors enumerated exactly once in the isolated rootless namespace.

On the perf VM (4CPUs, MemTotal8,069,112KiB), the first unchanged M8 remote_cli_enrollment_and_browser_terminal_two_processes case failed before any benchmark metric. Two diagnostic-only repetitions retained no private argv/input/output: the actual shipping CLI launched, joined identity.json appeared, no runtime socket appeared, and canonical supervisor output reported Some(NotFound) retries. The existing ten-second host-registration assertion failed at frozen remote_demo_tests.rs:360. No assertion or timeout was changed.

The independent existing task-base58760 shipping artifact SHA e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f (21,265,648B) failed the SAME unchanged fixture and assertion with the SAME canonical NotFound retries. Four relevant source slices are byte-identical between task base and M8: runtime acquire_owned/acquire_bound, CLI remote::run, Service::start_retained/runtime acquisition, and the fixture CLI invocation.

Source causality: the fixture passes agent --data <owned Directory/data> --state <owned Directory/s> join <public local URL>, and never creates Directory/.bootstrap-owner. Both task-base and M8 treat explicit state as an installation Context; acquire_owned then requires that existing host marker before starting runtime sockets. This identifies a preexisting custom-state/managed-provenance contract issue, not a new M12b effect. The documented operator/test agent-join contract and hidden --state semantics still need resolution. No runtime observer manufactured a marker, no fixture/production source was changed, and no second build was performed.

Qualification accounting: 0/56 primary cases completed successfully; M12b has not run; the remaining dimensions are unrun. The first regular M8 attempt and diagnostics are not substituted for the required matched cases. No latency/throughput/idle/RSS comparison is available. All recorded process births are gone, owned disk-backed fixture state is empty, and each shared lock/owner was released. The sequence remains held for contract diagnosis. Existing full-server traffic and whole-tree memory gaps remain.

Proposed next step (scratch common-driver fixture only, not executed): explicitly label these as managed remote CLI benchmarks. Publish the known public host marker once with create_new/owned600 checks in the original private700 fixture, before the first CLI launch and before its existing measurement timestamp. Restarts must assert and reuse the original marker without repair. Renewal setup already knows its original host. Preserve every workload/deadline/assertion and add existing-marker negative controls; keep the missing-marker VM RED. Both shipping CLI artifacts remain unchanged. This does not qualify the generic no-state operator path or installer performance. Parent owns the single rebuilt common-driver gate.

management12b-actual-cli-stage.json
management12b-cli-two-process-diagnostic2.log
management12b-cli-two-process-diagnostic2-receipt.json
management12b-taskbase-source-comparison.json
management12b-cli-taskbase-diagnostic.log
management12b-cli-taskbase-diagnostic-receipt.json
management12b-failed-baseline-cleanup.json

Actual shipping-CLI qualification stopped on a baseline functional failure; no M12b regression or performance acceptance claim. The immutable pair was staged and fully hashed outside the perf lock: M8 SHA `647ff9ec136166391f0bdf42fd093ab6d72798533208820c6713323f386a5214` (21,327,760B), M12b SHA `2e550c42d130430389f33db8fb6e26e80cb44555072cd5b1fd6d775ab8c28178` (19,832,176B). All1,883 source files match except the CLI package `{opt-level="s",strip=true}` Cargo profile. The common release server harness is unchanged SHA `70d883d9ced1e77de5a2876eb0452b8d35169c15d6d148174345863062a8692f`; its explicit loader/provider closure and frozen driver sources are pinned. Four primary selectors enumerated exactly once in the isolated rootless namespace. On the perf VM (4CPUs, MemTotal8,069,112KiB), the first unchanged M8 `remote_cli_enrollment_and_browser_terminal_two_processes` case failed before any benchmark metric. Two diagnostic-only repetitions retained no private argv/input/output: the actual shipping CLI launched, joined identity.json appeared, no runtime socket appeared, and canonical supervisor output reported `Some(NotFound)` retries. The existing ten-second host-registration assertion failed at frozen remote_demo_tests.rs:360. No assertion or timeout was changed. The independent existing task-base58760 shipping artifact SHA `e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f` (21,265,648B) failed the SAME unchanged fixture and assertion with the SAME canonical NotFound retries. Four relevant source slices are byte-identical between task base and M8: runtime acquire_owned/acquire_bound, CLI remote::run, Service::start_retained/runtime acquisition, and the fixture CLI invocation. Source causality: the fixture passes `agent --data <owned Directory/data> --state <owned Directory/s> join <public local URL>`, and never creates Directory/.bootstrap-owner. Both task-base and M8 treat explicit state as an installation Context; acquire_owned then requires that existing host marker before starting runtime sockets. This identifies a preexisting custom-state/managed-provenance contract issue, not a new M12b effect. The documented operator/test agent-join contract and hidden --state semantics still need resolution. No runtime observer manufactured a marker, no fixture/production source was changed, and no second build was performed. Qualification accounting: **0/56 primary cases completed successfully; M12b has not run; the remaining dimensions are unrun.** The first regular M8 attempt and diagnostics are not substituted for the required matched cases. No latency/throughput/idle/RSS comparison is available. All recorded process births are gone, owned disk-backed fixture state is empty, and each shared lock/owner was released. The sequence remains held for contract diagnosis. Existing full-server traffic and whole-tree memory gaps remain. Proposed next step (scratch common-driver fixture only, not executed): explicitly label these as managed remote CLI benchmarks. Publish the known public host marker once with create_new/owned600 checks in the original private700 fixture, before the first CLI launch and before its existing measurement timestamp. Restarts must assert and reuse the original marker without repair. Renewal setup already knows its original host. Preserve every workload/deadline/assertion and add existing-marker negative controls; keep the missing-marker VM RED. Both shipping CLI artifacts remain unchanged. This does not qualify the generic no-state operator path or installer performance. Parent owns the single rebuilt common-driver gate. [management12b-actual-cli-stage.json](https://git.kayg.org/attachments/7849c028-d041-4e69-ac31-3f60683a16df) [management12b-cli-two-process-diagnostic2.log](https://git.kayg.org/attachments/310ca982-0478-4a75-9d9d-618052b60f06) [management12b-cli-two-process-diagnostic2-receipt.json](https://git.kayg.org/attachments/15ea41c1-d9fa-49b5-a6d0-03ab9c22a77e) [management12b-taskbase-source-comparison.json](https://git.kayg.org/attachments/e4e09581-7eb7-4f87-b64e-a3854b738d6d) [management12b-cli-taskbase-diagnostic.log](https://git.kayg.org/attachments/265e968f-ae02-41b7-b2c3-85f4dadac723) [management12b-cli-taskbase-diagnostic-receipt.json](https://git.kayg.org/attachments/05ba6288-d012-437b-9f4b-6628ea5643a0) [management12b-failed-baseline-cleanup.json](https://git.kayg.org/attachments/a43cd304-4533-4ecd-be6a-f943c78196e1)

kayg commented

2026-10-20 04:25:02 +00:00

Author

Owner

Coherent source23 compile/profile gate GREEN (not final HEAD/fast/exhaustive coverage). Source manifest 6e48eedea25d33632b198d3278a6089de2251590f3f75b9529cf595c37ac95e0; compiler-reported installer test SHA b8801640681fff63b7d9b890e89dcb3f3b06afaee6f34f31663b0f55ca794634; helper SHA 039f84051183f317a74d95da35b5080d7c376ebb0d95487a5fbb1f72e1970ecb.

Both SSH and remote all-target Clippy + fmt/shell syntax GREEN. Command caps GREEN both modes (largest Root command130303B). Python observer46, compiled observer selfcheck1, retention matcher16, actual bounded-process transport2, emitter/descriptor2, classifier1, manifest wrapper1/direct2, transaction-open cleanup1, service-flag1, library69/0/2ignored, creator ledger1/0/1ignored, shell wrapper1, recovery support11/0/1ignored. The ignored cases remain separate required slice gates where applicable; no Docker case was relabeled passed.

Actual fully generated upgrade regression now GREEN: successful pure admission before independent edit, all158 held private nodes checked unchanged, transcript138B and real bounded transport preserves status71. Previous exact-source RED:27517B and lost statusNone. Small control30nodes also138B/Some71. Host durations are functional receipts only, not performance evidence.

Final marker, verbatim:

RECOVERY_V23_WITNESS_COMPILE_PROFILE_GREEN

The subsequently found retained non-directory point-report fallback is NOT in immutable23; its own permanent RED/GREEN gate is running. Retirement-worker reporting and full interruption-product execution remain open. No push, deployment or final gate claim.

recovery-v23.log
recovery-v23-retention-transport.log
recovery-v23-retention-report.log
manifest.json

Coherent source23 compile/profile gate GREEN (not final HEAD/fast/exhaustive coverage). Source manifest 6e48eedea25d33632b198d3278a6089de2251590f3f75b9529cf595c37ac95e0; compiler-reported installer test SHA b8801640681fff63b7d9b890e89dcb3f3b06afaee6f34f31663b0f55ca794634; helper SHA 039f84051183f317a74d95da35b5080d7c376ebb0d95487a5fbb1f72e1970ecb. Both SSH and remote all-target Clippy + fmt/shell syntax GREEN. Command caps GREEN both modes (largest Root command130303B). Python observer46, compiled observer selfcheck1, retention matcher16, actual bounded-process transport2, emitter/descriptor2, classifier1, manifest wrapper1/direct2, transaction-open cleanup1, service-flag1, library69/0/2ignored, creator ledger1/0/1ignored, shell wrapper1, recovery support11/0/1ignored. The ignored cases remain separate required slice gates where applicable; no Docker case was relabeled passed. Actual fully generated upgrade regression now GREEN: successful pure admission before independent edit, all158 held private nodes checked unchanged, transcript138B and real bounded transport preserves status71. Previous exact-source RED:27517B and lost statusNone. Small control30nodes also138B/Some71. Host durations are functional receipts only, not performance evidence. Final marker, verbatim: ``` RECOVERY_V23_WITNESS_COMPILE_PROFILE_GREEN ``` The subsequently found retained non-directory point-report fallback is NOT in immutable23; its own permanent RED/GREEN gate is running. Retirement-worker reporting and full interruption-product execution remain open. No push, deployment or final gate claim. [recovery-v23.log](https://git.kayg.org/attachments/dca527d9-177b-4c07-92c3-a6017d1e6524) [recovery-v23-retention-transport.log](https://git.kayg.org/attachments/cbfb2a82-fdd3-476a-91a4-b9f664202def) [recovery-v23-retention-report.log](https://git.kayg.org/attachments/698cfd77-ceb8-4674-a7e8-ac597bbff020) [manifest.json](https://git.kayg.org/attachments/0bf03e67-c831-484a-ac6a-00fac65b0d15)

kayg commented

2026-10-20 04:33:49 +00:00

Author

Owner

Scratch-only diagnostic21 projection is compiled and pinned. All shipping source/features remain byte-identical immutable21 (base manifest804a3d9e71354b43b0a05341075eb7caf009882f07e6fa4bf6bd9f8968e6498e). New test source only adds true ordinary Local versus actual seccomp workflow measurement, and separately selectable original versus reusable syscall-info-buffer full observers. Each arm keeps the same activate/complete producer, existing clocks and lease180. Final identity/manifest checks happen after producer timing. No whole-head/eight-way qualification claim; original overall21 remains RED.

New source manifest275d4c46e077125bb978275693d397294a85b41dd2c95b62229c87e6d16f87c3. Compiler pin manifest e64d17ced01c2a843e23167e5a0229e4778e2ecf041269336d85ca159a24c288; new testELF0bf2ec7306e507b19ae4a85a77327f49d0be59ce6a24cbfed8071eafa7e01f61. Existing immutable21 helpera1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8 is reused through verified unchanged shipping closure, not claimed newly compiled. fmt, install-target Clippy and test --no-run passed; no ignored workflow/benchmark ran on the build host.

The scratch buffer candidate avoids allocating/copying a128-byte syscall-info frame at every stop. It reuses per-Observer storage but returns independent owned scalar/argument tuples, validates common/op-specific returned lengths before any tail access, and changes no scheduling, stops, witnesses, cuts, paths, filesystem evidence or clocks. Actual kernel truncation control was RED on original (returned bytecount deliberately0 after real GETINFO fill; actor mutation continued) and GREEN on candidate (refused before mutation). Four ABI/truncation/stale-tail/PID/op/argument-ownership controls plus all46 original controls pass. No measured saving or adoption yet.

Preserved failed attempts: v1 diagnostic projection failed two test-only Clippy style checks; first standalone46 replay lacked two exact source fixture dependencies (other44+new4 passed). New immutable v2 and corrected controls2 replay pass; original failed receipts are retained, never relabeled.

