kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

Add host: SSH bootstrap commands use a 30 s wall clock, not a progress bound #378

New issue
Open
opened 2026-11-06 00:31:11 +00:00 by kayg · 33 comments
kayg commented 2026-11-06 00:31:11 +00:00
Owner
Copy link

J276: fix the production SSH bootstrap transfer deadline reported by J216b in #355 comment 81266. Related: #305. Follow D352 and #334: bound stalled progress without imposing a whole-transfer wall clock. Tests first; preserve fail-fast for short commands and dead links. No merge or deployment.

J276: fix the production SSH bootstrap transfer deadline reported by J216b in #355 comment 81266. Related: #305. Follow D352 and #334: bound stalled progress without imposing a whole-transfer wall clock. Tests first; preserve fail-fast for short commands and dead links. No merge or deployment.
kayg commented 2026-11-06 00:31:27 +00:00
Author
Owner
Copy link

J276 start: branch bootstrap-progress-bound-j276, base 442ac0f99. Plan (~90 minutes): trace process and duplex transfer bounds; write and run red regressions on a VM; implement byte-progress deadlines; run quick foreground and fast, record transfer-bound inventory and receipts; commit and push. No merge/deploy. Target directory: ~/worktrees/j276/target on the selected VM.

J276 start: branch bootstrap-progress-bound-j276, base 442ac0f99. Plan (~90 minutes): trace process and duplex transfer bounds; write and run red regressions on a VM; implement byte-progress deadlines; run quick foreground and fast, record transfer-bound inventory and receipts; commit and push. No merge/deploy. Target directory: ~/worktrees/j276/target on the selected VM.
kayg commented 2026-11-06 00:33:33 +00:00
Author
Owner
Copy link

Finding: process.rs execute_inner wraps the full upload in tokio::time::timeout(timeout, operation); the production timeout is 30 s. Other bootstrap wall clocks: bootstrap.rs attempt watcher (180 s, manifest::ATTEMPT_SECONDS), restart setup whole attempt (180 s), resolve_payload acquisition (up to 60 s); master connection/auth (30 s), ConnectTimeout=10, config query 3 s and key scans 5/3 s are short-command/connect bounds. Duplex uploads currently rely on the enclosing attempt deadline and have no local progress timer. Scope question for orchestrator: removing the outer 180 s upload cap requires bootstrap-level progress propagation beyond process.rs. Recommendation: follow up that broader attempt/acquisition policy separately; this job will fix the shared process upload bound and explicitly retain/report the remaining caps unless directed otherwise.

Finding: process.rs execute_inner wraps the full upload in tokio::time::timeout(timeout, operation); the production timeout is 30 s. Other bootstrap wall clocks: bootstrap.rs attempt watcher (180 s, manifest::ATTEMPT_SECONDS), restart setup whole attempt (180 s), resolve_payload acquisition (up to 60 s); master connection/auth (30 s), ConnectTimeout=10, config query 3 s and key scans 5/3 s are short-command/connect bounds. Duplex uploads currently rely on the enclosing attempt deadline and have no local progress timer. Scope question for orchestrator: removing the outer 180 s upload cap requires bootstrap-level progress propagation beyond process.rs. Recommendation: follow up that broader attempt/acquisition policy separately; this job will fix the shared process upload bound and explicitly retain/report the remaining caps unless directed otherwise.
kayg commented 2026-11-06 00:42:18 +00:00
Author
Owner
Copy link

Build-slot update: both VMs were busy; compute01 then reported a free slot. Cancelled J276 queued work on dev-02 before moving to compute01. Active VM worktree/only target: ~/worktrees/j276/target on compute01; evidence: ~/.cache/codex-scratch/j276/evidence/. No builds ran on dev-02 or the control host.

Build-slot update: both VMs were busy; compute01 then reported a free slot. Cancelled J276 queued work on dev-02 before moving to compute01. Active VM worktree/only target: ~/worktrees/j276/target on compute01; evidence: ~/.cache/codex-scratch/j276/evidence/. No builds ran on dev-02 or the control host.
kayg commented 2026-11-06 00:50:23 +00:00
Author
Owner
Copy link

Red evidence: compute01 ~/.cache/codex-scratch/j276/evidence/red.log: progressing_upload_outlives_thirty_seconds FAILED with "upload ended before chunk 4"; RED_EXIT=101. A real child consumes acknowledged chunks while Tokio time advances 10 s per chunk. The old total 30 s clock terminates that progressing upload. Initial quick stopped at fmt (quick-red.log); formatted before the red test. Implementing a latest-write timestamp per child; only successful nonempty stdin writes renew it, never output chatter.

Red evidence: compute01 ~/.cache/codex-scratch/j276/evidence/red.log: progressing_upload_outlives_thirty_seconds FAILED with "upload ended before chunk 4"; RED_EXIT=101. A real child consumes acknowledged chunks while Tokio time advances 10 s per chunk. The old total 30 s clock terminates that progressing upload. Initial quick stopped at fmt (quick-red.log); formatted before the red test. Implementing a latest-write timestamp per child; only successful nonempty stdin writes renew it, never output chatter.
kayg commented 2026-11-06 00:53:22 +00:00
Author
Owner
Copy link

Transfer-bound inventory (source evidence): process.rs execute_inner total command timeout (30 s production), fixed here for all stdin forms including File, Bytes, PayloadAndInvitation and Negotiated raw/gzip/zstd; bootstrap.rs:867-892 whole-attempt 180 s watcher and :452 restart attempt cap; bootstrap.rs:1097-1129 payload acquisition <=60 s; release_http.rs:30 whole-download 90 s (normally narrowed by acquisition). Duplex stage_session/send_transfer has no local wall clock, relying on the outer attempt. The existing contracts/ssh-bootstrap.md explicitly retains attempt and acquisition deadlines; those other files are outside this focused process change. Connection/auth/config/keyscan short bounds remain unchanged.

Transfer-bound inventory (source evidence): process.rs execute_inner total command timeout (30 s production), fixed here for all stdin forms including File, Bytes, PayloadAndInvitation and Negotiated raw/gzip/zstd; bootstrap.rs:867-892 whole-attempt 180 s watcher and :452 restart attempt cap; bootstrap.rs:1097-1129 payload acquisition <=60 s; release_http.rs:30 whole-download 90 s (normally narrowed by acquisition). Duplex stage_session/send_transfer has no local wall clock, relying on the outer attempt. The existing contracts/ssh-bootstrap.md explicitly retains attempt and acquisition deadlines; those other files are outside this focused process change. Connection/auth/config/keyscan short bounds remain unchanged.
kayg commented 2026-11-06 00:59:25 +00:00
Author
Owner
Copy link

Crash-safety checkpoint: WIP 2656f9b80 pushed to bootstrap-progress-bound-j276. Red regression is recorded; quick has completed workspace checking and is compiling/running changed-package unit tests on compute01. Next: process-suite green run, throttled real-sshd proof, rebase onto current dev, final gate. Logs: compute01 ~/.cache/codex-scratch/j276/evidence/. Only target: ~/worktrees/j276/target. WIP will become one verified atomic commit before handoff.

Crash-safety checkpoint: WIP 2656f9b80 pushed to bootstrap-progress-bound-j276. Red regression is recorded; quick has completed workspace checking and is compiling/running changed-package unit tests on compute01. Next: process-suite green run, throttled real-sshd proof, rebase onto current dev, final gate. Logs: compute01 ~/.cache/codex-scratch/j276/evidence/. Only target: ~/worktrees/j276/target. WIP will become one verified atomic commit before handoff.
kayg commented 2026-11-06 01:00:42 +00:00
Author
Owner
Copy link

Atomic implementation pushed: 3d7c8fca64, rebased onto dev 363d954687. Preliminary quick PASS, process suite 13/13, and real-sshd oracle PASS: PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete (real-ssh.log). Final-head foreground quick, process/real-sshd reruns and scripts/verify fast now queued/running through build-slot on compute01. Full Add host UI acceptance on test.ssh.kayg.org would require the orchestrator to deploy this branch; J276 does not deploy.

Atomic implementation pushed: 3d7c8fca64085d90232af9549979de7cf755ab06, rebased onto dev 363d95468701f0e5d58c0b3e7fca2c815936d839. Preliminary quick PASS, process suite 13/13, and real-sshd oracle PASS: PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete (real-ssh.log). Final-head foreground quick, process/real-sshd reruns and scripts/verify fast now queued/running through build-slot on compute01. Full Add host UI acceptance on test.ssh.kayg.org would require the orchestrator to deploy this branch; J276 does not deploy.
kayg commented 2026-11-06 01:08:03 +00:00
Author
Owner
Copy link

Author review finding: progressing_upload_outlives_thirty_seconds takes a joined path from a temporary common::ScratchRoot. The common helper documents that its owner must outlive children, particularly for the private fallback path. Hold that owner in the test until completion before handoff; no production change is needed. Current fast run remains on 079991ca0; a corrected final head will receive fresh verification. Final-head quick/process/real-sshd receipts for 079991ca0 are already green in *-final logs.

Author review finding: progressing_upload_outlives_thirty_seconds takes a joined path from a temporary common::ScratchRoot. The common helper documents that its owner must outlive children, particularly for the private fallback path. Hold that owner in the test until completion before handoff; no production change is needed. Current fast run remains on 079991ca0; a corrected final head will receive fresh verification. Final-head quick/process/real-sshd receipts for 079991ca0 are already green in *-final logs.
kayg commented 2026-11-06 01:26:15 +00:00
Author
Owner
Copy link

First full-gate finding on 079991ca0: workspace test unaffordable_repaints_park_until_sufficient_credit FAILED at crates/infraternal/tests/vt_credit.rs:33, case t1-gate-faithful-16384 (fast.log, test row 742s). Probe receipts copied out of target to compute01 ~/.cache/codex-scratch/j276/evidence/vt-credit-first/. The remaining gate rows are still running. Will run the exact test on unmodified dev 363d95468 to establish whether baseline also fails; no VT code or timeout change is planned in J276.