VM staging/copy/provider verification occurs outside perf.lock. Each actual case uses its own lock, CPUWeight10000 and original bounds. Static seven command labels and wholeflow time are recorded only on VM. wait4 maxRSS is the largest individual waited descendant maximum, not whole-tree RSS, a summed bound, or per-host/session memory. Untraced process count remains unmeasured; actual seccomp process statistics remain separately scoped. VM results pending.

Scratch-only diagnostic21 projection is compiled and pinned. All shipping source/features remain byte-identical immutable21 (base manifest804a3d9e71354b43b0a05341075eb7caf009882f07e6fa4bf6bd9f8968e6498e). New test source only adds true ordinary Local versus actual seccomp workflow measurement, and separately selectable original versus reusable syscall-info-buffer full observers. Each arm keeps the same activate/complete producer, existing clocks and lease180. Final identity/manifest checks happen after producer timing. No whole-head/eight-way qualification claim; original overall21 remains RED. New source manifest275d4c46e077125bb978275693d397294a85b41dd2c95b62229c87e6d16f87c3. Compiler pin manifest e64d17ced01c2a843e23167e5a0229e4778e2ecf041269336d85ca159a24c288; new testELF0bf2ec7306e507b19ae4a85a77327f49d0be59ce6a24cbfed8071eafa7e01f61. Existing immutable21 helpera1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8 is reused through verified unchanged shipping closure, not claimed newly compiled. fmt, install-target Clippy and test --no-run passed; no ignored workflow/benchmark ran on the build host. The scratch buffer candidate avoids allocating/copying a128-byte syscall-info frame at every stop. It reuses per-Observer storage but returns independent owned scalar/argument tuples, validates common/op-specific returned lengths before any tail access, and changes no scheduling, stops, witnesses, cuts, paths, filesystem evidence or clocks. Actual kernel truncation control was RED on original (returned bytecount deliberately0 after real GETINFO fill; actor mutation continued) and GREEN on candidate (refused before mutation). Four ABI/truncation/stale-tail/PID/op/argument-ownership controls plus all46 original controls pass. No measured saving or adoption yet. Preserved failed attempts: v1 diagnostic projection failed two test-only Clippy style checks; first standalone46 replay lacked two exact source fixture dependencies (other44+new4 passed). New immutable v2 and corrected controls2 replay pass; original failed receipts are retained, never relabeled. VM staging/copy/provider verification occurs outside perf.lock. Each actual case uses its own lock, CPUWeight10000 and original bounds. Static seven command labels and wholeflow time are recorded only on VM. wait4 maxRSS is the largest individual waited descendant maximum, not whole-tree RSS, a summed bound, or per-host/session memory. Untraced process count remains unmeasured; actual seccomp process statistics remain separately scoped. VM results pending.

kayg commented

2026-10-20 04:37:41 +00:00

Author

Owner

Completed separate commits:

917ab70680: preserve exact point reports for retained non-directory setup nodes without claiming descendant coverage. Permanent real-shell test RED on exact HEAD missing-report assertion, then GREEN with original UID/dev/inode/mode/bytes and referent unchanged. Fmt/syntax/all-target SSH Clippy GREEN; library63/0/2ignored and reporting3/0/0.
204c11736d: additive bounded-directory reporting contract, documentation only; original surrounding contract bytes preserved and whitespace check GREEN.
f08bdca0be: independent held-root reporting witness; original three controls remain byte-identical. Exact HEAD projection fmt/all-target SSH Clippy GREEN and16report tests GREEN. Root recreation/current identity, component/symlink boundaries, stdout/malformed/duplicate/earlier-attempt frames and absent descendants fail closed.

No push/deployment or final fast gate. Full retirement-worker reporting remains open: exact23 actual post-admission controls reproduce missing second-leaf reporting and multi-batch output overflow; separate design/catalog correction underway.

atomic-setup-node-report-gate-v2.log
atomic-setup-node-report-red-v2.log
atomic-retention-scope-gate.log
bounded-retention-contract-gate.json

Completed separate commits: - 917ab70680a8b8e669c23aac2754747f6fd22762: preserve exact point reports for retained non-directory setup nodes without claiming descendant coverage. Permanent real-shell test RED on exact HEAD missing-report assertion, then GREEN with original UID/dev/inode/mode/bytes and referent unchanged. Fmt/syntax/all-target SSH Clippy GREEN; library63/0/2ignored and reporting3/0/0. - 204c11736d20c97236ca1512fa4c0aea8ed4c0dc: additive bounded-directory reporting contract, documentation only; original surrounding contract bytes preserved and whitespace check GREEN. - f08bdca0be24438ad257569bce72a0ed8d3e0dd2: independent held-root reporting witness; original three controls remain byte-identical. Exact HEAD projection fmt/all-target SSH Clippy GREEN and16report tests GREEN. Root recreation/current identity, component/symlink boundaries, stdout/malformed/duplicate/earlier-attempt frames and absent descendants fail closed. No push/deployment or final fast gate. Full retirement-worker reporting remains open: exact23 actual post-admission controls reproduce missing second-leaf reporting and multi-batch output overflow; separate design/catalog correction underway. [atomic-setup-node-report-gate-v2.log](https://git.kayg.org/attachments/cc5ec3f9-27ab-4a01-9fad-6672e72f9126) [atomic-setup-node-report-red-v2.log](https://git.kayg.org/attachments/cc3e3d20-1190-4491-8ef4-a15635569a56) [atomic-retention-scope-gate.log](https://git.kayg.org/attachments/8dfd99db-7409-4de7-b036-d34eac3f0b21) [bounded-retention-contract-gate.json](https://git.kayg.org/attachments/ff0d884f-424d-4c55-a969-22e194ca0d72)

kayg commented

2026-10-20 04:39:32 +00:00

Author

Owner

The new diagnostic21 VM projection is RED, with raw receipts retained. No current-head/eight-way qualification or paired performance/RSS result is accepted.

The actual unchanged shipping21 producer completed all seven commands in every saved record: untraced Local wholeflow24.539/24.630s, Install18.227/18.269s; seccomp wholeflow55.691/55.725s, Install40.813/40.554s. Each seccomp Install reports26299 actual processes/253 local cuts, and all seven command statistics finished. These are preliminary static phase records only, not a planned matched experiment: my new wrapper was named resource.py, shadowing Python's standard resource module during os.wait4 and accidentally reexecuting the module/test once before failing AttributeError. No usable RSS or whole-pair outcome result was produced. Both owned containers were removed and perf.lock released. Correction is a new wrapper filename and explicit main guard, not a deadline/lease change.

Independent final-graph refusal is also reproducible from each captured completed image: OutcomeComparison.prepare expects SHA256(readlink bytes) for manifest l rows. The existing writer intentionally records '-' for d/l and hashes only regular f/r files (manifest_authority.sh::manifest_row); actual source21 l UID/device/inode/type all match. First rejected role is bin/current. This is a test oracle contract error, not a shipping manifest failure. A scratch-only proposal requires literal '-' on l, keeps exact l UID/device/inode/type checks, and independently constrains all three native entrypoint target bytes from the matching public unit's host/base/mode/enablement coordinates. Actual selfgraph changes RED to GREEN26nodes; changed target, inode, type or non-'-' spelling remain rejected. Parent review is pending; no LIVE comparator edit/adoption.

Immutable raw archives: NONE45cc11d4359d3b8fab78fc6273a8f8c40ec8f67d66f94d594587701e69df25d9; seccompf539d6f5dae573570af01626c15cdf9f00ff6990759369cad90775c763940424. New source v2 manifest275d4c46e077125bb978275693d397294a85b41dd2c95b62229c87e6d16f87c3, testELF0bf2ec7306e507b19ae4a85a77327f49d0be59ce6a24cbfed8071eafa7e01f61. Helper source/producer stayed immutable21: originala1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8, launch-only interpreter/RUNPATH relocated0474051e5ffbe4494b0cc1d4943b177a280924bb81920646a6027d60a8e1eb1d; no strip or source change. Other seven workflow axes and full96 product remain UNRUN.

The new diagnostic21 VM projection is RED, with raw receipts retained. No current-head/eight-way qualification or paired performance/RSS result is accepted. The actual unchanged shipping21 producer completed all seven commands in every saved record: untraced Local wholeflow24.539/24.630s, Install18.227/18.269s; seccomp wholeflow55.691/55.725s, Install40.813/40.554s. Each seccomp Install reports26299 actual processes/253 local cuts, and all seven command statistics finished. These are preliminary static phase records only, not a planned matched experiment: my new wrapper was named resource.py, shadowing Python's standard resource module during os.wait4 and accidentally reexecuting the module/test once before failing AttributeError. No usable RSS or whole-pair outcome result was produced. Both owned containers were removed and perf.lock released. Correction is a new wrapper filename and explicit main guard, not a deadline/lease change. Independent final-graph refusal is also reproducible from each captured completed image: OutcomeComparison.prepare expects SHA256(readlink bytes) for manifest l rows. The existing writer intentionally records '-' for d/l and hashes only regular f/r files (manifest_authority.sh::manifest_row); actual source21 l UID/device/inode/type all match. First rejected role is bin/current. This is a test oracle contract error, not a shipping manifest failure. A scratch-only proposal requires literal '-' on l, keeps exact l UID/device/inode/type checks, and independently constrains all three native entrypoint target bytes from the matching public unit's host/base/mode/enablement coordinates. Actual selfgraph changes RED to GREEN26nodes; changed target, inode, type or non-'-' spelling remain rejected. Parent review is pending; no LIVE comparator edit/adoption. Immutable raw archives: NONE45cc11d4359d3b8fab78fc6273a8f8c40ec8f67d66f94d594587701e69df25d9; seccompf539d6f5dae573570af01626c15cdf9f00ff6990759369cad90775c763940424. New source v2 manifest275d4c46e077125bb978275693d397294a85b41dd2c95b62229c87e6d16f87c3, testELF0bf2ec7306e507b19ae4a85a77327f49d0be59ce6a24cbfed8071eafa7e01f61. Helper source/producer stayed immutable21: originala1ed805e1aececb94f8af9cb07f2f44916a22133ed0fb1869cd9a87703086ce8, launch-only interpreter/RUNPATH relocated0474051e5ffbe4494b0cc1d4943b177a280924bb81920646a6027d60a8e1eb1d; no strip or source change. Other seven workflow axes and full96 product remain UNRUN.

kayg commented

2026-10-20 04:41:59 +00:00

Author

Owner

Qualified post-admission installer cleanup REDs against exact source23, with genuine generated-stage admission/proof and actual bounded process + native rollback retry:

Small:32 pinned nodes,2 independently edited retained leaves,1 worker batch,157-byte report/status72. Both real attempts preserve all32 nodes and returnSome(72), but report only one changed leaf; the second has no current exact report on either attempt.
Long:87 pinned generated nodes,40 edited leaves with4080-byte paths,2 batches. Actual producer emits8266 bytes/status72; the8192-byte transport rejects it. Both real attempts returnNone with original process error The SSH output exceeded its safety limit. All87 held identities/types/modes/link-counts/bytes remain unchanged after every pass.

Exact selection:0passed/2intended failures/0skipped; both intended assertions were reached. Clippy/compiler gates passed. No source23 or LIVE production change. No real SSH, VM timing, final size, global reporting, or completion claim. The scratch regression source remains available unchanged for a later logical test slice.

Source manifest 3d9a34a10441ff2ac9429cc231a75ac971215d7ef1af5633a5ecb259811dc4e2; test ELF ebbe013de4bc06513d24080d45bde4dbdd410e57f943887c9a68674294b13d1e; exact source23 helper 039f84051183f317a74d95da35b5080d7c376ebb0d95487a5fbb1f72e1970ecb. Full provenance and raw producer bytes are attached. A bounded structured-report catalog is being drafted separately for review before implementation.

worker-retention-source23-red-v2-finding.md
worker-retention-source23-red-v2-gate.log
worker-retention-source23-small-producer.txt
worker-retention-source23-long-producer.txt
worker-retention-source23-red-v2-results.json
worker-retention-source23-red-v2-test.txt

Qualified post-admission installer cleanup REDs against exact source23, with genuine generated-stage admission/proof and actual bounded process + native rollback retry: - Small:32 pinned nodes,2 independently edited retained leaves,1 worker batch,157-byte report/status72. Both real attempts preserve all32 nodes and returnSome(72), but report only one changed leaf; the second has no current exact report on either attempt. - Long:87 pinned generated nodes,40 edited leaves with4080-byte paths,2 batches. Actual producer emits8266 bytes/status72; the8192-byte transport rejects it. Both real attempts returnNone with original process error `The SSH output exceeded its safety limit.` All87 held identities/types/modes/link-counts/bytes remain unchanged after every pass. Exact selection:0passed/2intended failures/0skipped; both intended assertions were reached. Clippy/compiler gates passed. No source23 or LIVE production change. No real SSH, VM timing, final size, global reporting, or completion claim. The scratch regression source remains available unchanged for a later logical test slice. Source manifest `3d9a34a10441ff2ac9429cc231a75ac971215d7ef1af5633a5ecb259811dc4e2`; test ELF `ebbe013de4bc06513d24080d45bde4dbdd410e57f943887c9a68674294b13d1e`; exact source23 helper `039f84051183f317a74d95da35b5080d7c376ebb0d95487a5fbb1f72e1970ecb`. Full provenance and raw producer bytes are attached. A bounded structured-report catalog is being drafted separately for review before implementation. [worker-retention-source23-red-v2-finding.md](https://git.kayg.org/attachments/4731373e-564a-45be-8897-2170981185a5) [worker-retention-source23-red-v2-gate.log](https://git.kayg.org/attachments/f01e72db-7cc4-4d6a-b16f-b7cd34dde95b) [worker-retention-source23-small-producer.txt](https://git.kayg.org/attachments/704cbc79-9b13-4cc4-9cc9-a690afead239) [worker-retention-source23-long-producer.txt](https://git.kayg.org/attachments/fe8e56f6-8e34-4f92-a5fc-1e7627a6c13e) [worker-retention-source23-red-v2-results.json](https://git.kayg.org/attachments/032bef16-ceb5-4652-82d1-e9b0a5991c9b) [worker-retention-source23-red-v2-test.txt](https://git.kayg.org/attachments/a8663bce-e15e-4f8f-82a6-afb308d12b14)

kayg commented

2026-10-20 04:44:26 +00:00

Author

Owner

Managed actual-CLI experiment fixture is now compiler-pinned. This is a scratch-only managed installation context, not generic no-state join or installer performance. The known public original host marker is published once by the fixture before first CLI launch; create_new, original held inode, current UID/mode/link count and exact host bytes remain mandatory on every restart. No CLI/runtime source or either shipping artifact changed.

The new helper formatting check and selected server lib/tests strict Clippy passed (--no-deps). Three permanent scratch helper controls passed, including no-overwrite and changed/recreated-marker refusal. All four primary selectors enumerate exactly once. The initial broad dependency lint failure is retained separately; no dependency source was changed.

Common driver: 33,248,712 bytes, SHA256 ecc49eb2b825410559dfc5739aa39f7e2956a26e818cfbff15cafb1b7f7fbe84. Original common driver70d883d9 remains the missing-marker negative control. Approved four-file fixture patch67d47fc27ce0e7745c272cb50e94c394d1f2f6833ea678a43de807e8779d67d6.

Fresh VM bundle SHA256227dea43e122411730caf503c365ca1f3e483a0eb86450b56b734ea3d79c4a4f passed all-file/provider hashing and four exact-selector preflights outside the benchmark lock. The 56-case ABBA/BAAB run is starting from zero; prior failures/diagnostics are excluded. No timing/profile adoption claim follows from these functional controls. Every measurement uses the VM lock and CPUWeight10000; each case releases its lock. Actual server/shim scheduling will be checked before the idle windows.

management12b-managed-common-server-artifact.json
management12b-managed-fixture-ready.json
management12b-managed-fixture-controls.log
management12b-managed-common-server-gate-v2.log

Managed actual-CLI experiment fixture is now compiler-pinned. This is a scratch-only managed installation context, not generic no-state join or installer performance. The known public original host marker is published once by the fixture before first CLI launch; create_new, original held inode, current UID/mode/link count and exact host bytes remain mandatory on every restart. No CLI/runtime source or either shipping artifact changed. The new helper formatting check and selected server lib/tests strict Clippy passed (--no-deps). Three permanent scratch helper controls passed, including no-overwrite and changed/recreated-marker refusal. All four primary selectors enumerate exactly once. The initial broad dependency lint failure is retained separately; no dependency source was changed. Common driver: 33,248,712 bytes, SHA256 ecc49eb2b825410559dfc5739aa39f7e2956a26e818cfbff15cafb1b7f7fbe84. Original common driver70d883d9 remains the missing-marker negative control. Approved four-file fixture patch67d47fc27ce0e7745c272cb50e94c394d1f2f6833ea678a43de807e8779d67d6. Fresh VM bundle SHA256227dea43e122411730caf503c365ca1f3e483a0eb86450b56b734ea3d79c4a4f passed all-file/provider hashing and four exact-selector preflights outside the benchmark lock. The 56-case ABBA/BAAB run is starting from zero; prior failures/diagnostics are excluded. No timing/profile adoption claim follows from these functional controls. Every measurement uses the VM lock and CPUWeight10000; each case releases its lock. Actual server/shim scheduling will be checked before the idle windows. [management12b-managed-common-server-artifact.json](https://git.kayg.org/attachments/f584dc1a-88df-47c3-aa87-c97a81c1fdb8) [management12b-managed-fixture-ready.json](https://git.kayg.org/attachments/50d4790e-7efa-400a-98bd-9b2a1b967675) [management12b-managed-fixture-controls.log](https://git.kayg.org/attachments/baa9354f-9a56-42a0-b5a7-8a0cae14686e) [management12b-managed-common-server-gate-v2.log](https://git.kayg.org/attachments/e3adf0c2-0163-42fa-9a11-4d8dae2d9c84)

kayg commented

2026-10-20 04:53:06 +00:00

Author

Owner

Corrected scratch diagnostic21 pair is GREEN: one actual test execution each under true untraced Local and actual seccomp, all seven producer commands completed, exact three native l rows required, final26-node identity graphs matched with two reconstructed receipts and no ignored content. This is a newly compiled diagnostic-only testELF over unchanged immutable21 shipping closure; source21 overall remains RED, current source23/eight-way qualification and full96 product remain UNRUN. No deadline/lease changes.

VM observations (one diagnostic pair, not median/p95 or capacity acceptance): untraced wholeflow24.845600306s, Install18.554907229s; seccomp wholeflow56.046381508s, Install41.196920524s. Actual seccomp Install26299 processes/253 local cuts; all seven stats finished,496 total cuts. Untraced exact process count is unmeasured. wait4 CPU: untraced20.335718user/5.305278system seconds; seccomp35.960110user/16.688264system. wait4 maxRSS24592/33252KiB is Linux's largest individual waited descendant maximum, NOT whole-tree RSS, a summed bound, memory per host or persistent session cost. Postflow graph work is excluded from the producer timings and included in whole-test resource scope.

Source v4 manifest183080621ad18a85065b84fad6b0f8aaa24ec121d4306d9daf6c77770f2310e5. Compiler pin37ec2edceab790d393fc16fb6e415c267b91b76cc9434346a51675326c1e476d, testELF96a73464973f480eed180315ac839e60fecce5a7c9d6ff8279ebeec1a4d7043d. Stage363840f15109eafb642c9354ebca393ea6e6a5f481369cd74cf583c314d25e64, original21 helpera1ed805e… / interpreter-and-RUNPATH-only relocated0474051e… unchanged as documented. No strip/source/producer modification. New wrapper usage_probe.py has explicit main guard and uses the standard resource module; previous shadowing/double-execution RED receipts remain intact, excluded from accepted pair/RSS.

Typed graph correction preserves f/d historical checks and exact original negative assertions. Only manifests containing l rows derive role authority, from the two exact native fixture unit coordinates and their matching base/host/wanted. l requires literal '-' plus exact UID/device/inode/type and canonical current/launcher/wanted targets. Unknown roles/manifest/unit lookalikes cannot grant authority. Existing generic f-only negative remains unchanged. Gate: fmt +install-target Clippy +newELF compile +14 graph controls +46 original controls +4 ABI controls +46 candidate controls GREEN. V3 eager-role-check failure was preserved and corrected in new immutable v4, not edited/relabelled. Root coordinate parser positives are NOT actual Root workflow qualification.

Raw accepted pair archives: untraced34978a881ac5dbf72472990924b9fd5c47849c8541fe470203bd9f21bfab7738; seccomp341276e1dc1e48c690eb248fc95de519b9dc67c07b0b95b42188dbad2cc03f8b. Both owned containers removed, lock released between cases, CPUWeight10000 observed, all artifact/provider preflight hashing outside perf.lock. Full-original/full-buffer matched scratch observer pair is now pending under separate case locks, original150/155 full profile and180 lease; no candidate saving/adoption claim yet.

Corrected scratch diagnostic21 pair is GREEN: one actual test execution each under true untraced Local and actual seccomp, all seven producer commands completed, exact three native l rows required, final26-node identity graphs matched with two reconstructed receipts and no ignored content. This is a newly compiled diagnostic-only testELF over unchanged immutable21 shipping closure; source21 overall remains RED, current source23/eight-way qualification and full96 product remain UNRUN. No deadline/lease changes. VM observations (one diagnostic pair, not median/p95 or capacity acceptance): untraced wholeflow24.845600306s, Install18.554907229s; seccomp wholeflow56.046381508s, Install41.196920524s. Actual seccomp Install26299 processes/253 local cuts; all seven stats finished,496 total cuts. Untraced exact process count is unmeasured. wait4 CPU: untraced20.335718user/5.305278system seconds; seccomp35.960110user/16.688264system. wait4 maxRSS24592/33252KiB is Linux's largest individual waited descendant maximum, NOT whole-tree RSS, a summed bound, memory per host or persistent session cost. Postflow graph work is excluded from the producer timings and included in whole-test resource scope. Source v4 manifest183080621ad18a85065b84fad6b0f8aaa24ec121d4306d9daf6c77770f2310e5. Compiler pin37ec2edceab790d393fc16fb6e415c267b91b76cc9434346a51675326c1e476d, testELF96a73464973f480eed180315ac839e60fecce5a7c9d6ff8279ebeec1a4d7043d. Stage363840f15109eafb642c9354ebca393ea6e6a5f481369cd74cf583c314d25e64, original21 helpera1ed805e… / interpreter-and-RUNPATH-only relocated0474051e… unchanged as documented. No strip/source/producer modification. New wrapper usage_probe.py has explicit main guard and uses the standard resource module; previous shadowing/double-execution RED receipts remain intact, excluded from accepted pair/RSS. Typed graph correction preserves f/d historical checks and exact original negative assertions. Only manifests containing l rows derive role authority, from the two exact native fixture unit coordinates and their matching base/host/wanted. l requires literal '-' plus exact UID/device/inode/type and canonical current/launcher/wanted targets. Unknown roles/manifest/unit lookalikes cannot grant authority. Existing generic f-only negative remains unchanged. Gate: fmt +install-target Clippy +newELF compile +14 graph controls +46 original controls +4 ABI controls +46 candidate controls GREEN. V3 eager-role-check failure was preserved and corrected in new immutable v4, not edited/relabelled. Root coordinate parser positives are NOT actual Root workflow qualification. Raw accepted pair archives: untraced34978a881ac5dbf72472990924b9fd5c47849c8541fe470203bd9f21bfab7738; seccomp341276e1dc1e48c690eb248fc95de519b9dc67c07b0b95b42188dbad2cc03f8b. Both owned containers removed, lock released between cases, CPUWeight10000 observed, all artifact/provider preflight hashing outside perf.lock. Full-original/full-buffer matched scratch observer pair is now pending under separate case locks, original150/155 full profile and180 lease; no candidate saving/adoption claim yet.

kayg commented

2026-10-20 04:55:37 +00:00

Author

Owner

The managed M8 canary exposed two VM staging defects. Both failed runs are retained and excluded; no matched M12b performance case has run and the qualified comparison remains0/56.

The marker correction advanced genuine startup: original marker600, runtime700, original lifetime lock600 and plugin listener were observed, followed by actual shim children. The isolated namespace had replaced /home with tmpfs but omitted UID1001's passwd home /home/bench. Shipping Pty::spawn changes to that exact account directory before launching its shell. The namespace-only repair creates that private700 home and aligns HOME; it never accesses or writes the VM's real home. Both unchanged shipping CLIs then passed actual PTY open/echo/exit, including repeats under their own shared VM lock/CPUWeight10000. The earlier unlocked functional smoke is explicitly retained as such, with no timing credit.
The next M8 run reached its real daemon/terminal RSS check, then failed remote_demo_tests.rs458 with a canonical No-such-file category from its unchanged idle-canary launcher. The frozen18-file fixture closure lacked the EMPTY crates/infraternal-server directory that the compiler's literal crates/infraternal-server/../../scripts/idle_canary.py path must traverse. The normalized file existed; the literal path did not. A new immutable bundle adds only that directory, records directory types/modes, and positively checks the compiler directory plus literal idle-canary/flood helper paths. All18existing fixture file hashes, the common ECC49 ELF, both shipping CLIs, workloads, assertions and deadlines remain unchanged.