First full-gate finding on 079991ca0: workspace test unaffordable_repaints_park_until_sufficient_credit FAILED at crates/infraternal/tests/vt_credit.rs:33, case t1-gate-faithful-16384 (fast.log, test row 742s). Probe receipts copied out of target to compute01 ~/.cache/codex-scratch/j276/evidence/vt-credit-first/. The remaining gate rows are still running. Will run the exact test on unmodified dev 363d95468 to establish whether baseline also fails; no VT code or timeout change is planned in J276.
kayg commented 2026-11-06 01:28:27 +00:00
Author
Owner
Copy link

Progress checkpoint (~60 minutes into J276): pushed head remains 079991ca07; no uncommitted code or new production changes. First fast run is active through build-slot on compute01 (fast.log); its VT credit failure and raw probe receipts are recorded above, and later rows are still running. Next: retain the ScratchRoot owner in the new test, verify the corrected head, run the exact VT test on unmodified dev if needed, and measure direct static-size deltas. Only target remains ~/worktrees/j276/target. No merge/deploy.

Progress checkpoint (~60 minutes into J276): pushed head remains 079991ca07a625936f620416c71847f710c201c3; no uncommitted code or new production changes. First fast run is active through build-slot on compute01 (fast.log); its VT credit failure and raw probe receipts are recorded above, and later rows are still running. Next: retain the ScratchRoot owner in the new test, verify the corrected head, run the exact VT test on unmodified dev if needed, and measure direct static-size deltas. Only target remains ~/worktrees/j276/target. No merge/deploy.
kayg commented 2026-11-06 02:28:33 +00:00
Author
Owner
Copy link

j276 checkpoint: final atomic head 12b5bb725c33b3614ee82460c5cc8657c3c08280 is pushed on bootstrap-progress-bound-j276; worktree clean. final foreground scripts/verify fast is running through build-slot on compute01, evidence ~/.cache/codex-scratch/j276/evidence/fast-final.log. the vt_credit case that failed on the earlier head passed in this run. no claim that the earlier failure reproduces on baseline. qualified quick/process/private-fallback receipts remain alongside it. the final real-sshd oracle and direct parent/candidate static-size comparison follow this gate. no deployment or merge.

j276 checkpoint: final atomic head `12b5bb725c33b3614ee82460c5cc8657c3c08280` is pushed on `bootstrap-progress-bound-j276`; worktree clean. final foreground `scripts/verify fast` is running through build-slot on compute01, evidence `~/.cache/codex-scratch/j276/evidence/fast-final.log`. the vt_credit case that failed on the earlier head passed in this run. no claim that the earlier failure reproduces on baseline. qualified quick/process/private-fallback receipts remain alongside it. the final real-sshd oracle and direct parent/candidate static-size comparison follow this gate. no deployment or merge.
kayg commented 2026-11-06 02:55:45 +00:00
Author
Owner
Copy link

j276 final-head evidence: 12b5bb725c33b3614ee82460c5cc8657c3c08280 foreground fast finished FAST_EXIT=1. every summary row passed except privileged integration | FAIL (1). workspace tests and both static builds passed. final-head real-sshd oracle passed, REAL_EXIT=0, including PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete.

the privileged row fails PrivilegedAreas.test_gate_prints_skip_for_77: it expects plain|FAIL (77) but receives plain|SKIP. on unmodified parent 2eb38a21d01265fb746bfbce1c9def53bc8de108, the test passes standalone and fails with the identical assertion under RUST_GATE_SKIPPABLE=yes, the environment used by rust_run_gate_skippable in the actual gate. receipts: compute01 ~/.cache/codex-scratch/j276/evidence/{fast-final.log,real-head.log,baseline-privileged.log,baseline-privileged-context.log}. this existing gate-context failure is outside the SSH fix; no gate tooling changed. direct static-size measurements are running in the same target now. full output and attachments will follow in the finish comment.

j276 final-head evidence: `12b5bb725c33b3614ee82460c5cc8657c3c08280` foreground fast finished `FAST_EXIT=1`. every summary row passed except `privileged integration | FAIL (1)`. workspace tests and both static builds passed. final-head real-sshd oracle passed, `REAL_EXIT=0`, including `PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete`. the privileged row fails `PrivilegedAreas.test_gate_prints_skip_for_77`: it expects `plain|FAIL (77)` but receives `plain|SKIP`. on unmodified parent `2eb38a21d01265fb746bfbce1c9def53bc8de108`, the test passes standalone and fails with the identical assertion under `RUST_GATE_SKIPPABLE=yes`, the environment used by `rust_run_gate_skippable` in the actual gate. receipts: compute01 `~/.cache/codex-scratch/j276/evidence/{fast-final.log,real-head.log,baseline-privileged.log,baseline-privileged-context.log}`. this existing gate-context failure is outside the SSH fix; no gate tooling changed. direct static-size measurements are running in the same target now. full output and attachments will follow in the finish comment.
kayg commented 2026-11-06 03:12:32 +00:00
Author
Owner
Copy link

j276 implementation finished on bootstrap-progress-bound-j276, head 12b5bb725c33b3614ee82460c5cc8657c3c08280, one atomic commit pushed. no merge or deployment.

successful nonempty SSH stdin writes now renew the documented 30 s inactivity interval, including partial writes and all shared raw/framed/compressed payload paths. empty commands and signal waits retain their short total bounds; output chatter cannot renew the interval. existing cancellation, process-group ownership and output caps remain.

evidence attached: original-code red regression (RED_EXIT=101, stopped before chunk 4); final qualified foreground quick (QUICK_EXIT=0); all 13 process tests (PROCESS_EXIT=0), including the 80 s virtual upload and stalled-input expiry; private scratch fallback (FALLBACK_EXIT=0); final-head real sshd (REAL_EXIT=0), verifying 16 MiB over 256 throttled chunks beyond the old 30 s total bound. logs remain under compute01 and control ~/.cache/codex-scratch/j276/evidence/.

direct static-size comparison against unmodified parent 2eb38a21d01265fb746bfbce1c9def53bc8de108, same target and static recipe:

target parent bytes head bytes delta
x86_64 musl 27556144 27558416 +2272
aarch64 musl 24799648 24801344 +1696

final-head scripts/verify fast summary, verbatim (full output attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | FAIL (1)     |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
FAST_EXIT=1

the sole final gate failure is the existing skip-code self-test, reproduced on the unmodified parent with the gate's RUST_GATE_SKIPPABLE=yes context. it expects plain|FAIL (77) and receives plain|SKIP. standalone parent test passes. both receipts attached; no gate tooling changed. the earlier terminal-credit failure did not recur in the final workspace gate.

transfer-bound inventory is attached. outside this shared process runner, the whole bootstrap/restart attempt still has 180 s caps, payload acquisition <=60 s, release HTTP download 90 s, and duplex staging relies on the attempt cap. these can still interrupt sufficiently slow transfers. the contracts explicitly retain those outer caps; changing that policy needs a follow-up owner decision. short connect/auth/config/keyscan limits remain. no numbered decision or contract changed.

real Add host UI acceptance on test.ssh.kayg.org requires an orchestrator deployment. this task forbids deployment, so that acceptance remains for integration; the real SSH transport proof is attached.

parent terminal-credit check also passed (BASELINE_VT_EXIT=0, receipt attached). VM restored to the final head, clean; own-process sweep found no processes with a J276 worktree cwd/executable. the job target directory is removed after measurements; evidence remains outside it.

j276 implementation finished on `bootstrap-progress-bound-j276`, head `12b5bb725c33b3614ee82460c5cc8657c3c08280`, one atomic commit pushed. no merge or deployment. successful nonempty SSH stdin writes now renew the documented 30 s inactivity interval, including partial writes and all shared raw/framed/compressed payload paths. empty commands and signal waits retain their short total bounds; output chatter cannot renew the interval. existing cancellation, process-group ownership and output caps remain. evidence attached: original-code red regression (`RED_EXIT=101`, stopped before chunk 4); final qualified foreground quick (`QUICK_EXIT=0`); all 13 process tests (`PROCESS_EXIT=0`), including the 80 s virtual upload and stalled-input expiry; private scratch fallback (`FALLBACK_EXIT=0`); final-head real sshd (`REAL_EXIT=0`), verifying 16 MiB over 256 throttled chunks beyond the old 30 s total bound. logs remain under compute01 and control `~/.cache/codex-scratch/j276/evidence/`. direct static-size comparison against unmodified parent `2eb38a21d01265fb746bfbce1c9def53bc8de108`, same target and static recipe: | target | parent bytes | head bytes | delta | | --- | ---: | ---: | ---: | | x86_64 musl | 27556144 | 27558416 | +2272 | | aarch64 musl | 24799648 | 24801344 | +1696 | final-head `scripts/verify fast` summary, verbatim (full output attached): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | FAIL (1) | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ FAST_EXIT=1 ``` the sole final gate failure is the existing skip-code self-test, reproduced on the unmodified parent with the gate's `RUST_GATE_SKIPPABLE=yes` context. it expects `plain|FAIL (77)` and receives `plain|SKIP`. standalone parent test passes. both receipts attached; no gate tooling changed. the earlier terminal-credit failure did not recur in the final workspace gate. transfer-bound inventory is attached. outside this shared process runner, the whole bootstrap/restart attempt still has 180 s caps, payload acquisition <=60 s, release HTTP download 90 s, and duplex staging relies on the attempt cap. these can still interrupt sufficiently slow transfers. the contracts explicitly retain those outer caps; changing that policy needs a follow-up owner decision. short connect/auth/config/keyscan limits remain. no numbered decision or contract changed. real Add host UI acceptance on test.ssh.kayg.org requires an orchestrator deployment. this task forbids deployment, so that acceptance remains for integration; the real SSH transport proof is attached. parent terminal-credit check also passed (`BASELINE_VT_EXIT=0`, receipt attached). VM restored to the final head, clean; own-process sweep found no processes with a J276 worktree cwd/executable. the job target directory is removed after measurements; evidence remains outside it.
fast-final.log
758 KiB
baseline-privileged.log
166 B
baseline-privileged-context.log
921 B
real-head.log
850 B
red.log
8.9 KiB
green-qualified.log
2.7 KiB
quick-qualified.log
24 KiB
private-fallback.log
1.7 KiB
static-sizes.txt
766 B
baseline-vt.log
3.1 KiB
transfer-bounds.txt
1.5 KiB
kayg commented 2026-11-06 03:16:58 +00:00
Author
Owner
Copy link

J289 review start: target bootstrap-progress-bound-j276 @ 12b5bb725c, parent 2eb38a21d0. Plan (~60 minutes): inspect actual transport progress and outer transfer bounds, create a scratch merge with current origin/dev on dev-02 (free slot), run the changed process tests and real-sshd oracle, measure/verify payload size and slow-link cap calculation, post APPROVE or REQUEST CHANGES with evidence. No full gate rerun, push, merge to dev, or deployment.