New bundle SHA25635a45bc73b65952e92fde84221f34d9405d08f387fb45c2c841c6f634c21a701 passed file/provider/directory/selector preflight outside the benchmark lock. Its locked functional smoke and fresh56 ABBA/BAAB sequence are queued fairly. These findings qualify staging, not performance or adoption of M8/M12b. No production/index/commit changes.

management12b-managed-diagnostic2-receipt.json
management12b-managed-diagnostic2.log
management12b-managed-v3-diagnostic.log
management12b-managed-v3-compiled-path-red.json
management12b-managed-v3-locked-smoke-receipt.json
management12b-actual-cli-v4-managed-stage.json
management12b-actual-cli-v4-managed-preflight.log

The managed M8 canary exposed two VM staging defects. Both failed runs are retained and excluded; no matched M12b performance case has run and the qualified comparison remains0/56. 1. The marker correction advanced genuine startup: original marker600, runtime700, original lifetime lock600 and plugin listener were observed, followed by actual shim children. The isolated namespace had replaced /home with tmpfs but omitted UID1001's passwd home /home/bench. Shipping Pty::spawn changes to that exact account directory before launching its shell. The namespace-only repair creates that private700 home and aligns HOME; it never accesses or writes the VM's real home. Both unchanged shipping CLIs then passed actual PTY open/echo/exit, including repeats under their own shared VM lock/CPUWeight10000. The earlier unlocked functional smoke is explicitly retained as such, with no timing credit. 2. The next M8 run reached its real daemon/terminal RSS check, then failed remote_demo_tests.rs458 with a canonical No-such-file category from its unchanged idle-canary launcher. The frozen18-file fixture closure lacked the EMPTY crates/infraternal-server directory that the compiler's literal crates/infraternal-server/../../scripts/idle_canary.py path must traverse. The normalized file existed; the literal path did not. A new immutable bundle adds only that directory, records directory types/modes, and positively checks the compiler directory plus literal idle-canary/flood helper paths. All18existing fixture file hashes, the common ECC49 ELF, both shipping CLIs, workloads, assertions and deadlines remain unchanged. New bundle SHA25635a45bc73b65952e92fde84221f34d9405d08f387fb45c2c841c6f634c21a701 passed file/provider/directory/selector preflight outside the benchmark lock. Its locked functional smoke and fresh56 ABBA/BAAB sequence are queued fairly. These findings qualify staging, not performance or adoption of M8/M12b. No production/index/commit changes. [management12b-managed-diagnostic2-receipt.json](https://git.kayg.org/attachments/040bb0e1-6c67-49fa-9494-e5bcd178a21f) [management12b-managed-diagnostic2.log](https://git.kayg.org/attachments/db236f1b-07ae-446f-a400-16333f7b16d1) [management12b-managed-v3-diagnostic.log](https://git.kayg.org/attachments/28774506-eea8-4bbc-add0-8b92e396f0f9) [management12b-managed-v3-compiled-path-red.json](https://git.kayg.org/attachments/99fc8eb1-42d8-4172-85b9-dbb7a43afece) [management12b-managed-v3-locked-smoke-receipt.json](https://git.kayg.org/attachments/08f4a3fa-0077-48ef-b6a4-c63ccf4803fb) [management12b-actual-cli-v4-managed-stage.json](https://git.kayg.org/attachments/c6d003d0-306b-4ea7-a693-d678b2ecae33) [management12b-actual-cli-v4-managed-preflight.log](https://git.kayg.org/attachments/157fd2e0-c73b-4e3d-9579-dd0eff896a9f)

kayg commented

2026-10-20 05:00:10 +00:00

Author

Owner

Step committed: 0c8aca9bac596c42b761dc463cd6ecf8510e7036 extends the existing shared SSH robustness target with canonical retention-frame properties and adds an explicit synthetic seed-only mode. No dependency, feature or engine change.

Exact projected HEAD: fmt, selected-target Clippy and compiler-reported target build GREEN (ATOMIC_RETENTION_PARSER_PROPERTIES_BUILD_GREEN). All 148 public synthetic seeds classified: 3 accepted, 145 rejected. On the locked perf VM under CPUWeight=10000, the identical SHA-pinned ordinary target completed 10,000 fixed-count inputs without assertion failures (PARSER_PROPERTIES_FIXED_COUNT_GREEN). This target is not coverage-instrumented; no coverage, throughput or memory qualification is claimed. Parser/truncation/duplicate framing assertions remain strict.

Build gate, seed classification, VM artifact provenance, VM fixed-count output.

Overall round4 remains incomplete. Actual worker-report REDs, full interruption matrix, runtime/size qualification and final branch-head fast gate are outstanding. No push/deploy.

Step committed: `0c8aca9bac596c42b761dc463cd6ecf8510e7036` extends the existing shared SSH robustness target with canonical retention-frame properties and adds an explicit synthetic seed-only mode. No dependency, feature or engine change. Exact projected HEAD: fmt, selected-target Clippy and compiler-reported target build GREEN (`ATOMIC_RETENTION_PARSER_PROPERTIES_BUILD_GREEN`). All 148 public synthetic seeds classified: 3 accepted, 145 rejected. On the locked perf VM under CPUWeight=10000, the identical SHA-pinned ordinary target completed 10,000 fixed-count inputs without assertion failures (`PARSER_PROPERTIES_FIXED_COUNT_GREEN`). This target is not coverage-instrumented; no coverage, throughput or memory qualification is claimed. Parser/truncation/duplicate framing assertions remain strict. [Build gate](https://git.kayg.org/attachments/8d94d6ba-e53d-4796-b57d-ccab3013c8dc), [seed classification](https://git.kayg.org/attachments/b5298083-8d13-43c7-a48b-b777b2ac5cbf), [VM artifact provenance](https://git.kayg.org/attachments/b4de4018-47bb-4692-8cae-cb6a3961bfa6), [VM fixed-count output](https://git.kayg.org/attachments/b05a3987-a1e2-44a1-b42f-4e467f6d3534). Overall round4 remains incomplete. Actual worker-report REDs, full interruption matrix, runtime/size qualification and final branch-head fast gate are outstanding. No push/deploy.

kayg commented

2026-10-20 05:05:35 +00:00

Author

Owner

Current actual-CLI comparison remains blocked at0/56. No M12b matched performance case has run, and no candidate/profile is accepted.

After the independently proven private-home and compiler-path staging corrections, the unchanged managed M8 two-process test reaches its real terminal and daemon idle check. Narrow locked VM diagnostics now distinguish two failures rather than attributing everything to idle:

One M8 diagnostic reached remote_demo_tests.rs165 (browser WebSocket send) after the canary call returned successfully. Its browser is only polled/replies to proofs in next(); the ten-second synchronous canary wait leaves that browser unpolled. This is a fixture starvation hypothesis; it has not yet been demonstrated with a positive-canary line plus identical old-CLI browser failure.
The explicitly requested paired control used the SAME ECC49 common test ELF/managed v4 fixture/namespace and swapped only the actual shipping CLI to original taskbase58760 (SHA e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f). M8 recorded two scheduler activations in the first0.100s sample of its unchanged10-second zero-activation canary; taskbase recorded one in its first0.100s sample. Both refused at the original assertion458. These are VM diagnostic observations, not an M12 regression or an older-server qualification: the common library server remains fixedM8 in both controls.

All original deadlines/assertions remain. No browser pumping change, quiet-period extension, activation allowance, production source, new Cargo rebuild, index or commit has been made. A reusable bounded browser pump exists, but its possible fixture migration is a separate reviewable step and would not excuse the early zero-idle violations. Every known diagnostic CLI PID/birth is now gone, private fixture directories are empty, and the shared VM lock was released.

management12b-managed-v4-paired-M8.log
management12b-managed-v4-paired-Taskbase587.log
management12b-managed-v4-taskbase-source.json
management12b-managed-v4-diagnostic.log
management12b-managed-v4-diagnostic-cleanup.json

Current actual-CLI comparison remains blocked at0/56. No M12b matched performance case has run, and no candidate/profile is accepted. After the independently proven private-home and compiler-path staging corrections, the unchanged managed M8 two-process test reaches its real terminal and daemon idle check. Narrow locked VM diagnostics now distinguish two failures rather than attributing everything to idle: - One M8 diagnostic reached remote_demo_tests.rs165 (browser WebSocket send) after the canary call returned successfully. Its browser is only polled/replies to proofs in next(); the ten-second synchronous canary wait leaves that browser unpolled. This is a fixture starvation hypothesis; it has not yet been demonstrated with a positive-canary line plus identical old-CLI browser failure. - The explicitly requested paired control used the SAME ECC49 common test ELF/managed v4 fixture/namespace and swapped only the actual shipping CLI to original taskbase58760 (SHA e4da1abed127b2e6029b5a60310bf81043035faf364f7a08fe3d58b2f0bd722f). M8 recorded two scheduler activations in the first0.100s sample of its unchanged10-second zero-activation canary; taskbase recorded one in its first0.100s sample. Both refused at the original assertion458. These are VM diagnostic observations, not an M12 regression or an older-server qualification: the common library server remains fixedM8 in both controls. All original deadlines/assertions remain. No browser pumping change, quiet-period extension, activation allowance, production source, new Cargo rebuild, index or commit has been made. A reusable bounded browser pump exists, but its possible fixture migration is a separate reviewable step and would not excuse the early zero-idle violations. Every known diagnostic CLI PID/birth is now gone, private fixture directories are empty, and the shared VM lock was released. [management12b-managed-v4-paired-M8.log](https://git.kayg.org/attachments/bca1a44b-7db4-438f-9050-994a613d4e0b) [management12b-managed-v4-paired-Taskbase587.log](https://git.kayg.org/attachments/eb658213-0644-4d91-a05d-21712d17dfd8) [management12b-managed-v4-taskbase-source.json](https://git.kayg.org/attachments/a9fe0e8e-e0eb-4128-ad66-5ea65882413c) [management12b-managed-v4-diagnostic.log](https://git.kayg.org/attachments/7fdcaa82-b4bf-480d-900c-a0bd8196c7af) [management12b-managed-v4-diagnostic-cleanup.json](https://git.kayg.org/attachments/75d6ab13-8f94-4b82-9ba0-f5707742e66f)

kayg commented

2026-10-20 05:08:19 +00:00

Author

Owner

Atomic lease step committed: 1f76411b77d790c47dfed4f7a79e4b6c1e537c8b. Only lease-record parsing/retirement and an independent kernel regression are included; activation remains separate.

Before fix: empty private lease plus an actual stage-lock holder returned 1 instead of the required 73. After fix: empty records confer no signal authority; unreaped children confer none after descriptor closure; recovery still takes the exact kernel stage flock. Live PID/birth/fd7 mismatches remain refusals. The original unreaped/live assertions are preserved, with three added empty-record controls. The test now lives once in tests/setup_lease.rs, independently of the uncommitted activation harness.

Exact projected index: fmt, shell syntax, all-target SSH Clippy, library 63 passed; 0 failed; 2 ignored, and real-kernel regression 1 passed; 0 failed; 0 ignored. Marker: ATOMIC_SETUP_LEASE_green_GREEN. Initial test lint failure was corrected through the established test unwrap allowance, without changing assertions.

Original RED, initial lint RED, exact-index GREEN. These are functional checks; their elapsed host times are not performance evidence. Overall round4 remains incomplete; no push/deploy.

Atomic lease step committed: `1f76411b77d790c47dfed4f7a79e4b6c1e537c8b`. Only lease-record parsing/retirement and an independent kernel regression are included; activation remains separate. Before fix: empty private lease plus an actual stage-lock holder returned 1 instead of the required 73. After fix: empty records confer no signal authority; unreaped children confer none after descriptor closure; recovery still takes the exact kernel stage flock. Live PID/birth/fd7 mismatches remain refusals. The original unreaped/live assertions are preserved, with three added empty-record controls. The test now lives once in `tests/setup_lease.rs`, independently of the uncommitted activation harness. Exact projected index: fmt, shell syntax, all-target SSH Clippy, library `63 passed; 0 failed; 2 ignored`, and real-kernel regression `1 passed; 0 failed; 0 ignored`. Marker: `ATOMIC_SETUP_LEASE_green_GREEN`. Initial test lint failure was corrected through the established test unwrap allowance, without changing assertions. [Original RED](https://git.kayg.org/attachments/b3f1a4c0-0eed-4505-84d6-10168dfe82f5), [initial lint RED](https://git.kayg.org/attachments/ead1e8bb-7895-4753-ae35-c0709963e452), [exact-index GREEN](https://git.kayg.org/attachments/1f3f5e98-01bc-410f-8110-b72973e91c70). These are functional checks; their elapsed host times are not performance evidence. Overall round4 remains incomplete; no push/deploy.

kayg commented

2026-10-20 05:09:19 +00:00

Author

Owner

Both full-observer diagnostic arms completed on the VM with original150/155/180 bounds, all seven producer phases, exact three native l rows,496 actual mutation/durability cuts with496 matching same-call real kernel witnesses, and matching final26-node identity graphs. No LIVE observer/source adoption has occurred. Original source21 overall remains RED; source23/current-head eight-way qualification and full96 Cartesian product remain UNRUN.

Single-pair observations only: original wholeflow201.752312798s /Install149.013719112s; reusable syscall-info-buffer candidate198.505643275s /147.047394153s. Ratios0.983908/0.986804 (~1.6%/~1.3% lower) are too small and insufficiently repeated to establish a decisive overhead fix or performance acceptance. Original earlier150s RED is retained; its now149.01s pass demonstrates proximity/variance near the same limit. Actual Install process counts26299/26299 and local cuts253/253. Every other actual cut remains witnessed; harmless entry/exit-read stop counts differ slightly between executions, never normalized/dropped.

Wait4 CPU: original136.484212user+48.361577system; candidate134.907275+46.968730 seconds. maxRSS34880/34692KiB is largest individual waited-descendant maximum only, NOT whole-tree RSS, a summed bound, per-host/session cost or established memory saving. Producer timings exclude postflow graph work; whole-test resource scope includes it. Raw archives a59d1f9440d5b4c8b5a3283a9e7501912301f8c33b4525e15c1d1222f0bb2ce6 /3448329de0dbf4115b40b10bf6d77277b17e700d092b1fe5cfc08591f5d51146. Both owned containers removed, perf.lock released after each case, CPUWeight10000 observed, all staging/preflight hashes outside lock. Full records/source pins accompany summary; no host timing evidence used.

Read-only attribution limitation: successful probe archives retain every mutation event and per-command counters, but their fixture exec-control history was removed by FixtureDrop. Earlier actual21 failed150s archive retains1453 controls:1279 watched execs (1264tools/awk,4awk-wire,4payload,4runtime-helper,3systemctl),163fsync,11flock. External /usr/bin stat/od/sha paths and shell-function origin were never logged, so exact per-family/call totals cannot be reconstructed. No inferred totals will be reported as measurements.

Existing trace confirms peak10 immutable ledger records/9 successors. Static unchanged-source accounting: one stable, nonpending creation_rows_emit at that depth performs18 cut utilities solely to extract two captured header fields;70stat,44sha256sum,10head and10row-grammar awk utility calls remain separately necessary under current checks. A narrowly safe scratch candidate replaces only the captured-header cut/format substitutions with literal-TAB parameter expansion and exact canonical reconstruction, preserving every original metadata/hash/link/captured-byte/source check. No mutable file/parse/admission cache. Refreshed exact21 controls pass100 differential actual cl_record cases (17accepted),11 unchanged focused ledger invariants per variant,15 exact source/wire/storage tests and strict standalone Clippy. Compact source shrinks10bytes. A new helper/testELF projection will compare actual full cuts/witness/final graph against the pinned original21 control before interpreting any timing; this is separate from buffered observer and no LIVE change is authorized yet.

Both full-observer diagnostic arms completed on the VM with original150/155/180 bounds, all seven producer phases, exact three native l rows,496 actual mutation/durability cuts with496 matching same-call real kernel witnesses, and matching final26-node identity graphs. No LIVE observer/source adoption has occurred. Original source21 overall remains RED; source23/current-head eight-way qualification and full96 Cartesian product remain UNRUN. Single-pair observations only: original wholeflow201.752312798s /Install149.013719112s; reusable syscall-info-buffer candidate198.505643275s /147.047394153s. Ratios0.983908/0.986804 (~1.6%/~1.3% lower) are too small and insufficiently repeated to establish a decisive overhead fix or performance acceptance. Original earlier150s RED is retained; its now149.01s pass demonstrates proximity/variance near the same limit. Actual Install process counts26299/26299 and local cuts253/253. Every other actual cut remains witnessed; harmless entry/exit-read stop counts differ slightly between executions, never normalized/dropped. Wait4 CPU: original136.484212user+48.361577system; candidate134.907275+46.968730 seconds. maxRSS34880/34692KiB is largest individual waited-descendant maximum only, NOT whole-tree RSS, a summed bound, per-host/session cost or established memory saving. Producer timings exclude postflow graph work; whole-test resource scope includes it. Raw archives a59d1f9440d5b4c8b5a3283a9e7501912301f8c33b4525e15c1d1222f0bb2ce6 /3448329de0dbf4115b40b10bf6d77277b17e700d092b1fe5cfc08591f5d51146. Both owned containers removed, perf.lock released after each case, CPUWeight10000 observed, all staging/preflight hashes outside lock. Full records/source pins accompany summary; no host timing evidence used. Read-only attribution limitation: successful probe archives retain every mutation event and per-command counters, but their fixture exec-control history was removed by FixtureDrop. Earlier actual21 failed150s archive retains1453 controls:1279 watched execs (1264tools/awk,4awk-wire,4payload,4runtime-helper,3systemctl),163fsync,11flock. External /usr/bin stat/od/sha paths and shell-function origin were never logged, so exact per-family/call totals cannot be reconstructed. No inferred totals will be reported as measurements. Existing trace confirms peak10 immutable ledger records/9 successors. Static unchanged-source accounting: one stable, nonpending creation_rows_emit at that depth performs18 cut utilities solely to extract two captured header fields;70stat,44sha256sum,10head and10row-grammar awk utility calls remain separately necessary under current checks. A narrowly safe scratch candidate replaces only the captured-header cut/format substitutions with literal-TAB parameter expansion and exact canonical reconstruction, preserving every original metadata/hash/link/captured-byte/source check. No mutable file/parse/admission cache. Refreshed exact21 controls pass100 differential actual cl_record cases (17accepted),11 unchanged focused ledger invariants per variant,15 exact source/wire/storage tests and strict standalone Clippy. Compact source shrinks10bytes. A new helper/testELF projection will compare actual full cuts/witness/final graph against the pinned original21 control before interpreting any timing; this is separate from buffered observer and no LIVE change is authorized yet.

kayg commented

2026-10-20 05:09:32 +00:00

Author

Owner

Before the scratch browser fixture repair: existing ECC49 control ca_handoff::shipping_tests::browser_client::tests::probes_are_answered_without_assertion_reads_and_drop_closes_the_socket passed under its own shared VM lock/CPUWeight10000. The real TCP/WebSocket control sends correlated mux and transport probes and requires replies BEFORE the caller's first read, retains Ack42, and proves socket release on Drop. This is independent protocol-helper evidence, not a successful CLI comparison or an older-server runtime claim.

The current pull-based remote_demo browser replies only when next() is polled; its10-second canary and renewal's11-second waits leave it unpolled. The approved scratch-only correction will reuse that existing bounded actor (32commands/4096retained messages), generalize its socket transport for the existing OpenSSL connection, retain FIFO/data/Close/overflow/Drop checks and the original outer10-second read guard. No new wire protocol, production source, application traffic, workload reduction, deadline extension or assertion relaxation is planned.

The early canary activations already seen with BOTH taskbase and M8 remain distinct failing controls. After the pump correction, paired taskbase/M8 runs must still satisfy the unchanged zero-activation floor; any remaining wakeup requires causal ownership/readiness diagnosis. No extra settling or ignored activation will be introduced. Comparison remains0/56; M12b performance remains unrun.

management12b-protocol-control.log
management12b-protocol-control-source.json

Before the scratch browser fixture repair: existing ECC49 control ca_handoff::shipping_tests::browser_client::tests::probes_are_answered_without_assertion_reads_and_drop_closes_the_socket passed under its own shared VM lock/CPUWeight10000. The real TCP/WebSocket control sends correlated mux and transport probes and requires replies BEFORE the caller's first read, retains Ack42, and proves socket release on Drop. This is independent protocol-helper evidence, not a successful CLI comparison or an older-server runtime claim. The current pull-based remote_demo browser replies only when next() is polled; its10-second canary and renewal's11-second waits leave it unpolled. The approved scratch-only correction will reuse that existing bounded actor (32commands/4096retained messages), generalize its socket transport for the existing OpenSSL connection, retain FIFO/data/Close/overflow/Drop checks and the original outer10-second read guard. No new wire protocol, production source, application traffic, workload reduction, deadline extension or assertion relaxation is planned. The early canary activations already seen with BOTH taskbase and M8 remain distinct failing controls. After the pump correction, paired taskbase/M8 runs must still satisfy the unchanged zero-activation floor; any remaining wakeup requires causal ownership/readiness diagnosis. No extra settling or ignored activation will be introduced. Comparison remains0/56; M12b performance remains unrun. [management12b-protocol-control.log](https://git.kayg.org/attachments/009946bc-7d34-4129-8bf8-fd686a157a7d) [management12b-protocol-control-source.json](https://git.kayg.org/attachments/9323c455-a907-4cfc-8fbc-4532326d0040)

kayg commented

2026-10-20 05:14:22 +00:00

Author

Owner

Reviewed installer retention-message proposal, before implementation. Both previously posted real-process findings remain open: small preserved32nodes but omitted one retained-leaf report; long preserved87nodes while8266diagnostic bytes exceeded the8192reader limit. Exact immutable source23 baseline manifest: 6e48eedea25d33632b198d3278a6089de2251590f3f75b9529cf595c37ac95e0.

The attached audit maps all72 literal reporting references in11production source files to exact configured coordinates/families, including pending/proof peers, fresh-state workers, prepared creator chains, public targets and destination capsules. Creator discovery scans every lexical base ancestor: the later64-level recovery limit does not bound discovery. One parent UID/device/inode cannot represent all those ancestors.

Proposed additive standalone V2: one canonical count+digest binding the complete independently registered coordinate/anchor catalog, fixed TREE/NODE/family semantics and explicit absence/blocked entries. Each exact parent contributes its own type/UID/device/inode and raw-path encoding to the digest; hashing an ancestor never covers unrelated children. Maximum frame144B (35+20+1+64+24), independent of depth, sibling count and worker batches. Original V1 and three point controls stay unchanged. Existing per-node held-descriptor, owner/type/byte and original assertions remain required; the message supplies no removal authority.

Two constraints are explicit: component-relative no-follow traversal is required (deep-path lstat alone follows intermediate links), and exact transaction namespaces must be captured independently rather than inherited from mutable helper globals. Source23 inspection starts with nil and passes previousT only as phase_transaction; a possible unbound-manifest inspection mismatch is under separate actual-producer diagnosis, not established by this source audit. No arbitrary-T family is proposed. Hash/current catalog comparison must allow legitimately retired owned anchors to become ABSENT while never allowing recreated required anchors to inherit a saved descriptor.

This is a review draft, not a global reporting or size qualification. Producer feasibility/no-follow availability still needs proof. Source23 command maximum130729B leaves only343B to the strict131072boundary; a small wire frame does not demonstrate source fit. No production/test/index changes, build, VM latency or final-size acceptance follows from this audit.

bounded-retention-catalog-audit-v2.md
bounded-retention-source23-callsites.json

Exact local source hashes:

bounded-retention-catalog-audit-v2.md: 5ee15d1bdf8d336afdff2e4723a7835906fdd91811f2cf978f60579fdd7b532b
bounded-retention-source23-callsites.json: c082e4075821f93ea3696d1a72fcc348293bb6ecee29601f5bb07acda5ba654d

Reviewed installer retention-message proposal, before implementation. Both previously posted real-process findings remain open: small preserved32nodes but omitted one retained-leaf report; long preserved87nodes while8266diagnostic bytes exceeded the8192reader limit. Exact immutable source23 baseline manifest: `6e48eedea25d33632b198d3278a6089de2251590f3f75b9529cf595c37ac95e0`. The attached audit maps all72 literal reporting references in11production source files to exact configured coordinates/families, including pending/proof peers, fresh-state workers, prepared creator chains, public targets and destination capsules. Creator discovery scans every lexical base ancestor: the later64-level recovery limit does not bound discovery. One parent UID/device/inode cannot represent all those ancestors. Proposed additive standalone V2: one canonical count+digest binding the complete independently registered coordinate/anchor catalog, fixed TREE/NODE/family semantics and explicit absence/blocked entries. Each exact parent contributes its own type/UID/device/inode and raw-path encoding to the digest; hashing an ancestor never covers unrelated children. Maximum frame144B (35+20+1+64+24), independent of depth, sibling count and worker batches. Original V1 and three point controls stay unchanged. Existing per-node held-descriptor, owner/type/byte and original assertions remain required; the message supplies no removal authority. Two constraints are explicit: component-relative no-follow traversal is required (deep-path lstat alone follows intermediate links), and exact transaction namespaces must be captured independently rather than inherited from mutable helper globals. Source23 inspection starts with nil and passes previousT only as phase_transaction; a possible unbound-manifest inspection mismatch is under separate actual-producer diagnosis, not established by this source audit. No arbitrary-T family is proposed. Hash/current catalog comparison must allow legitimately retired owned anchors to become ABSENT while never allowing recreated required anchors to inherit a saved descriptor. This is a review draft, not a global reporting or size qualification. Producer feasibility/no-follow availability still needs proof. Source23 command maximum130729B leaves only343B to the strict131072boundary; a small wire frame does not demonstrate source fit. No production/test/index changes, build, VM latency or final-size acceptance follows from this audit. [bounded-retention-catalog-audit-v2.md](https://git.kayg.org/attachments/952df2e5-0b41-42b9-8082-5e1366087434) [bounded-retention-source23-callsites.json](https://git.kayg.org/attachments/03546040-8776-4133-a3c0-ac146849c0fb) Exact local source hashes: - `bounded-retention-catalog-audit-v2.md`: `5ee15d1bdf8d336afdff2e4723a7835906fdd91811f2cf978f60579fdd7b532b` - `bounded-retention-source23-callsites.json`: `c082e4075821f93ea3696d1a72fcc348293bb6ecee29601f5bb07acda5ba654d`

kayg commented

2026-10-20 05:19:56 +00:00

Author

Owner

Catalog draft addendum from the exit-only caller audit: Installation::prepare_recovery at immutable source23 install.rs1119–1133 creates exact B.bootstrap-cache.recovery-T, outside both B and exact B.bootstrap-cache. If the future reporting scope includes that migration operation, this exact locally generated current-T coordinate and its directory contents must be registered too. The consumer does not scan arbitrary cache.recovery-* siblings, so no other-T family coverage is proposed. The attached revised audit includes this missing coordinate; its literal reporter inventory remains72references.