J289 review start: target bootstrap-progress-bound-j276 @ 12b5bb725c33b3614ee82460c5cc8657c3c08280, parent 2eb38a21d01265fb746bfbce1c9def53bc8de108. Plan (~60 minutes): inspect actual transport progress and outer transfer bounds, create a scratch merge with current origin/dev on dev-02 (free slot), run the changed process tests and real-sshd oracle, measure/verify payload size and slow-link cap calculation, post APPROVE or REQUEST CHANGES with evidence. No full gate rerun, push, merge to dev, or deployment.
kayg commented 2026-11-06 03:25:28 +00:00
Author
Owner
Copy link

J289 review: REQUEST CHANGES

Target bootstrap-progress-bound-j276 @ 12b5bb725c33b3614ee82460c5cc8657c3c08280. Reviewed against D352, #334, J216b's #355 comment 81266 and J276's comment 81610. Tests ran on dev-02 scratch merge f001ae8ef2f5511b9bdaac70f2a372cc806bf8be, incorporating origin/dev 2ca748b8c07a5836462b380ef4e340d829731ec5. No push, integration merge or deployment.

  1. P1: local pipe writes are not downstream transfer progress (crates/plugins/ssh/src/process.rs:225–240, timer at 184–198). ProgressWriter timestamps successful ChildStdin::poll_write, so the interval can expire while bytes already buffered by SSH are still reaching the remote consumer. Real-sshd reproducer: send 40 KiB (fits in the buffering), consume 1 KiB each second remotely, and record every consumption to a receipt file. Receipts 0 through 29 were recorded, then The SSH operation timed out. terminated the command. The reader was continuously moving bytes. The author's 16 MiB test passes because its chunks keep the local writer backpressured; it misses this buffered-tail case. Use downstream byte acknowledgements/progress that remains observable until transfer completion, with a separately bounded completion exchange. Do not count keepalives or arbitrary output as progress.

    Verbatim reproducer output (real_ssh_review-qualified.log):

    REVIEW remote_read_receipts=0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,
REVIEW buffered_remote_progress error=Some(Failure { kind: Install, message: "The SSH operation timed out.", log_tail: [], failed_step: None, exit_status: None, already_added: false, missing_binary: None, fingerprints: [], host_key_type: None, host_key_changed: false, choose_method: false, ids: None })
healthy remote reader was killed while bytes kept moving
TEST_EXIT=1

  2. P1: the 180 s outer wall clock still cuts off a healthy upload (crates/plugins/ssh/src/bootstrap.rs:867–892, restart :452; manifest.rs:10). J276's retained direct static-size receipt gives x86 27,558,416 bytes and arm64 24,801,344 bytes. At 1,000,000 bit/s, raw transfer alone requires 220.467328 s and 198.410752 s, before protocol, connection, probe and installation overhead. Raw is a supported fallback when compressors are absent. Independently stat'ed an existing real x86 static executable on compute01: 27,572,528 bytes, SHA-256 c4548effc68f9902ea075a65626cc82d39e5f5dd75564577162824d7a6d9cd76, requiring 220.580224 s. The target's own static artifacts had already been deleted, so its exact head sizes are J276's retained measurement, not a fresh target rebuild. Remove the whole-transfer attempt cap in favor of progress bounds. Scaling to a larger fixed cap only moves the failure to a slower healthy link; a scaled policy would need an explicitly accepted minimum throughput and stage allowance. Confirmation is the only deadline renewal here, not transfer progress.

  3. P2: other bootstrap transfers still use whole-transfer clocks, and duplex staging has no 30 s inactivity bound. The inventory is accurate, but it prevents approval of an end-to-end progress-bound claim: bootstrap.rs:1097–1129 wraps payload acquisition in at most 60 s, crates/infraternal-server/src/release_http.rs:30 wraps the full HTTP download in 90 s, and install.rs:665–740,1322–1357 sends the early-session upload through Duplex, bypassing process::execute_inner and relying on the 180 s outer cap. A stalled duplex upload therefore has no new local 30 s inactivity detector. Apply byte-progress bounds through those paths too, or explicitly split the outstanding work and keep the Add host correction unapproved until it is covered. Existing contracts retaining those caps need reconciliation by the owner; this review changes no decision or contract.

Checks and evidence:

  • Changed process suite: 13 passed, PROCESS_EXIT=0, including 80 s virtual progress and stalled-input expiry (process.log).
  • Author's real-sshd upload: 16,777,216 bytes / 256 chunks, 1 passed, TEST_EXIT=0 (real_ssh-qualified.log).
  • Additional causal virtual-time test: consume all 64 KiB, acknowledge consumption, then never finish and emit only chatter. Timeout still fires; 2 passed including common scratch check, PROCESS_REVIEW_EXIT=0 (process-review.log). Thus dead-input and post-input hangs remain bounded in the shared process runner, and chatter does not reset its clock. This does not prove the same for the duplex path.
  • Dev-02 system OpenSSH 9.6 cannot run this synthetic fixture (unsupported PerSourcePenalties and fixture key format). Qualified real-sshd runs use the dev shell's OpenSSH 10.6 sshd/client/key utilities, with only their executable paths adapted. Exact adaptation and reproducer sources are attached; production source was untouched.
  • Size: acceptable. x86 +2,272 bytes (0.008245%), arm64 +1,696 bytes (0.006839%), same recipe against parent 2eb38a21d01265fb746bfbce1c9def53bc8de108. This overhead is small for a justified progress detector; no size blocker.
  • Read the author's complete gate log. Its verbatim exit is FAST_EXIT=1; the only failing summary row is | privileged integration | FAIL (1) |, and | static builds | PASS |. Comment 81610 documents the parent reproduction of the skip-flag bug; the requested newer dev is incorporated into the scratch merge. No full gate rerun: reviewer brief forbids it. No production code changed, gate not applicable to this review.

Artifacts: dev-02 ~/.cache/codex-scratch/j289/evidence/, copied to control /home/kayg/.cache/j289/vm-evidence/; author's full gate and static receipts plus independent stat receipt under /home/kayg/.cache/j289/. Attached archive retains the relevant logs, exact test sources, toolchain adaptation, heads, and slow-link calculation. Scratch worktree restored clean; own target deleted and all own runs completed. No live mesh state touched.

REQUEST CHANGES: fix downstream progress accounting and reconcile the remaining whole-transfer caps/duplex bounds before approval.

J289 review: **REQUEST CHANGES** Target `bootstrap-progress-bound-j276` @ `12b5bb725c33b3614ee82460c5cc8657c3c08280`. Reviewed against D352, #334, J216b's #355 comment 81266 and J276's comment 81610. Tests ran on dev-02 scratch merge `f001ae8ef2f5511b9bdaac70f2a372cc806bf8be`, incorporating origin/dev `2ca748b8c07a5836462b380ef4e340d829731ec5`. No push, integration merge or deployment. 1. **P1: local pipe writes are not downstream transfer progress** (`crates/plugins/ssh/src/process.rs:225–240`, timer at 184–198). `ProgressWriter` timestamps successful `ChildStdin::poll_write`, so the interval can expire while bytes already buffered by SSH are still reaching the remote consumer. Real-sshd reproducer: send 40 KiB (fits in the buffering), consume 1 KiB each second remotely, and record every consumption to a receipt file. Receipts 0 through 29 were recorded, then `The SSH operation timed out.` terminated the command. The reader was continuously moving bytes. The author's 16 MiB test passes because its chunks keep the local writer backpressured; it misses this buffered-tail case. Use downstream byte acknowledgements/progress that remains observable until transfer completion, with a separately bounded completion exchange. Do not count keepalives or arbitrary output as progress. Verbatim reproducer output (`real_ssh_review-qualified.log`): ```text REVIEW remote_read_receipts=0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29, REVIEW buffered_remote_progress error=Some(Failure { kind: Install, message: "The SSH operation timed out.", log_tail: [], failed_step: None, exit_status: None, already_added: false, missing_binary: None, fingerprints: [], host_key_type: None, host_key_changed: false, choose_method: false, ids: None }) healthy remote reader was killed while bytes kept moving TEST_EXIT=1 ``` 2. **P1: the 180 s outer wall clock still cuts off a healthy upload** (`crates/plugins/ssh/src/bootstrap.rs:867–892`, restart `:452`; `manifest.rs:10`). J276's retained direct static-size receipt gives x86 **27,558,416 bytes** and arm64 **24,801,344 bytes**. At 1,000,000 bit/s, raw transfer alone requires **220.467328 s** and **198.410752 s**, before protocol, connection, probe and installation overhead. Raw is a supported fallback when compressors are absent. Independently stat'ed an existing real x86 static executable on compute01: **27,572,528 bytes**, SHA-256 `c4548effc68f9902ea075a65626cc82d39e5f5dd75564577162824d7a6d9cd76`, requiring 220.580224 s. The target's own static artifacts had already been deleted, so its exact head sizes are J276's retained measurement, not a fresh target rebuild. Remove the whole-transfer attempt cap in favor of progress bounds. Scaling to a larger fixed cap only moves the failure to a slower healthy link; a scaled policy would need an explicitly accepted minimum throughput and stage allowance. Confirmation is the only deadline renewal here, not transfer progress. 3. **P2: other bootstrap transfers still use whole-transfer clocks, and duplex staging has no 30 s inactivity bound.** The inventory is accurate, but it prevents approval of an end-to-end progress-bound claim: `bootstrap.rs:1097–1129` wraps payload acquisition in at most 60 s, `crates/infraternal-server/src/release_http.rs:30` wraps the full HTTP download in 90 s, and `install.rs:665–740,1322–1357` sends the early-session upload through `Duplex`, bypassing `process::execute_inner` and relying on the 180 s outer cap. A stalled duplex upload therefore has no new local 30 s inactivity detector. Apply byte-progress bounds through those paths too, or explicitly split the outstanding work and keep the Add host correction unapproved until it is covered. Existing contracts retaining those caps need reconciliation by the owner; this review changes no decision or contract. Checks and evidence: - Changed process suite: **13 passed**, `PROCESS_EXIT=0`, including 80 s virtual progress and stalled-input expiry (`process.log`). - Author's real-sshd upload: **16,777,216 bytes / 256 chunks**, **1 passed**, `TEST_EXIT=0` (`real_ssh-qualified.log`). - Additional causal virtual-time test: consume all 64 KiB, acknowledge consumption, then never finish and emit only chatter. Timeout still fires; **2 passed** including common scratch check, `PROCESS_REVIEW_EXIT=0` (`process-review.log`). Thus dead-input and post-input hangs remain bounded in the shared process runner, and chatter does not reset its clock. This does not prove the same for the duplex path. - Dev-02 system OpenSSH 9.6 cannot run this synthetic fixture (unsupported `PerSourcePenalties` and fixture key format). Qualified real-sshd runs use the dev shell's OpenSSH 10.6 sshd/client/key utilities, with only their executable paths adapted. Exact adaptation and reproducer sources are attached; production source was untouched. - Size: **acceptable**. x86 +2,272 bytes (**0.008245%**), arm64 +1,696 bytes (**0.006839%**), same recipe against parent `2eb38a21d01265fb746bfbce1c9def53bc8de108`. This overhead is small for a justified progress detector; no size blocker. - Read the author's complete gate log. Its verbatim exit is `FAST_EXIT=1`; the only failing summary row is `| privileged integration | FAIL (1) |`, and `| static builds | PASS |`. Comment 81610 documents the parent reproduction of the skip-flag bug; the requested newer dev is incorporated into the scratch merge. **No full gate rerun: reviewer brief forbids it. No production code changed, gate not applicable to this review.** Artifacts: dev-02 `~/.cache/codex-scratch/j289/evidence/`, copied to control `/home/kayg/.cache/j289/vm-evidence/`; author's full gate and static receipts plus independent stat receipt under `/home/kayg/.cache/j289/`. Attached archive retains the relevant logs, exact test sources, toolchain adaptation, heads, and slow-link calculation. Scratch worktree restored clean; own target deleted and all own runs completed. No live mesh state touched. **REQUEST CHANGES**: fix downstream progress accounting and reconcile the remaining whole-transfer caps/duplex bounds before approval.
j289-review-evidence.tar.gz
134 KiB
kayg commented 2026-11-06 03:39:24 +00:00
Author
Owner
Copy link

j276 round 2 started on bootstrap-progress-bound-j276. previous head 12b5bb725c33b3614ee82460c5cc8657c3c08280; merged origin/dev 2ca748b8c07a5836462b380ef4e340d829731ec5 as 009e5cb92 and pushed. read review 81624 in full and its exact buffered-tail reproducer. compute01 only, std VMs untouched.

plan, estimate 180 minutes including clean VM builds/gates: (1) install J289's buffered-tail red test and add causal tests for outer attempt, acquisition, HTTP and duplex stalls; (2) downstream byte acknowledgements through upload completion, separate bounded completion exchange, never count arbitrary output/keepalive; (3) remove whole-transfer attempt/acquisition/download clocks and bound every transfer by inactivity, preserving short command/connect/confirmation bounds; (4) foreground quick then fast, real sshd proof, atomic commits/pushes, attach evidence and cleanup. the owner request explicitly authorizes replacing the formerly retained outer caps; reconcile affected contract prose without changing numbered decisions. no new engine/dependency, merge to dev or deployment.

j276 round 2 started on `bootstrap-progress-bound-j276`. previous head `12b5bb725c33b3614ee82460c5cc8657c3c08280`; merged origin/dev `2ca748b8c07a5836462b380ef4e340d829731ec5` as `009e5cb92` and pushed. read review 81624 in full and its exact buffered-tail reproducer. compute01 only, std VMs untouched. plan, estimate 180 minutes including clean VM builds/gates: (1) install J289's buffered-tail red test and add causal tests for outer attempt, acquisition, HTTP and duplex stalls; (2) downstream byte acknowledgements through upload completion, separate bounded completion exchange, never count arbitrary output/keepalive; (3) remove whole-transfer attempt/acquisition/download clocks and bound every transfer by inactivity, preserving short command/connect/confirmation bounds; (4) foreground quick then fast, real sshd proof, atomic commits/pushes, attach evidence and cleanup. the owner request explicitly authorizes replacing the formerly retained outer caps; reconcile affected contract prose without changing numbered decisions. no new engine/dependency, merge to dev or deployment.
kayg commented 2026-11-06 03:52:57 +00:00
Author
Owner
Copy link

j276 round-2 finding: setup_lock.sh:14 also uses exec sleep 180 for the transaction lease. it does not itself kill the transfer, but expires the directory-lock holder during an upload lasting >180 s, losing cross-command transaction protection. include byte-driven lease renewal in the authorized bootstrap-path fix, preserving bounded idle retirement and exact PID-birth/fd ownership. test-first fixture controls each lease interval instead of waiting real minutes. supporting source is in current head 009e5cb92; test tests/lease_progress.rs will prove renewal and no-progress retirement.

the red VM run is now active, target ~/worktrees/j276/target, evidence ~/.cache/codex-scratch/j276/evidence/r2/. initial quick stopped on formatting of new tests; final quick will be rerun after formatting. J289's exact real-sshd buffered-tail reader is compiling before production changes.

j276 round-2 finding: `setup_lock.sh:14` also uses `exec sleep 180` for the transaction lease. it does not itself kill the transfer, but expires the directory-lock holder during an upload lasting >180 s, losing cross-command transaction protection. include byte-driven lease renewal in the authorized bootstrap-path fix, preserving bounded idle retirement and exact PID-birth/fd ownership. test-first fixture controls each lease interval instead of waiting real minutes. supporting source is in current head `009e5cb92`; test `tests/lease_progress.rs` will prove renewal and no-progress retirement. the red VM run is now active, target `~/worktrees/j276/target`, evidence `~/.cache/codex-scratch/j276/evidence/r2/`. initial quick stopped on formatting of new tests; final quick will be rerun after formatting. J289's exact real-sshd buffered-tail reader is compiling before production changes.
kayg commented 2026-11-06 04:12:45 +00:00
Author
Owner
Copy link

round 2 checkpoint pushed at bac6a76e1 (WIP, to split/squash before completion). fresh red artifacts on compute01 under ~/.cache/codex-scratch/j276/evidence/r2/: buffered-red.log records receipts 0..29 then timeout; buffered-virtual-red.log fails the same buffered-tail scenario; http-red.log fails both a >90-second progressing body and 31-second stalled body. initial quick stops at test formatting. the transaction lease red and acquisition-over-180-second red are queued, with old production source retained on the VM until they finish.

implementation uses canonical remote consumed-byte counters, each bounded by the selected wire length. local SSH pipe writes never renew a timer. final acknowledgement starts its own completion interval. duplex staging reads counters concurrently with writes. HTTP body data saved to staging renews acquisition; empty frames/headers/keepalives do not. removing 180-second attempt/restart clocks and 60/90-second acquisition/download clocks; preserving separate connection, short-command, confirmation and authenticated readiness bounds. another fixed transfer-related bound is the 180-second remote lease, now being changed to renew only on the reader's atomically published byte counter.

compute01 has four busy slots and a long queue; std VMs remain untouched. one target only: /home/claude/worktrees/j276/target. no new dependency/engine or deployment.

round 2 checkpoint pushed at bac6a76e1 (WIP, to split/squash before completion). fresh red artifacts on compute01 under ~/.cache/codex-scratch/j276/evidence/r2/: buffered-red.log records receipts 0..29 then timeout; buffered-virtual-red.log fails the same buffered-tail scenario; http-red.log fails both a >90-second progressing body and 31-second stalled body. initial quick stops at test formatting. the transaction lease red and acquisition-over-180-second red are queued, with old production source retained on the VM until they finish. implementation uses canonical remote consumed-byte counters, each bounded by the selected wire length. local SSH pipe writes never renew a timer. final acknowledgement starts its own completion interval. duplex staging reads counters concurrently with writes. HTTP body data saved to staging renews acquisition; empty frames/headers/keepalives do not. removing 180-second attempt/restart clocks and 60/90-second acquisition/download clocks; preserving separate connection, short-command, confirmation and authenticated readiness bounds. another fixed transfer-related bound is the 180-second remote lease, now being changed to renew only on the reader's atomically published byte counter. compute01 has four busy slots and a long queue; std VMs remain untouched. one target only: /home/claude/worktrees/j276/target. no new dependency/engine or deployment.
kayg commented 2026-11-06 04:23:07 +00:00
Author
Owner
Copy link

round-2 red evidence on merged old production source (009e5cb92): J289's real-sshd buffered-tail reader records receipts 0..29 then times out; HTTP tests reject both the 90-second total clock and lack of 30-second body inactivity detection. the combined lease_progress target also runs isolated acquisition and duplex regressions: three new failures prove >180-second acquisition is cut off, a silent duplex setup receipt lacks a 30-second bound, and the fixed lease loses transaction protection despite real consumption. RED_EXIT=101 for the combined target. only a default no-progress trait method was added to let the old source compile the acquisition fixture; old timeout behavior was preserved.

checkpoint 80e061483 pushed. fixes are now synced to compute01 and foreground quick is compiling. full red logs attached; durable originals under ~/.cache/codex-scratch/j276/evidence/r2/ on compute01 and control. final atomic commits, real-sshd green and fast still pending.

round-2 red evidence on merged old production source (009e5cb92): J289's real-sshd buffered-tail reader records receipts 0..29 then times out; HTTP tests reject both the 90-second total clock and lack of 30-second body inactivity detection. the combined lease_progress target also runs isolated acquisition and duplex regressions: three new failures prove >180-second acquisition is cut off, a silent duplex setup receipt lacks a 30-second bound, and the fixed lease loses transaction protection despite real consumption. RED_EXIT=101 for the combined target. only a default no-progress trait method was added to let the old source compile the acquisition fixture; old timeout behavior was preserved. checkpoint 80e061483 pushed. fixes are now synced to compute01 and foreground quick is compiling. full red logs attached; durable originals under ~/.cache/codex-scratch/j276/evidence/r2/ on compute01 and control. final atomic commits, real-sshd green and fast still pending.
buffered-red.log
1.3 KiB
http-red.log
15 KiB
lease-red.log
3.5 KiB
kayg commented 2026-11-06 04:38:39 +00:00
Author
Owner
Copy link

measured the new remote reader under perf-run on the perf VM. exact old raw head/tee/hash pipeline versus acknowledged dd/chunk/tee/hash, four alternating samples of 16,777,200 public fixture bytes. medians: old 0.020742401 s, acknowledged 0.721995632 s, +0.701253231 s. the acknowledged path produced 256 canonical consumption receipts per sample, with identical verified SHA-256 output. BENCH_EXIT=0, no steal time. log attached; before/after quiet-state artifacts remain in ~/.cache/codex-scratch/j276/evidence/r2/reader-bench-final/ on the perf VM. harness and reader source retained under ~/.cache/codex-scratch/j276/ there.