Wire grammar/scalar parser are unchanged, maximum144B. Actual producer/catalog semantics, transaction inspection behavior and component-relative no-follow feasibility remain unqualified. No production/test/index changes or separate migration correctness claim.

bounded-retention-catalog-audit-v3.md

SHA256 4e61fddfff2ae6a932054fa976dc96e501a1333c19f9f4275a62015c307cb0de.

Catalog draft addendum from the exit-only caller audit: `Installation::prepare_recovery` at immutable source23 install.rs1119–1133 creates exact `B.bootstrap-cache.recovery-T`, outside both B and exact B.bootstrap-cache. If the future reporting scope includes that migration operation, this exact locally generated current-T coordinate and its directory contents must be registered too. The consumer does not scan arbitrary `cache.recovery-*` siblings, so no other-T family coverage is proposed. The attached revised audit includes this missing coordinate; its literal reporter inventory remains72references. Wire grammar/scalar parser are unchanged, maximum144B. Actual producer/catalog semantics, transaction inspection behavior and component-relative no-follow feasibility remain unqualified. No production/test/index changes or separate migration correctness claim. [bounded-retention-catalog-audit-v3.md](https://git.kayg.org/attachments/6c4b32f2-7a12-44eb-8662-f632a191c234) SHA256 `4e61fddfff2ae6a932054fa976dc96e501a1333c19f9f4275a62015c307cb0de`.

kayg commented

2026-10-20 05:24:20 +00:00

Author

Owner

Potential installer cleanup finding from source review, pending the actual API regression. At HEAD 73b6de0a863cfc9b6029a811bf440199ce8a580f, Installation::prepare_recovery is byte-identical to the current/source23 method (SHA256 6abb0df874d48a0574620e0fca6a0eff6978383559cf167c2b44d4ce3da00d25). Its parent/cache checks and upload digest do not authenticate the later objects removed by its EXIT trap: current $prepared/payload, $prepared/owner and the current $prepared directory are removed by pathname. The trap has no original inode/type/UID/content comparison. A replaced empty prepared directory or independently recreated files at those names can therefore reach the final cleanup without a matching original creation receipt; the success path can retain status zero.

The sole production caller is Bootstrap::refresh_helper (source23 bootstrap.rs988), for a missing/earlier runtime helper. The existing earlier_binary_cache_is_refreshed_before_owned_recovery covers ordinary refresh, not this independent change before cleanup. A scratch-only standalone regression is being prepared against the actual public Installation::prepare_recovery API, using public fixture bytes, a private local directory, the real final move and a deterministic controller rendezvous before EXIT. It will hold recreated objects with nonfollowing descriptors and require their original path/type/UID/device/inode/mode/bytes to survive, plus a reported refusal. No production or live-test edits and no actual API RED claim yet.

Separately, the reviewed scalar V2 parser draft has no source-level findings: exact 125–144-byte framing, borrowed digest, canonical u64 count syntax (including zero), and the entire original V1 five-test module unchanged. This review does not qualify catalog semantics, a producer, component-relative no-follow traversal, release size or VM behavior. Read-only review receipt: evidence/catalog-parser-source-review.json.

Potential installer cleanup finding from source review, pending the actual API regression. At HEAD `73b6de0a863cfc9b6029a811bf440199ce8a580f`, `Installation::prepare_recovery` is byte-identical to the current/source23 method (SHA256 `6abb0df874d48a0574620e0fca6a0eff6978383559cf167c2b44d4ce3da00d25`). Its parent/cache checks and upload digest do not authenticate the later objects removed by its EXIT trap: current `$prepared/payload`, `$prepared/owner` and the current `$prepared` directory are removed by pathname. The trap has no original inode/type/UID/content comparison. A replaced empty prepared directory or independently recreated files at those names can therefore reach the final cleanup without a matching original creation receipt; the success path can retain status zero. The sole production caller is `Bootstrap::refresh_helper` (source23 bootstrap.rs988), for a missing/earlier runtime helper. The existing `earlier_binary_cache_is_refreshed_before_owned_recovery` covers ordinary refresh, not this independent change before cleanup. A scratch-only standalone regression is being prepared against the actual public `Installation::prepare_recovery` API, using public fixture bytes, a private local directory, the real final move and a deterministic controller rendezvous before EXIT. It will hold recreated objects with nonfollowing descriptors and require their original path/type/UID/device/inode/mode/bytes to survive, plus a reported refusal. No production or live-test edits and no actual API RED claim yet. Separately, the reviewed scalar V2 parser draft has no source-level findings: exact 125–144-byte framing, borrowed digest, canonical u64 count syntax (including zero), and the entire original V1 five-test module unchanged. This review does not qualify catalog semantics, a producer, component-relative no-follow traversal, release size or VM behavior. Read-only review receipt: `evidence/catalog-parser-source-review.json`.

kayg commented

2026-10-20 05:24:27 +00:00

Author

Owner

Scalar parser prerequisite committed: 73b6de0a863cfc9b6029a811bf440199ce8a580f. This implements only the additive grammar proposed above: one complete INFRATERNAL_RETAINED_V2 CATALOG_V1 COUNT SHA256 ALL_CURRENT_REGISTERED frame with exactly one final LF, canonical u64 count and 64 lowercase hex digest. Maximum144B, constant storage, borrowed digest. Zero is valid scalar syntax; actual catalog count/meaning remains an independent consumer check.

Original V1 accepted grammar and all five original test bodies are unchanged. New controls cover endpoint counts, overflow/noncanonical spelling, borrowed-pointer identity, digest alphabet/width, every truncated prefix, mixed/duplicate frames and extra bytes. Independent source review found no grammar issue. Its reviewed draft SHA differs from final only by a new-test empty-string constructor corrected for Clippy; no assertion/production change.

Exact projected index: fmt, all-target SSH Clippy, library 67 passed; 0 failed; 2 ignored, existing V1 classification 1 passed; 0 failed; 0 ignored; marker ATOMIC_CATALOG_SCALAR_PARSER_GREEN.

Initial test lint RED, exact-index GREEN, source review.

This does not activate or qualify the producer, filesystem catalog, classifier or oracle. Transaction-context, no-follow traversal, command caps and genuine worker-report REDs remain outstanding. No final gate/push/deploy claim.

Scalar parser prerequisite committed: `73b6de0a863cfc9b6029a811bf440199ce8a580f`. This implements only the additive grammar proposed above: one complete `INFRATERNAL_RETAINED_V2 CATALOG_V1 COUNT SHA256 ALL_CURRENT_REGISTERED` frame with exactly one final LF, canonical u64 count and 64 lowercase hex digest. Maximum144B, constant storage, borrowed digest. Zero is valid scalar syntax; actual catalog count/meaning remains an independent consumer check. Original V1 accepted grammar and all five original test bodies are unchanged. New controls cover endpoint counts, overflow/noncanonical spelling, borrowed-pointer identity, digest alphabet/width, every truncated prefix, mixed/duplicate frames and extra bytes. Independent source review found no grammar issue. Its reviewed draft SHA differs from final only by a new-test empty-string constructor corrected for Clippy; no assertion/production change. Exact projected index: fmt, all-target SSH Clippy, library `67 passed; 0 failed; 2 ignored`, existing V1 classification `1 passed; 0 failed; 0 ignored`; marker `ATOMIC_CATALOG_SCALAR_PARSER_GREEN`. [Initial test lint RED](https://git.kayg.org/attachments/d2b62ba3-f2fe-4786-b113-ea26f80ec25e), [exact-index GREEN](https://git.kayg.org/attachments/6de6e58c-10a0-442a-b6cc-884d28bb0e96), [source review](https://git.kayg.org/attachments/6049ec3c-1222-4856-97aa-c1a8553df21f). This does not activate or qualify the producer, filesystem catalog, classifier or oracle. Transaction-context, no-follow traversal, command caps and genuine worker-report REDs remain outstanding. No final gate/push/deploy claim.

kayg commented

2026-10-20 05:24:47 +00:00

Author

Owner

Scratch-only captured-header parsing comparison completed; no live adoption. This changes only creator_ledger.sh in source21: two cut pipelines and one canonical-header formatting substitution become literal-TAB shell field extraction plus the same final exact header equality. All original row grammar, binding, captured-byte, metadata, hash, alias, link, phase and directory checks remain in place; no mutable-evidence cache.

The exact source manifest is bd6e9708a35ed886405ab1550bf08e6b5fe914fb6bf0917f6aa99822a3ae6b4e; creator-ledger control 5e2de902da6fa267711c52b58c18c3388e233f9e166f35b1e96c70f4453cb70a, candidate 2d12d150eb8e43cb61ddbd09761cea79b005e5707529917b3524fe0652514644. Compacted source is 10 bytes smaller. Exact source manifest and patch.

Before VM measurement, 100 authenticated-header differential cases (17 accepted), unchanged 11 inherited focused tests per variant, 15 compiled source/wire/storage tests, strict standalone Clippy, shell syntax, fresh-helper compilation and SSH all-target Clippy passed. Direct controls, fresh artifact gate. Final markers verbatim:

CREATOR_HEADER_SOURCE21_CONTROLS_GREEN
OBSERVER_HEADER21_COMPILE_GREEN

On the perf VM, the single original-observer control/candidate pair preserved all 496 actual mutation/durability cuts and all 496 same-call kernel witnesses, the exact three native entrypoint link rows, and the complete 26-node final identity graph (two reconstructed dynamic receipts; no ignored content). The common native runtime helper remains identical; each shell source has its own freshly pinned program-helper/test ELF. Full-install 150/155-second limits and production 180-second lease remain unchanged. Each case held the fair perf lock only for execution; staging/hashing/analysis stayed outside it and owned containers were removed.

Measured whole flow: 201.752313 → 191.079375 seconds (ratio 0.94710). Install: 149.013719 → 138.281938 seconds (ratio 0.92798). This is one diagnostic pair, not median/p95 or current-head acceptance. Actual process counts fell Install 26,299 → 22,281 and whole flow 34,584 → 30,013. All phase reductions are exact multiples of seven, consistent with removing seven shell/pipeline child processes per successor-header parse: 574 inferred Install parses and 653 inferred whole-flow parses. These parse counts are source/delta inference, not directly recorded utility-family totals.

Qualified summary, raw receipt archive (uncompressed SHA256 ef456d9202158e2d040f42c5f4c1be66bb2ec4cc747d7264ebd81b916ab54306). The qualified summary corrects an inherited driver label claiming unchanged source21: this candidate is source21 plus the explicit header delta, original observer, no buffer candidate. Source21 overall gate remains RED; current-head eight workflows and full96 remain UNRUN.

Memory scope correction retained: wait4 maximum RSS 34,880/34,708 KiB is the largest individual maximum among waited descendants; it is neither whole-tree RSS nor a summed bound or per-host/session memory measurement. No memory improvement claim. Initial scratch staging path failures remain preserved separately and were corrected before any header VM measurement; no failed stage held the perf lock.