this is a real fast-link cost, accepted here to make remote consumption observable without imposing a minimum throughput or adding a transport engine/dependency. memory/disk staging is one <=64 KiB temporary chunk per active transfer, at most 512 KiB for eight concurrent hosts; counters are bounded, and no full public payload is duplicated per host. slow short reads acknowledge immediately instead of waiting to fill 64 KiB. final gate and green real-sshd evidence remain pending in the compute01 queue.

measured the new remote reader under perf-run on the perf VM. exact old raw head/tee/hash pipeline versus acknowledged dd/chunk/tee/hash, four alternating samples of 16,777,200 public fixture bytes. medians: old 0.020742401 s, acknowledged 0.721995632 s, +0.701253231 s. the acknowledged path produced 256 canonical consumption receipts per sample, with identical verified SHA-256 output. BENCH_EXIT=0, no steal time. log attached; before/after quiet-state artifacts remain in ~/.cache/codex-scratch/j276/evidence/r2/reader-bench-final/ on the perf VM. harness and reader source retained under ~/.cache/codex-scratch/j276/ there. this is a real fast-link cost, accepted here to make remote consumption observable without imposing a minimum throughput or adding a transport engine/dependency. memory/disk staging is one <=64 KiB temporary chunk per active transfer, at most 512 KiB for eight concurrent hosts; counters are bounded, and no full public payload is duplicated per host. slow short reads acknowledge immediately instead of waiting to fill 64 KiB. final gate and green real-sshd evidence remain pending in the compute01 queue.
reader-bench-final.log
1.3 KiB
kayg commented 2026-11-06 04:43:48 +00:00
Author
Owner
Copy link

checkpoint 588f789c0 is pushed, still WIP while foreground verification iterates. the new private-barrier regression is red: duplicate PAYLOAD ready without consumed-byte counters actually released synthetic invitation input (barrier-red.log, RED_EXIT=101). the guard now requires complete validated acknowledgement before readiness can release private stdin. lease children explicitly close the upload progress descriptor, and chunk files are retired between reads so the install shell keeps noclobber enabled.

quick has caught a naming lint and the ordinary release_latest caller of download(); fixes are synced. the current foreground compute01 slot request runs quick, targeted SSH/process/install/acquisition/lease/duplex suites and real sshd. logs under ~/.cache/codex-scratch/j276/evidence/r2/; one target at ~/worktrees/j276/target. no own work runs on std VMs. latest fetched dev is fcdd353b91, whose changes do not overlap this slice; merge it before the final gate after squashing WIP into atomic commits.

checkpoint 588f789c0 is pushed, still WIP while foreground verification iterates. the new private-barrier regression is red: duplicate PAYLOAD ready without consumed-byte counters actually released synthetic invitation input (barrier-red.log, RED_EXIT=101). the guard now requires complete validated acknowledgement before readiness can release private stdin. lease children explicitly close the upload progress descriptor, and chunk files are retired between reads so the install shell keeps noclobber enabled. quick has caught a naming lint and the ordinary release_latest caller of download(); fixes are synced. the current foreground compute01 slot request runs quick, targeted SSH/process/install/acquisition/lease/duplex suites and real sshd. logs under ~/.cache/codex-scratch/j276/evidence/r2/; one target at ~/worktrees/j276/target. no own work runs on std VMs. latest fetched dev is fcdd353b9158d2852920a1222f870e22c6538200, whose changes do not overlap this slice; merge it before the final gate after squashing WIP into atomic commits.
kayg commented 2026-11-06 05:17:58 +00:00
Author
Owner
Copy link

round 2 checkpoint: bootstrap-progress-bound-j276 @ e3d6c9b51. compute01 foreground quick is running after fixing compile/doc/lint findings. No green gate claimed. The held build slot will run targeted process/install/acquisition/lease/duplex tests and the real-sshd oracle after quick passes. Logs: compute01 ~/.cache/codex-scratch/j276/evidence/r2/; sole target ~/worktrees/j276/target.

Removed the old whole-attempt test API. Existing rollback fixtures now simulate independently bounded SSH commands. Their old include layout required conventional module paths to support D345 module documentation; formatting now reaches their child modules too. Remote readiness must follow complete byte acknowledgement before private input is released (red regression retained in barrier-red.log).

Latest dev is 0aad23e1c; it will be merged before final quick then fast. WIP commits will be consolidated into logical changes after verification. No merge to dev or deployment.

round 2 checkpoint: `bootstrap-progress-bound-j276` @ `e3d6c9b51`. compute01 foreground quick is running after fixing compile/doc/lint findings. No green gate claimed. The held build slot will run targeted process/install/acquisition/lease/duplex tests and the real-sshd oracle after quick passes. Logs: compute01 `~/.cache/codex-scratch/j276/evidence/r2/`; sole target `~/worktrees/j276/target`. Removed the old whole-attempt test API. Existing rollback fixtures now simulate independently bounded SSH commands. Their old include layout required conventional module paths to support D345 module documentation; formatting now reaches their child modules too. Remote readiness must follow complete byte acknowledgement before private input is released (red regression retained in `barrier-red.log`). Latest dev is `0aad23e1c`; it will be merged before final quick then fast. WIP commits will be consolidated into logical changes after verification. No merge to dev or deployment.
kayg commented 2026-11-06 05:40:57 +00:00
Author
Owner
Copy link

round 2: consolidated implementation 56efde8ec, merged current origin/dev 0aad23e1c and pushed head 977601e875. Final compute01 foreground verify quick then verify fast is running. No merge to dev or deployment.

Retained targeted result (same implementation tree before the unrelated current-dev merge): 126 passed, 0 failed, 2 ignored, TARGETED_EXIT=0. Includes 104 install cases, 16 process cases, silent duplex expiry, the consumed-byte lease and acquisition tests. Virtual-clock transfers last 240 seconds (process/duplex) and 200 seconds (acquisition). The private-input regression first failed (barrier-red.log) and now passes: readiness alone cannot release invitation stdin without complete byte receipts. Prior buffered-tail, HTTP and lease/acquisition red evidence is in comment 81709.

Real rootless sshd oracle: 1 passed, 0 failed, REAL_EXIT=0:

PROOF real_sshd buffered_tail bytes=40960 consumed_chunks=40 complete
PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete
PROOF real_sshd never_answering_host bounded_after_tcp_acceptance virtual_seconds=31

J289's buffered-tail reader now completes. A real TCP-accepted host with no SSH banner still expires using the virtual contract clock. Completion hangs and chatter have separate causal virtual-time regressions; only canonical increasing byte counters renew a transfer.

Quick pre-check before the unrelated dev merge: SSH 120 passed, server 553 passed, no failures, QUICK_EXIT=0. Final-head quick/fast results will follow. Targeted harness's missing recovery-helper prerequisite and direct-shell process-group mismatch were diagnosed and corrected; diagnostic/failure logs remain under compute01 ~/.cache/codex-scratch/j276/evidence/r2/. The existing streaming regression reserves the final bounded chunk, allowing the real decoder's block boundary before asserting output/hash progress.

Transfer inventory and policy:

  • Direct raw/compressed and negotiated SSH staging, recovery-cache refresh, early duplex staging: exact remote consumed wire-byte counters, 30 seconds without increase, separate 30-second verification/completion exchange.
  • Payload acquisition and all release object downloads (manifest, signature, version/binary): actual nonempty body bytes saved; 30-second inactivity, no aggregate 60/90-second cap.
  • Full attempt and restart: removed the 180-second whole-transfer caps, without raising them.
  • Remote setup lease: checks consumed bytes every 180 seconds and renews only on an increase; an abandoned lease retires within two sampling intervals. Active caller stalls fail after 30 seconds.
  • Retained non-transfer bounds: independently bounded short SSH commands and connection/auth exchanges; <=64 KiB duplex setup-script frame and canonical receipt exchanges (30 seconds); HTTP connect/TLS/headers/storage completion (30 seconds); confirmation and authenticated readiness/proof have independent limits. The post-transfer final proof/commit ceiling remains 180 seconds and cannot truncate an upload. One-use credential expiry is unchanged.

The measured fast-link shell-reader cost is recorded in comment 81729 (old median 0.020742401 s, receipts 0.721995632 s for 16,777,200 bytes, +0.701253231 s). No new engine or dependency was selected. Sole target remains compute01 ~/worktrees/j276/target; evidence is preserved separately.

round 2: consolidated implementation `56efde8ec`, merged current origin/dev `0aad23e1c` and pushed head **977601e875b019007122fbe73e8cdb40d9387cf0**. Final compute01 foreground `verify quick` then `verify fast` is running. No merge to dev or deployment. Retained targeted result (same implementation tree before the unrelated current-dev merge): **126 passed, 0 failed, 2 ignored**, `TARGETED_EXIT=0`. Includes 104 install cases, 16 process cases, silent duplex expiry, the consumed-byte lease and acquisition tests. Virtual-clock transfers last 240 seconds (process/duplex) and 200 seconds (acquisition). The private-input regression first failed (`barrier-red.log`) and now passes: readiness alone cannot release invitation stdin without complete byte receipts. Prior buffered-tail, HTTP and lease/acquisition red evidence is in comment 81709. Real rootless sshd oracle: **1 passed, 0 failed**, `REAL_EXIT=0`: ``` PROOF real_sshd buffered_tail bytes=40960 consumed_chunks=40 complete PROOF real_sshd progressing_upload bytes=16777216 chunks=256 complete PROOF real_sshd never_answering_host bounded_after_tcp_acceptance virtual_seconds=31 ``` J289's buffered-tail reader now completes. A real TCP-accepted host with no SSH banner still expires using the virtual contract clock. Completion hangs and chatter have separate causal virtual-time regressions; only canonical increasing byte counters renew a transfer. Quick pre-check before the unrelated dev merge: SSH **120 passed**, server **553 passed**, no failures, `QUICK_EXIT=0`. Final-head quick/fast results will follow. Targeted harness's missing recovery-helper prerequisite and direct-shell process-group mismatch were diagnosed and corrected; diagnostic/failure logs remain under compute01 `~/.cache/codex-scratch/j276/evidence/r2/`. The existing streaming regression reserves the final bounded chunk, allowing the real decoder's block boundary before asserting output/hash progress. Transfer inventory and policy: - Direct raw/compressed and negotiated SSH staging, recovery-cache refresh, early duplex staging: exact remote consumed wire-byte counters, 30 seconds without increase, separate 30-second verification/completion exchange. - Payload acquisition and all release object downloads (manifest, signature, version/binary): actual nonempty body bytes saved; 30-second inactivity, no aggregate 60/90-second cap. - Full attempt and restart: removed the 180-second whole-transfer caps, without raising them. - Remote setup lease: checks consumed bytes every 180 seconds and renews only on an increase; an abandoned lease retires within two sampling intervals. Active caller stalls fail after 30 seconds. - Retained non-transfer bounds: independently bounded short SSH commands and connection/auth exchanges; <=64 KiB duplex setup-script frame and canonical receipt exchanges (30 seconds); HTTP connect/TLS/headers/storage completion (30 seconds); confirmation and authenticated readiness/proof have independent limits. The post-transfer final proof/commit ceiling remains 180 seconds and cannot truncate an upload. One-use credential expiry is unchanged. The measured fast-link shell-reader cost is recorded in comment 81729 (old median 0.020742401 s, receipts 0.721995632 s for 16,777,200 bytes, +0.701253231 s). No new engine or dependency was selected. Sole target remains compute01 `~/worktrees/j276/target`; evidence is preserved separately.
targeted-green.log
12 KiB
real-green.log
1.1 KiB
barrier-red.log
2.3 KiB
quick-green.log
85 KiB
kayg commented 2026-11-06 06:10:33 +00:00
Author
Owner
Copy link

final-head progress: 977601e875b019007122fbe73e8cdb40d9387cf0 is pushed, worktree clean. verify quick completed with QUICK_EXIT=0 on that head. Foreground verify fast is running on compute01 in the same sole target (~/worktrees/j276/target); workspace test results have no failures so far, and it is currently in the SSH earlier-attempt shell fixtures. This is progress, not a completed gate claim.