Scratch-only captured-header parsing comparison completed; no live adoption. This changes only `creator_ledger.sh` in source21: two `cut` pipelines and one canonical-header formatting substitution become literal-TAB shell field extraction plus the same final exact header equality. All original row grammar, binding, captured-byte, metadata, hash, alias, link, phase and directory checks remain in place; no mutable-evidence cache. The exact source manifest is `bd6e9708a35ed886405ab1550bf08e6b5fe914fb6bf0917f6aa99822a3ae6b4e`; creator-ledger control `5e2de902da6fa267711c52b58c18c3388e233f9e166f35b1e96c70f4453cb70a`, candidate `2d12d150eb8e43cb61ddbd09761cea79b005e5707529917b3524fe0652514644`. Compacted source is 10 bytes smaller. Exact [source manifest](https://git.kayg.org/attachments/4b925ba0-9826-4fe9-af44-286df20578ab) and [patch](https://git.kayg.org/attachments/c5225638-c8c9-47d5-ac35-eab745e0ee8a). Before VM measurement, 100 authenticated-header differential cases (17 accepted), unchanged 11 inherited focused tests per variant, 15 compiled source/wire/storage tests, strict standalone Clippy, shell syntax, fresh-helper compilation and SSH all-target Clippy passed. [Direct controls](https://git.kayg.org/attachments/5f09f2b6-c872-4e1c-8c01-de30126bf3e3), [fresh artifact gate](https://git.kayg.org/attachments/ef48efef-368e-459f-b64e-b80e4344ac18). Final markers verbatim: ``` CREATOR_HEADER_SOURCE21_CONTROLS_GREEN OBSERVER_HEADER21_COMPILE_GREEN ``` On the perf VM, the single original-observer control/candidate pair preserved all 496 actual mutation/durability cuts and all 496 same-call kernel witnesses, the exact three native entrypoint link rows, and the complete 26-node final identity graph (two reconstructed dynamic receipts; no ignored content). The common native runtime helper remains identical; each shell source has its own freshly pinned program-helper/test ELF. Full-install 150/155-second limits and production 180-second lease remain unchanged. Each case held the fair perf lock only for execution; staging/hashing/analysis stayed outside it and owned containers were removed. Measured whole flow: 201.752313 → 191.079375 seconds (ratio 0.94710). Install: 149.013719 → 138.281938 seconds (ratio 0.92798). This is one diagnostic pair, not median/p95 or current-head acceptance. Actual process counts fell Install 26,299 → 22,281 and whole flow 34,584 → 30,013. All phase reductions are exact multiples of seven, consistent with removing seven shell/pipeline child processes per successor-header parse: 574 inferred Install parses and 653 inferred whole-flow parses. These parse counts are source/delta inference, not directly recorded utility-family totals. [Qualified summary](https://git.kayg.org/attachments/e6e2f21a-f22a-42e8-8d50-6b41788abe80), [raw receipt archive](https://git.kayg.org/attachments/ed4e3385-018c-4b0a-8605-567cf7e0ae41) (uncompressed SHA256 `ef456d9202158e2d040f42c5f4c1be66bb2ec4cc747d7264ebd81b916ab54306`). The qualified summary corrects an inherited driver label claiming unchanged source21: this candidate is source21 **plus the explicit header delta**, original observer, no buffer candidate. Source21 overall gate remains RED; current-head eight workflows and full96 remain UNRUN. Memory scope correction retained: wait4 maximum RSS 34,880/34,708 KiB is the largest individual maximum among waited descendants; it is neither whole-tree RSS nor a summed bound or per-host/session memory measurement. No memory improvement claim. Initial scratch staging path failures remain preserved separately and were corrected before any header VM measurement; no failed stage held the perf lock.

kayg commented

2026-10-20 05:29:22 +00:00

Author

Owner

The minimal header parser now also passes an exact atomic projection on committed parent 2db7b1d8497d653ed155c98828e2910b29c19979. The archived HEAD has only crates/plugins/ssh/src/creator_ledger.sh changed to the already measured header candidate SHA256 2d12d150eb8e43cb61ddbd09761cea79b005e5707529917b3524fe0652514644; source manifest SHA256 07b607562140cfaca5e0026d32a1dd29ff0455d3f320efc4ead5c8d28c0acfbc. Its full file/symlink inventory was rechecked unchanged after the gate.

Gate used the one shared target, wrapper-disabled UID-preserving source namespace, per-gate job/global locks and entrypoint freshness. The external pinned Python fixture bodies load only projected current module/dependency copies; no untracked test module entered the Cargo graph. No live source, index or commit changes were made by this gate.

Formatting and SSH all-target Clippy passed; each actual authenticated reader passed all100 differential cases (17accepted) and all11 unchanged focused tests. Library output and final marker verbatim:

test result: ok. 67 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 4.69s
CREATOR_HEADER_HEAD_PROJECTION_GREEN

Projection receipt, complete gate log. This is an atomic module gate, not final branch verify fast or current eight/96-workflow qualification. Parent handles review and any adoption/commit. Predecessor grammar inheritance remains a separate read-only assessment, with no implementation or adoption.

The minimal header parser now also passes an exact atomic projection on committed parent `2db7b1d8497d653ed155c98828e2910b29c19979`. The archived HEAD has only `crates/plugins/ssh/src/creator_ledger.sh` changed to the already measured header candidate SHA256 `2d12d150eb8e43cb61ddbd09761cea79b005e5707529917b3524fe0652514644`; source manifest SHA256 `07b607562140cfaca5e0026d32a1dd29ff0455d3f320efc4ead5c8d28c0acfbc`. Its full file/symlink inventory was rechecked unchanged after the gate. Gate used the one shared target, wrapper-disabled UID-preserving source namespace, per-gate job/global locks and entrypoint freshness. The external pinned Python fixture bodies load only projected current module/dependency copies; no untracked test module entered the Cargo graph. No live source, index or commit changes were made by this gate. Formatting and SSH all-target Clippy passed; each actual authenticated reader passed all100 differential cases (17accepted) and all11 unchanged focused tests. Library output and final marker verbatim: ``` test result: ok. 67 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 4.69s CREATOR_HEADER_HEAD_PROJECTION_GREEN ``` [Projection receipt](https://git.kayg.org/attachments/6a4cf8b3-2be0-4ef8-867a-ecfb46e9dfcb), [complete gate log](https://git.kayg.org/attachments/4c54066d-c259-41b2-aac2-45dd94a51eff). This is an atomic module gate, not final branch `verify fast` or current eight/96-workflow qualification. Parent handles review and any adoption/commit. Predecessor grammar inheritance remains a separate read-only assessment, with no implementation or adoption.

kayg commented

2026-10-20 05:30:20 +00:00

Author

Owner

The common managed-CLI benchmark fixture now reuses the existing bounded browser actor. The scratch-only two-file change passed touched-server Clippy, the three managed-genesis controls, the existing real-socket actor control, and compiler-pinned all four exact workload selectors. The measured two-process test and its 250 ms settle/10 s zero-activation canary remain unchanged. Shipping CLI artifacts are unchanged.

The fresh narrow pair still fails that original canary: taskbase 58760 produced 1,609 scheduler activations over 10 s, and unadopted M8 produced 1,635, each on namespace TID21. This is a retained baseline failure, not evidence of an M12b regression. Read-only source inspection finds the existing 25 ms native control/attachment Ping proof path while attachments are active, consistent with sustained wakeups once the browser pump keeps the route alive. Exact live thread/protocol attribution remains unproven by these receipts; no allowance or deadline was changed.

The first dimension remains RED and unqualified. The other six explicitly named dimensions are now running as 48 independent ABBA/BAAB rows under separate shared VM locks and CPUWeight10000, with original assertions/workloads/windows. A failed row is recorded and never supplies accepted timing; independent rows continue. No seven-dimensional completion, M12b adoption, installer qualification, or full server steady-traffic qualification is claimed.

Selected receipts: common compiler pin, paired failures, source causality and limit, remaining-six accounting.

The common managed-CLI benchmark fixture now reuses the existing bounded browser actor. The scratch-only two-file change passed touched-server Clippy, the three managed-genesis controls, the existing real-socket actor control, and compiler-pinned all four exact workload selectors. The measured two-process test and its 250 ms settle/10 s zero-activation canary remain unchanged. Shipping CLI artifacts are unchanged. The fresh narrow pair still fails that original canary: taskbase 58760 produced 1,609 scheduler activations over 10 s, and unadopted M8 produced 1,635, each on namespace TID21. This is a retained baseline failure, not evidence of an M12b regression. Read-only source inspection finds the existing 25 ms native control/attachment Ping proof path while attachments are active, consistent with sustained wakeups once the browser pump keeps the route alive. Exact live thread/protocol attribution remains unproven by these receipts; no allowance or deadline was changed. The first dimension remains RED and unqualified. The other six explicitly named dimensions are now running as 48 independent ABBA/BAAB rows under separate shared VM locks and CPUWeight10000, with original assertions/workloads/windows. A failed row is recorded and never supplies accepted timing; independent rows continue. No seven-dimensional completion, M12b adoption, installer qualification, or full server steady-traffic qualification is claimed. Selected receipts: [common compiler pin](https://git.kayg.org/attachments/9a2d24ec-646a-4a8d-b5c3-5607dd3deaaa), [paired failures](https://git.kayg.org/attachments/55ba8a1d-83e0-48e2-9c3b-f6b5fcd5f712), [source causality and limit](https://git.kayg.org/attachments/d7aca5e7-a745-45d1-838d-22a2bc3866fc), [remaining-six accounting](https://git.kayg.org/attachments/d0731cb9-8e39-4a4a-87c7-dc57e3183310).

kayg commented

2026-10-20 05:31:41 +00:00

Author

Owner

Two independently gated steps committed.

2db7b1d8497d653ed155c98828e2910b29c19979: expose one fixed local explanation for a complete canonical V2 catalog receipt, withholding digest/count/remote bytes. No filesystem producer or catalog oracle is activated. Exact projected index: fmt, all-target SSH Clippy, library67/0/2 and classification2/0/0 GREEN. Complete gate.

e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3: adopt the measured captured-header parser only. Literal-TAB expansion replaces two cut pipelines and a formatter substitution; every filesystem, digest and row-grammar check remains. Exact parent projection passes fmt, all-target SSH Clippy, library67/0/2, 100 authenticated differential cases per variant (17 accepted) and11 inherited focused cases per variant. Exact projection receipt, complete gate. Single source21 VM diagnostic, already detailed above, preserved496 cuts/witnesses and26-node final graph; Install process count26299→22281 and time149.013719s→138.281938s. Compact source−10B. No all-flow or memory benefit claim follows from one pair.

Current head e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3. Overall round4 remains incomplete. Cache-preparation cleanup and interrupted manifest-phase recovery are under genuine-producer diagnosis; final size/runtime/fast gates remain outstanding. No push/deploy.

Two independently gated steps committed. `2db7b1d8497d653ed155c98828e2910b29c19979`: expose one fixed local explanation for a complete canonical V2 catalog receipt, withholding digest/count/remote bytes. No filesystem producer or catalog oracle is activated. Exact projected index: fmt, all-target SSH Clippy, library67/0/2 and classification2/0/0 GREEN. [Complete gate](https://git.kayg.org/attachments/75c3eec8-2324-4089-9118-1fb9ab18e7ed). `e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3`: adopt the measured captured-header parser only. Literal-TAB expansion replaces two cut pipelines and a formatter substitution; every filesystem, digest and row-grammar check remains. Exact parent projection passes fmt, all-target SSH Clippy, library67/0/2, 100 authenticated differential cases per variant (17 accepted) and11 inherited focused cases per variant. [Exact projection receipt](https://git.kayg.org/attachments/6a4cf8b3-2be0-4ef8-867a-ecfb46e9dfcb), [complete gate](https://git.kayg.org/attachments/4c54066d-c259-41b2-aac2-45dd94a51eff). Single source21 VM diagnostic, already detailed above, preserved496 cuts/witnesses and26-node final graph; Install process count26299→22281 and time149.013719s→138.281938s. Compact source−10B. No all-flow or memory benefit claim follows from one pair. Current head `e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3`. Overall round4 remains incomplete. Cache-preparation cleanup and interrupted manifest-phase recovery are under genuine-producer diagnosis; final size/runtime/fast gates remain outstanding. No push/deploy.

kayg commented

2026-10-20 05:39:58 +00:00

Author

Owner

The six-dimension independent run has completed all24 Rust workload rows: four M8 and four M12b rows each for renewal,50MiB flood and actual server cold restart. All24 ran the exact original selector and failed an original assertion; all fixture state was empty afterward. None contributes accepted performance timing. This is not a completed56-case qualification or an M12b-specific finding.

Two additional uncredited M8 diagnostic runs retained only panic location/public categories. Flood fails before starting the byte workload at remote_renewal_cli_tests.rs:126, which expects exactly one owned UDP socket. The reader silently discards /proc/PID/fd readlink errors while shipping startup disables dumpability; an observability mismatch is a hypothesis, not yet a live errno proof. Cold restart reaches actual restart/echo and locked-enrollment success, then receives an unexpected WebSocket Close at ca_handoff_browser_tests.rs:116 before completing revocation assertions; raw Close reasons were withheld. No assertion, timer, capability or production change was made to force either case through.

The24 separate 50-session idle rows continue. The first M8 and first M12b zero-client rows passed original60s settle+60s sample, real shim identity/thread stability, exact scheduling weights10000 and cleanup. No aggregate dimension comparison is accepted until four samples per arm complete.

Receipts: all24 negative rows, flood location, cold location, exact owned cleanup.

The six-dimension independent run has completed all24 Rust workload rows: four M8 and four M12b rows each for renewal,50MiB flood and actual server cold restart. All24 ran the exact original selector and failed an original assertion; all fixture state was empty afterward. None contributes accepted performance timing. This is not a completed56-case qualification or an M12b-specific finding. Two additional uncredited M8 diagnostic runs retained only panic location/public categories. Flood fails before starting the byte workload at `remote_renewal_cli_tests.rs:126`, which expects exactly one owned UDP socket. The reader silently discards `/proc/PID/fd` readlink errors while shipping startup disables dumpability; an observability mismatch is a hypothesis, not yet a live errno proof. Cold restart reaches actual restart/echo and locked-enrollment success, then receives an unexpected WebSocket Close at `ca_handoff_browser_tests.rs:116` before completing revocation assertions; raw Close reasons were withheld. No assertion, timer, capability or production change was made to force either case through. The24 separate 50-session idle rows continue. The first M8 and first M12b zero-client rows passed original60s settle+60s sample, real shim identity/thread stability, exact scheduling weights10000 and cleanup. No aggregate dimension comparison is accepted until four samples per arm complete. Receipts: [all24 negative rows](https://git.kayg.org/attachments/542cf155-bba6-48ad-b8dc-b58553b4d0d9), [flood location](https://git.kayg.org/attachments/603cecaa-5d0a-4a0d-b98a-225f73b37485), [cold location](https://git.kayg.org/attachments/8b10fc46-fe2a-4a06-8b8e-c4d99c43f488), [exact owned cleanup](https://git.kayg.org/attachments/f50ed030-14f7-43da-9533-228a1f5854b7).

kayg commented

2026-10-20 05:40:13 +00:00

Author

Owner

Confirmed actual-API cache-preparation cleanup finding, exact parent e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3, no production changes.

Four standalone tests call real Installation::prepare_recovery, use its actual payload digest/copy and successful final cache move, then pause at the deterministic fixture move return before EXIT cleanup. Independently changed owner bytes, recreated owner, recreated payload, and recreated prepared directory+children all disappear. Every API call reports status0. Held nonfollowing descriptors verify UID/device/inode/type/mode/link count and expected bytes; saved original nodes remain unchanged.

Results: OwnerBytes held1/preserved0/reported0; OwnerRecreated1/0/0; PayloadRecreated1/0/0; DirectoryRecreated3/0/0. All four tests compiled and reached actual move; 0 passed; 4 failed; 0 ignored. This is a functional real-filesystem result, no performance claim. Exact API RED transcript.

Scratch regression recovery-cache-api-regression/tests/recovery_cache.rs; frozen exact-HEAD projection atomic-recovery-cache-red-source, provenance evidence/atomic-recovery-cache-red-source.json. No assertion weakened. Fix design must cover the whole prepared-cache lifecycle, including publication and interruption; a standalone pathname-only EXIT remover cannot remain outside the manifest/creation model. Overall round4 still incomplete; no push/deploy.

Confirmed actual-API cache-preparation cleanup finding, exact parent `e8f4ebb24405c1ee3d2552dc66dba9ee2c43e1e3`, no production changes. Four standalone tests call real `Installation::prepare_recovery`, use its actual payload digest/copy and successful final cache move, then pause at the deterministic fixture move return before EXIT cleanup. Independently changed owner bytes, recreated owner, recreated payload, and recreated prepared directory+children all disappear. Every API call reports status0. Held nonfollowing descriptors verify UID/device/inode/type/mode/link count and expected bytes; saved original nodes remain unchanged. Results: OwnerBytes held1/preserved0/reported0; OwnerRecreated1/0/0; PayloadRecreated1/0/0; DirectoryRecreated3/0/0. All four tests compiled and reached actual move; `0 passed; 4 failed; 0 ignored`. This is a functional real-filesystem result, no performance claim. [Exact API RED transcript](https://git.kayg.org/attachments/7d00e201-e88e-41a7-b5b3-9cbe00bb8168). Scratch regression `recovery-cache-api-regression/tests/recovery_cache.rs`; frozen exact-HEAD projection `atomic-recovery-cache-red-source`, provenance `evidence/atomic-recovery-cache-red-source.json`. No assertion weakened. Fix design must cover the whole prepared-cache lifecycle, including publication and interruption; a standalone pathname-only EXIT remover cannot remain outside the manifest/creation model. Overall round4 still incomplete; no push/deploy.

kayg commented

2026-10-20 05:57:25 +00:00

Author

Owner

Completed atomic parser-test step e72ad72925 (#231/#235): extend the existing shared SSH arbitrary-byte target and seed generator to V2 catalog framing. Exact canonical re-encoding, every truncation, duplicate/extra-LF rejection and cross-grammar rejection; V1 properties unchanged. HEAD-only projection plus these two files: manifest SHA256 5f79461bd2a721167d019ed412ce43db4c0899d8fcde88489941a5145f54dc48.

Gate: fmt, Python compilation, strict target Clippy and target build passed. Marker (verbatim):

ATOMIC_CATALOG_PROPERTIES_BUILD_GREEN

build log

VM fixed-count run completed 10000 executions without assertions: 294 generated seed files (148 V1, 146 V2; 292 nonempty). Exact executable cfc74c61c9439a3aa8cca56642fee09242dcac2afcfba6a8b4571d9008552c44; staged loader only, executable bytes unchanged. Ordinary executable: no sanitizer/coverage instrumentation, no coverage/throughput/RSS acceptance claimed. VM raw log, seed counts, stage pin.

Still incomplete: cache lifecycle four actual-API REDs; late rollback removes canonical producers before repeated admission; V2 producer/oracle; exhaustive product; profile qualification; final fast gate/size. No push/deploy.

Completed atomic parser-test step e72ad729259de2434006d79241d8b09fbff65bbf (#231/#235): extend the existing shared SSH arbitrary-byte target and seed generator to V2 catalog framing. Exact canonical re-encoding, every truncation, duplicate/extra-LF rejection and cross-grammar rejection; V1 properties unchanged. HEAD-only projection plus these two files: manifest SHA256 5f79461bd2a721167d019ed412ce43db4c0899d8fcde88489941a5145f54dc48. Gate: fmt, Python compilation, strict target Clippy and target build passed. Marker (verbatim): ``` ATOMIC_CATALOG_PROPERTIES_BUILD_GREEN ``` [build log](https://git.kayg.org/attachments/0b6f93da-5e84-4694-b939-d311b44f1888) VM fixed-count run completed 10000 executions without assertions: 294 generated seed files (148 V1, 146 V2; 292 nonempty). Exact executable cfc74c61c9439a3aa8cca56642fee09242dcac2afcfba6a8b4571d9008552c44; staged loader only, executable bytes unchanged. Ordinary executable: no sanitizer/coverage instrumentation, no coverage/throughput/RSS acceptance claimed. [VM raw log](https://git.kayg.org/attachments/a6daf966-fc76-409a-b9d4-051e23134ae7), [seed counts](https://git.kayg.org/attachments/cde3588a-c667-4b3d-9943-16a426a468e6), [stage pin](https://git.kayg.org/attachments/f1a21515-a4d2-4f31-babf-1f13387316c9). Still incomplete: cache lifecycle four actual-API REDs; late rollback removes canonical producers before repeated admission; V2 producer/oracle; exhaustive product; profile qualification; final fast gate/size. No push/deploy.

kayg commented

2026-10-20 06:09:58 +00:00

Author

Owner

Completed atomic shared binding step d0e59fde4f (#231/#235). Publication previously hashed one pathname and recorded a later inode: all 3 real regular/symlink/directory hash-time substitutions returned 0. The shared held-descriptor regular reader now refuses 71. pre-fix RED.

Reused one artifact binder; existing private proof 600/1MiB interfaces and final type/owner/inode predicates remain. Fixed cache wrappers add exact trusted upload size and held metadata equality; they are not cache lifecycle authority. Same-inode mode/size/link edits remain explicit baseline characterization for old proof wrappers, not a new safety claim.

Exact HEAD-only source projection plus this step passed fmt, syntax, strict all-target SSH Clippy, library 67 passed/0 failed/2 ignored, Rust wrapper 1 passed containing 10 direct controls, and the original both-mode argument-bound test 1 passed. Marker (verbatim):

ATOMIC_ARTIFACT_BINDING_GREEN

full gate, selected source/test pins.

Original committed activation command lengths: Rootless [38692,15920,16454], Root [66900,44151,16630]. These are source/argument byte counts, not performance. Current uncommitted larger activation source23 closure remains separately unqualified after this helper; no claim that it fits 130729's previous 342-byte margin. Raw two-module growth 1734 bytes; final static size/performance still pending. Four actual cache lifecycle REDs are unchanged; structural cache orchestration is being implemented in scratch, and terminal retirement needs a pre-rollback seal for every emitter-dependent private prefix. No push/deploy.

Completed atomic shared binding step d0e59fde4ffd4ea4b52f14012f157e4ba207c867 (#231/#235). Publication previously hashed one pathname and recorded a later inode: all 3 real regular/symlink/directory hash-time substitutions returned 0. The shared held-descriptor regular reader now refuses 71. [pre-fix RED](https://git.kayg.org/attachments/a8f85088-7ef1-49a1-8141-52e705ce3796). Reused one artifact binder; existing private proof 600/1MiB interfaces and final type/owner/inode predicates remain. Fixed cache wrappers add exact trusted upload size and held metadata equality; they are not cache lifecycle authority. Same-inode mode/size/link edits remain explicit baseline characterization for old proof wrappers, not a new safety claim. Exact HEAD-only source projection plus this step passed fmt, syntax, strict all-target SSH Clippy, library 67 passed/0 failed/2 ignored, Rust wrapper 1 passed containing 10 direct controls, and the original both-mode argument-bound test 1 passed. Marker (verbatim): ``` ATOMIC_ARTIFACT_BINDING_GREEN ``` [full gate](https://git.kayg.org/attachments/23295237-9856-4bff-a86c-27d8267d571e), [selected source/test pins](https://git.kayg.org/attachments/5613bf60-1d31-4e97-86b4-86e4c1c40eea). Original committed activation command lengths: Rootless [38692,15920,16454], Root [66900,44151,16630]. These are source/argument byte counts, not performance. Current uncommitted larger activation source23 closure remains separately unqualified after this helper; no claim that it fits 130729's previous 342-byte margin. Raw two-module growth 1734 bytes; final static size/performance still pending. Four actual cache lifecycle REDs are unchanged; structural cache orchestration is being implemented in scratch, and terminal retirement needs a pre-rollback seal for every emitter-dependent private prefix. No push/deploy.

kayg referenced this issue

2026-10-20 20:42:58 +00:00

Status board: work in flight (kept current) #24

kayg commented

2026-10-20 20:56:04 +00:00

Author

Owner

Release-9 triage found the missing-account-after-channel-open case still falls through to FailureKind::Install (crates/plugins/ssh/src/openssh.rs:449-482; the UI then uses the generic Connect message at apps/tracer/src/canvas/addhost/model.ts:52). Added a failing regression in diagnostics.rs, commit 3d53b61e6 (pushed on stability-triage). Focused result: 0 passed, 1 failed; observed Install, expected Auth.

Release-9 triage found the missing-account-after-channel-open case still falls through to `FailureKind::Install` (`crates/plugins/ssh/src/openssh.rs:449-482`; the UI then uses the generic Connect message at `apps/tracer/src/canvas/addhost/model.ts:52`). Added a failing regression in [diagnostics.rs](https://git.kayg.org/kayg/infraternal/src/branch/stability-triage/crates/plugins/ssh/tests/diagnostics.rs#L65), commit `3d53b61e6` (pushed on `stability-triage`). Focused result: 0 passed, 1 failed; observed `Install`, expected `Auth`.

kayg referenced this issue

2026-10-20 21:49:38 +00:00

Status board: work in flight (kept current) #24

~~kayg referenced this issue 2026-10-28 17:53:56 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg referenced this issue

2026-10-28 18:00:45 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg referenced this issue

2026-10-31 16:19:26 +00:00

infraternal up + one-command install #263

kayg referenced this issue