Final logs: compute01 ~/.cache/codex-scratch/j276/evidence/r2/{quick-final.log,fast-final.log,final-head.txt}. Targeted/real evidence is attached in comment 81780. After the full gate, measure both static deltas against merged dev 0aad23e1c with the same recipe and target, retain evidence, then delete the job target. No remaining code changes planned; no deployment or merge to dev.

final-head progress: `977601e875b019007122fbe73e8cdb40d9387cf0` is pushed, worktree clean. `verify quick` completed with `QUICK_EXIT=0` on that head. Foreground `verify fast` is running on compute01 in the same sole target (`~/worktrees/j276/target`); workspace test results have no failures so far, and it is currently in the SSH earlier-attempt shell fixtures. This is progress, not a completed gate claim. Final logs: compute01 `~/.cache/codex-scratch/j276/evidence/r2/{quick-final.log,fast-final.log,final-head.txt}`. Targeted/real evidence is attached in comment 81780. After the full gate, measure both static deltas against merged dev `0aad23e1c` with the same recipe and target, retain evidence, then delete the job target. No remaining code changes planned; no deployment or merge to dev.
kayg commented 2026-11-06 06:26:28 +00:00
Author
Owner
Copy link

final-head gate findings, head 977601e87: workspace server tests reported 932 passed, 2 failed, 57 ignored. Fast continues through its remaining checks, so no completed final gate result yet.

  1. My adapted Replace timeout fixture retained the old whole-attempt clock's text assertion. The bounded command correctly emits a named connection failure (Failure::at(Connect)), which sanitizes the timeout wording. It reproduces in isolation (restore-isolated.log, ISOLATED_EXIT=101). Fix prepared: assert the failed event's typed Connect boundary, retain the actual restore-script and as-found filesystem/service assertions. The command is deliberately never released, so removing its timeout still prevents test completion. No production behavior change is needed.
  2. Unchanged mesh storage diagnostics captured 0 tracing events instead of 2 in the full parallel suite. All 13 storage diagnostic tests, including that exact case, pass in isolation (storage-isolated.log, STORAGE_EXIT=0). No change to mesh diagnostics is proposed in this upload task. The next complete final-head gate will retain any recurrence explicitly; a passing isolated run does not turn the failed full row green.

After the first fast completes, verify/commit/push the fixture assertion correction and run final quick then fast again. All previous failure logs are retained. The progress regressions and real sshd evidence remain in comment 81780.

final-head gate findings, head `977601e87`: workspace server tests reported **932 passed, 2 failed, 57 ignored**. Fast continues through its remaining checks, so no completed final gate result yet. 1. My adapted Replace timeout fixture retained the old whole-attempt clock's text assertion. The bounded command correctly emits a named connection failure (`Failure::at(Connect)`), which sanitizes the timeout wording. It reproduces in isolation (`restore-isolated.log`, `ISOLATED_EXIT=101`). Fix prepared: assert the failed event's typed Connect boundary, retain the actual restore-script and as-found filesystem/service assertions. The command is deliberately never released, so removing its timeout still prevents test completion. No production behavior change is needed. 2. Unchanged mesh storage diagnostics captured 0 tracing events instead of 2 in the full parallel suite. All **13** storage diagnostic tests, including that exact case, pass in isolation (`storage-isolated.log`, `STORAGE_EXIT=0`). No change to mesh diagnostics is proposed in this upload task. The next complete final-head gate will retain any recurrence explicitly; a passing isolated run does not turn the failed full row green. After the first fast completes, verify/commit/push the fixture assertion correction and run final quick then fast again. All previous failure logs are retained. The progress regressions and real sshd evidence remain in comment 81780.
restore-isolated.log
857 B
storage-isolated.log
1.8 KiB
kayg commented 2026-11-06 06:36:08 +00:00
Author
Owner
Copy link

assertion correction committed and pushed atomically: 9573d38e4c. All 14 stuck-install rollback tests pass (RESTORE_EXIT=0), including the command-timeout case and actual as-found filesystem/service restoration.

Stopped the earlier known-failed fast run before static builds to avoid duplicating the remaining expensive work. Its full retained output is fast-first-stopped.log, explicitly marked STOPPED_AFTER_TWO_TEST_FAILURES=130; this is not a green or completed gate. The previously reported parallel mesh tracing-capture failure remains unchanged code and its isolated 13-test pass is attached in comment 81816.

Final quick then fast is now running in the foreground on pushed head 9573d38e4, compute01, same sole target. No production code changed after the already passing transfer/real-sshd evidence in comment 81780. Final gate logs and the direct static delta against merged dev will follow. No deployment or merge to dev.

assertion correction committed and pushed atomically: **9573d38e4ca2498d8df8ce33f6f8e14cc53284fe**. All **14** stuck-install rollback tests pass (`RESTORE_EXIT=0`), including the command-timeout case and actual as-found filesystem/service restoration. Stopped the earlier known-failed fast run before static builds to avoid duplicating the remaining expensive work. Its full retained output is `fast-first-stopped.log`, explicitly marked `STOPPED_AFTER_TWO_TEST_FAILURES=130`; this is not a green or completed gate. The previously reported parallel mesh tracing-capture failure remains unchanged code and its isolated 13-test pass is attached in comment 81816. Final **quick then fast** is now running in the foreground on pushed head `9573d38e4`, compute01, same sole target. No production code changed after the already passing transfer/real-sshd evidence in comment 81780. Final gate logs and the direct static delta against merged dev will follow. No deployment or merge to dev.
restore-green.log
7.1 KiB
fast-first-stopped.log
728 KiB
kayg commented 2026-11-06 07:02:24 +00:00
Author
Owner
Copy link

final-head progress, 9573d38e4c: completed verify quick, QUICK_EXIT=0, log attached. The full fast rerun is active in the foreground on compute01 and has no reported failed tests so far; it is currently in the full-feature server suite. No complete fast result is claimed.

Worktree remains clean. The only change after 977601e87 is the rollback fixture's typed failure assertion, verified with all 14 stuck-install rollback tests in comment 81823. Implementation and real-sshd evidence are unchanged. Remaining work: finish fast, record the direct x86/arm64 static delta against merged dev 0aad23e1c, post verbatim gate output, and remove the sole job target. Gate reruns have extended this beyond the initial three-hour estimate; scope remains the same and below the brief's twice-estimate stop threshold.

final-head progress, **9573d38e4ca2498d8df8ce33f6f8e14cc53284fe**: completed `verify quick`, **QUICK_EXIT=0**, log attached. The full fast rerun is active in the foreground on compute01 and has no reported failed tests so far; it is currently in the full-feature server suite. No complete fast result is claimed. Worktree remains clean. The only change after `977601e87` is the rollback fixture's typed failure assertion, verified with all 14 stuck-install rollback tests in comment 81823. Implementation and real-sshd evidence are unchanged. Remaining work: finish fast, record the direct x86/arm64 static delta against merged dev `0aad23e1c`, post verbatim gate output, and remove the sole job target. Gate reruns have extended this beyond the initial three-hour estimate; scope remains the same and below the brief's twice-estimate stop threshold.
quick-final.log
85 KiB
kayg commented 2026-11-06 07:43:22 +00:00
Author
Owner
Copy link

J276 round 2 follow-up, 13:13 IST. Pushed e596bbfe077101ac8d739186b5b772b7ded1c8c2 on bootstrap-progress-bound-j276.

The full verify fast on preceding head 9573d38e4 completed with every Rust summary row PASS and FAST_EXIT=0. A further release-only compile check exposed a regression in my HTTP change: the shared downloader imported its constant from the optional SSH crate. The failing check produced E0433 with FEATURE_RED_EXIT=101. Replaced that import with a documented local 30-second policy, keeping release-only builds independent of SSH. The same compile now returns FEATURE_GREEN_EXIT=0; all five focused HTTP tests pass (HTTP_GREEN_EXIT=0), including virtual-time slow-body and stalled-body cases; FMT_EXIT=0.

Final-head quick then fast is running in the foreground on compute01, in the same sole target /home/claude/worktrees/j276/target, through the held build slot. No std VM work, deployment, or integration merge. Attached red/green logs retain the commands and outputs.

J276 round 2 follow-up, 13:13 IST. Pushed `e596bbfe077101ac8d739186b5b772b7ded1c8c2` on `bootstrap-progress-bound-j276`. The full `verify fast` on preceding head `9573d38e4` completed with every Rust summary row PASS and `FAST_EXIT=0`. A further release-only compile check exposed a regression in my HTTP change: the shared downloader imported its constant from the optional SSH crate. The failing check produced E0433 with `FEATURE_RED_EXIT=101`. Replaced that import with a documented local 30-second policy, keeping release-only builds independent of SSH. The same compile now returns `FEATURE_GREEN_EXIT=0`; all five focused HTTP tests pass (`HTTP_GREEN_EXIT=0`), including virtual-time slow-body and stalled-body cases; `FMT_EXIT=0`. Final-head quick then fast is running in the foreground on compute01, in the same sole target `/home/claude/worktrees/j276/target`, through the held build slot. No std VM work, deployment, or integration merge. Attached red/green logs retain the commands and outputs.
feature-red.log
3.8 KiB
feature-green.log
8.8 KiB
kayg commented 2026-11-06 08:12:59 +00:00
Author
Owner
Copy link

J276 progress, 13:43 IST. Final-head scripts/verify quick passed on e596bbfe077101ac8d739186b5b772b7ded1c8c2, QUICK_EXIT=0 (attached exact output). scripts/verify fast is running in the foreground on compute01 under the held build slot, same sole target /home/claude/worktrees/j276/target. It has reached the full server suite, with no failed test reported so far; this is not a completed gate claim. Code is clean and pushed. Next: finish fast, measure both static head/base deltas against merged dev 0aad23e1c, preserve receipts, remove the sole target and release the slot. No deployment or integration merge.

J276 progress, 13:43 IST. Final-head `scripts/verify quick` passed on `e596bbfe077101ac8d739186b5b772b7ded1c8c2`, `QUICK_EXIT=0` (attached exact output). `scripts/verify fast` is running in the foreground on compute01 under the held build slot, same sole target `/home/claude/worktrees/j276/target`. It has reached the full server suite, with no failed test reported so far; this is not a completed gate claim. Code is clean and pushed. Next: finish fast, measure both static head/base deltas against merged dev `0aad23e1c`, preserve receipts, remove the sole target and release the slot. No deployment or integration merge.
quick-final.log
84 KiB
kayg commented 2026-11-06 08:36:28 +00:00
Author
Owner
Copy link

J276 final-head gate, 14:06 IST. scripts/verify quick then scripts/verify fast both passed on pushed head e596bbfe077101ac8d739186b5b772b7ded1c8c2. Full exact fast output is attached; verbatim summary follows. Server suite: 934 passed, 0 failed, 57 ignored. Both static images have no PT_INTERP. No code changes during verification.

The same held build slot is now building merged dev 0aad23e1c in the same sole target to measure per-architecture deltas. The script restores final head on exit. Size receipts and cleanup are pending, so this is a gate milestone rather than the final handoff.

| Rust gate                 | Result       |
+---------------------------+--------------+

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [7.68s]
FAST_EXIT=0
J276 final-head gate, 14:06 IST. `scripts/verify quick` then `scripts/verify fast` both passed on pushed head `e596bbfe077101ac8d739186b5b772b7ded1c8c2`. Full exact fast output is attached; verbatim summary follows. Server suite: 934 passed, 0 failed, 57 ignored. Both static images have no PT_INTERP. No code changes during verification. The same held build slot is now building merged dev `0aad23e1c` in the same sole target to measure per-architecture deltas. The script restores final head on exit. Size receipts and cleanup are pending, so this is a gate milestone rather than the final handoff. ```text | Rust gate | Result | +---------------------------+--------------+ 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [7.68s] FAST_EXIT=0 ```
fast-final.log
864 KiB
gate-summary.log
180 B
kayg commented 2026-11-06 08:51:39 +00:00
Author
Owner
Copy link

J276 round 2 complete on bootstrap-progress-bound-j276, head e596bbfe077101ac8d739186b5b772b7ded1c8c2. Incorporated dev through 0aad23e1c02778705c1b69abb4f92edaab3072b9. No integration merge or deployment; leaving #378 open for review.

Addressed J289 comment 81624:

  • P1 downstream progress: production uploads now carry canonical, strictly increasing remote consumed-byte receipts bounded by the selected wire length. Local pipe writes, output chatter and keepalives cannot renew the 30-second inactivity interval. The final receipt begins a separate bounded verification/completion exchange. The private invitation remains behind payload verification.
  • P1 attempt cap: removed the 180-second host/restart whole-attempt cap instead of increasing it. Per-command/exchange bounds remain. The separate authenticated proof/commit ceiling starts after payload transfers.
  • P2 inventory: direct raw/compressed uploads, negotiated uploads, recovery-cache refresh and duplex staging all consume remote counters. Duplex reads and writes concurrently, with bounded selection, inactivity and completion. Removed the 60-second acquisition and 90-second HTTP whole-download clocks. Acquisition observes actual byte changes; HTTP renews only on nonempty body data saved. Connect, TLS, headers, storage completion and other short commands retain independent bounds. Sources without byte observations keep a short acquisition bound. Confirmation and one-use credential expiry remain independent.

Test-first evidence is attached in comments 81709 and 81780. J289's real-sshd 40 KiB buffered-tail reproduction failed against the old implementation and now succeeds with all 40 consumed chunks. The same real-sshd oracle also completes 16 MiB/256 chunks and bounds a host that accepts TCP but never answers after 31 virtual seconds (real-green.log, REAL_EXIT=0). These are rootless real-sshd transport proofs. The gate's privileged user-namespace tests cover installation containment; they do not prove a system host-directory installation under real uid 0.

Targeted receipt: 126 passed, 0 failed, 2 ignored (targeted-green.log, TARGETED_EXIT=0). Direct/duplex transfers progress for 240 virtual seconds; acquisition progresses for 200 virtual seconds. Stalled transfer, acquisition and HTTP bodies expire without a whole-transfer timer. HTTP slow-body/stall tests and release-only compile pass (feature-green.log). The optional-feature compile regression was first captured as E0433 (feature-red.log) and fixed in the final atomic commit. Rollback retains its named failed step and as-found restoration assertions (restore-green.log, 14 passed).

Performance receipt: reader-bench-final.log, perf-run exit 0, zero steal, four alternating pipe-fed 16,777,200-byte samples. Median old reader 0.020742401 s, acknowledged reader 0.721995632 s, +0.701253231 s. This reader-only cost buys remote short-read observations without introducing a new transport or engine. It is not an end-to-end SSH latency measurement.

Final-head gates on compute01 completed in order: QUICK_EXIT=0, then FAST_EXIT=0. The full quick log is attached in comment 81910 and the full fast log in comment 81930. My earlier generated summary attachment stopped at its header separator; the corrected complete verbatim table is below and in final-receipts.log. No gate rerun or code change was involved in correcting the extraction.

Static sizes from the same recipe, same target and same compute01 build slot, against merged dev 0aad23e1c (static-delta.log, SIZE_EXIT=0):

Architecture Final head bytes Merged dev bytes Delta bytes
x86_64 musl 27,741,232 27,713,264 +27,968
aarch64 musl 24,959,904 24,933,184 +26,720

Final image SHA-256 receipts and both baseline build logs are attached. Both final images passed the gate's static linkage checks with PT_INTERP absent. The baseline comparison restored final head. Control and VM worktrees are clean, and the remote branch resolves to the reported head.

Cleanup completed at 14:20 IST: held build-slot shell exited, process audit found no process using this worktree or its binaries, and /home/claude/worktrees/j276/target was removed. Logs remain under ~/.cache/codex-scratch/j276/evidence/r2/ on compute01 and control. No queued or running work remains for J276. No merge into dev, deployment, live mesh mutation or issue closure.

Verbatim final gate summary:

| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [7.68s]
FAST_EXIT=0

Verbatim cleanup receipt:

J276_PROCESS_COUNT=0
TARGET_REMOVED=/home/claude/worktrees/j276/target
SLOT_SHELL_EXIT=0
Fri Nov  6 08:50:20 AM UTC 2026
J276 round 2 complete on `bootstrap-progress-bound-j276`, head `e596bbfe077101ac8d739186b5b772b7ded1c8c2`. Incorporated dev through `0aad23e1c02778705c1b69abb4f92edaab3072b9`. No integration merge or deployment; leaving #378 open for review. Addressed J289 comment 81624: - P1 downstream progress: production uploads now carry canonical, strictly increasing remote consumed-byte receipts bounded by the selected wire length. Local pipe writes, output chatter and keepalives cannot renew the 30-second inactivity interval. The final receipt begins a separate bounded verification/completion exchange. The private invitation remains behind payload verification. - P1 attempt cap: removed the 180-second host/restart whole-attempt cap instead of increasing it. Per-command/exchange bounds remain. The separate authenticated proof/commit ceiling starts after payload transfers. - P2 inventory: direct raw/compressed uploads, negotiated uploads, recovery-cache refresh and duplex staging all consume remote counters. Duplex reads and writes concurrently, with bounded selection, inactivity and completion. Removed the 60-second acquisition and 90-second HTTP whole-download clocks. Acquisition observes actual byte changes; HTTP renews only on nonempty body data saved. Connect, TLS, headers, storage completion and other short commands retain independent bounds. Sources without byte observations keep a short acquisition bound. Confirmation and one-use credential expiry remain independent. Test-first evidence is attached in comments 81709 and 81780. J289's real-sshd 40 KiB buffered-tail reproduction failed against the old implementation and now succeeds with all 40 consumed chunks. The same real-sshd oracle also completes 16 MiB/256 chunks and bounds a host that accepts TCP but never answers after 31 virtual seconds (`real-green.log`, `REAL_EXIT=0`). These are rootless real-sshd transport proofs. The gate's privileged user-namespace tests cover installation containment; they do not prove a system host-directory installation under real uid 0. Targeted receipt: 126 passed, 0 failed, 2 ignored (`targeted-green.log`, `TARGETED_EXIT=0`). Direct/duplex transfers progress for 240 virtual seconds; acquisition progresses for 200 virtual seconds. Stalled transfer, acquisition and HTTP bodies expire without a whole-transfer timer. HTTP slow-body/stall tests and release-only compile pass (`feature-green.log`). The optional-feature compile regression was first captured as E0433 (`feature-red.log`) and fixed in the final atomic commit. Rollback retains its named failed step and as-found restoration assertions (`restore-green.log`, 14 passed). Performance receipt: `reader-bench-final.log`, perf-run exit 0, zero steal, four alternating pipe-fed 16,777,200-byte samples. Median old reader 0.020742401 s, acknowledged reader 0.721995632 s, +0.701253231 s. This reader-only cost buys remote short-read observations without introducing a new transport or engine. It is not an end-to-end SSH latency measurement. Final-head gates on compute01 completed in order: `QUICK_EXIT=0`, then `FAST_EXIT=0`. The full quick log is attached in comment 81910 and the full fast log in comment 81930. My earlier generated summary attachment stopped at its header separator; the corrected complete verbatim table is below and in `final-receipts.log`. No gate rerun or code change was involved in correcting the extraction. Static sizes from the same recipe, same target and same compute01 build slot, against merged dev `0aad23e1c` (`static-delta.log`, `SIZE_EXIT=0`): | Architecture | Final head bytes | Merged dev bytes | Delta bytes | | --- | ---: | ---: | ---: | | x86_64 musl | 27,741,232 | 27,713,264 | +27,968 | | aarch64 musl | 24,959,904 | 24,933,184 | +26,720 | Final image SHA-256 receipts and both baseline build logs are attached. Both final images passed the gate's static linkage checks with PT_INTERP absent. The baseline comparison restored final head. Control and VM worktrees are clean, and the remote branch resolves to the reported head. Cleanup completed at 14:20 IST: held build-slot shell exited, process audit found no process using this worktree or its binaries, and `/home/claude/worktrees/j276/target` was removed. Logs remain under `~/.cache/codex-scratch/j276/evidence/r2/` on compute01 and control. No queued or running work remains for J276. No merge into dev, deployment, live mesh mutation or issue closure. Verbatim final gate summary: ```text | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [7.68s] FAST_EXIT=0 ``` Verbatim cleanup receipt: ```text J276_PROCESS_COUNT=0 TARGET_REMOVED=/home/claude/worktrees/j276/target SLOT_SHELL_EXIT=0 Fri Nov 6 08:50:20 AM UTC 2026 ```
final-receipts.log
2.4 KiB
static-delta.log
957 B
size-base-x86_64-unknown-linux-musl.log
1.7 KiB
size-base-aarch64-unknown-linux-musl.log
1.7 KiB
cleanup.log
121 B
kayg commented 2026-11-06 08:54:46 +00:00
Author
Owner
Copy link

J293 review started: bootstrap-progress-bound-j276 at e596bbfe077101ac8d739186b5b772b7ded1c8c2, detached reviewer worktree. Plan (~45 minutes): inspect J289 delta and transfer inventory, rerun focused real-sshd buffered-tail/dead-link/completion and progress/lease tests on compute01, read author gate evidence, then post verdict. No full reviewer gate, push, merge or deployment.

J293 review started: `bootstrap-progress-bound-j276` at `e596bbfe077101ac8d739186b5b772b7ded1c8c2`, detached reviewer worktree. Plan (~45 minutes): inspect J289 delta and transfer inventory, rerun focused real-sshd buffered-tail/dead-link/completion and progress/lease tests on compute01, read author gate evidence, then post verdict. No full reviewer gate, push, merge or deployment.
kayg commented 2026-11-06 09:11:24 +00:00
Author
Owner
Copy link

J293 delta review: APPROVE

Reviewed bootstrap-progress-bound-j276 at exact head e596bbfe077101ac8d739186b5b772b7ded1c8c2, against J289 comment 81624, J276 round-2 report 81940, lease finding 81682, D352 and #334. No remaining P1/P2 findings in this scope.

  1. P1 downstream progress: fixed. transfer_progress.rs emits receipts after actual bounded remote reads; process.rs renews only on canonical, strictly increasing counters within the selected wire length. Local pipe writes never renew the interval. Independent real-sshd buffered-tail rerun sent 40,960 bytes, consumed 1 KiB per second, and recorded every read to remote-read-receipts.txt: 0 through 39, then successful completion. The instrumentation diff and exact test source are retained. The final consumed-byte receipt starts the separate completion bound. An additional independent real-sshd case consumed all 40 KiB, emitted the final counter and arbitrary keepalive/output text, then deliberately withheld completion: The SSH operation timed out. The remote consumption marker exists in completion-consumed.txt. Virtual-time process tests separately prove chatter cannot renew silence and private input stays behind verified payload readiness.

  2. P1 whole-transfer clock: fixed. Bootstrap.deadline, ATTEMPT_SECONDS, payload_budget and the attempt/restart wrapper timers are gone. Remaining proof/commit limits start after payload transfers. Slow-link reasoning, rather than a claimed bandwidth measurement: the author's retained exact-head raw x86 executable is 27,741,232 bytes, SHA-256 e806ac59ab856c5330a912565d7a6402383f522cae7771a7fd9a214476fa4b0f; at 1,000,000 bit/s the payload takes 221.929856 seconds. Each maximum 65,536-byte read takes 0.524288 seconds, and short reads also earn receipts. With continuous delivery and ordinary completion, no policy clock truncates that upload. Independent direct and duplex tests each complete through 240 virtual seconds of receipt-driven consumption. Details and assumptions: slow-link-analysis.txt; size provenance: author-static-delta.log (retained author measurement, not a reviewer rebuild).

  3. P2 inventory and lease: fixed. Direct raw/compressed, negotiated, recovery-cache refresh and duplex uploads use consumed-byte receipts. Duplex sends and reads concurrently, bounds selection and each whole receipt, and separately bounds writer completion/verification. Acquisition renews on observed byte increases, and the HTTP body loop renews only after saving nonempty body data; the old 60/90-second whole-download clocks are absent. Connect/TLS/headers/storage completion retain separate bounds. Sources without byte observations retain a short acquisition bound. Independent acquisition tests pass through 200 virtual seconds and still reject stalled acquisition. setup_lock.sh now uses the 180-second sleep as a sampling interval: advancing the reader's cumulative count renews the lock; no increase retires it. The independent real-lock test proves renewal across the first interval and release after the next idle interval. PID-birth and exact fd ownership checks remain intact. Reviewed HTTP tests and the author's retained feature-green.log: 5 passed, HTTP_GREEN_EXIT=0; release-only build also has FEATURE_GREEN_EXIT=0.

Negative paths remain bounded: the independent real-sshd oracle observes actual TCP acceptance from a silent endpoint before advancing 31 virtual seconds and gets Unreachable; the no-consumption process test expires; the real fully-consumed-but-never-finishing command expires. #334: real waits are hang guards or deliberate fixture pacing, and virtual-time tests exercise the policy clock and real-sshd assertions check outcomes; no shared-VM speed threshold was added.

Independent compute01 receipts:

process: 16 passed; 0 failed
payload_source: 3 passed; 0 failed
lease_progress: 2 passed; 0 failed
duplex_progress: 1 passed; 0 failed
FOCUSED_EXIT=0
duplex upload: 1 passed; 0 failed
DUPLEX_EXIT=0
real sshd: 1 passed; 0 failed
REAL_EXIT=0

Artifacts: compute01 /home/claude/.cache/codex-scratch/j293/evidence/, copied to control /home/kayg/.cache/j293/vm-evidence/; attached review archive includes logs, per-read receipts, instrumentation source/diff and slow-link analysis. Author gate copied to /home/kayg/.cache/j293/author-fast-final.log; full public gate attachment: https://git.kayg.org/attachments/78df3cf6-327d-4d40-a6ff-fbc97a5a9487 . The author's reader benchmark was also read: BENCH_EXIT=0, with its acknowledged-reader overhead explicitly measured on the perf VM. This review makes no new end-to-end performance claim.

No production code changed; no full reviewer gate run, per the reviewer brief. Read the author's full final-head gate; its summary is quoted verbatim:

| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [7.68s]
FAST_EXIT=0

All reviewer runs finished, own target removed, scratch-only instrumentation preserved as evidence and restored locally. The deliberately nonterminating remote shell/Python fixtures were retired by exact recorded PID/birth during cleanup; final own-process audit is zero (cleanup.log). No push, merge, deployment, live mesh mutation or issue closure.

APPROVE

J293 delta review: **APPROVE** Reviewed `bootstrap-progress-bound-j276` at exact head `e596bbfe077101ac8d739186b5b772b7ded1c8c2`, against J289 comment 81624, J276 round-2 report 81940, lease finding 81682, D352 and #334. No remaining P1/P2 findings in this scope. 1. **P1 downstream progress: fixed.** `transfer_progress.rs` emits receipts after actual bounded remote reads; `process.rs` renews only on canonical, strictly increasing counters within the selected wire length. Local pipe writes never renew the interval. Independent real-sshd buffered-tail rerun sent **40,960 bytes**, consumed **1 KiB per second**, and recorded every read to `remote-read-receipts.txt`: **0 through 39, then successful completion**. The instrumentation diff and exact test source are retained. The final consumed-byte receipt starts the separate completion bound. An additional independent real-sshd case consumed all 40 KiB, emitted the final counter and arbitrary keepalive/output text, then deliberately withheld completion: **`The SSH operation timed out.`** The remote consumption marker exists in `completion-consumed.txt`. Virtual-time process tests separately prove chatter cannot renew silence and private input stays behind verified payload readiness. 2. **P1 whole-transfer clock: fixed.** `Bootstrap.deadline`, `ATTEMPT_SECONDS`, `payload_budget` and the attempt/restart wrapper timers are gone. Remaining proof/commit limits start after payload transfers. Slow-link reasoning, rather than a claimed bandwidth measurement: the author's retained exact-head raw x86 executable is **27,741,232 bytes**, SHA-256 `e806ac59ab856c5330a912565d7a6402383f522cae7771a7fd9a214476fa4b0f`; at 1,000,000 bit/s the payload takes **221.929856 seconds**. Each maximum 65,536-byte read takes **0.524288 seconds**, and short reads also earn receipts. With continuous delivery and ordinary completion, no policy clock truncates that upload. Independent direct and duplex tests each complete through **240 virtual seconds** of receipt-driven consumption. Details and assumptions: `slow-link-analysis.txt`; size provenance: `author-static-delta.log` (retained author measurement, not a reviewer rebuild). 3. **P2 inventory and lease: fixed.** Direct raw/compressed, negotiated, recovery-cache refresh and duplex uploads use consumed-byte receipts. Duplex sends and reads concurrently, bounds selection and each whole receipt, and separately bounds writer completion/verification. Acquisition renews on observed byte increases, and the HTTP body loop renews only after saving nonempty body data; the old 60/90-second whole-download clocks are absent. Connect/TLS/headers/storage completion retain separate bounds. Sources without byte observations retain a short acquisition bound. Independent acquisition tests pass through **200 virtual seconds** and still reject stalled acquisition. `setup_lock.sh` now uses the 180-second sleep as a sampling interval: advancing the reader's cumulative count renews the lock; no increase retires it. The independent real-lock test proves renewal across the first interval and release after the next idle interval. PID-birth and exact fd ownership checks remain intact. Reviewed HTTP tests and the author's retained `feature-green.log`: **5 passed**, `HTTP_GREEN_EXIT=0`; release-only build also has `FEATURE_GREEN_EXIT=0`. Negative paths remain bounded: the independent real-sshd oracle observes actual TCP acceptance from a silent endpoint before advancing 31 virtual seconds and gets `Unreachable`; the no-consumption process test expires; the real fully-consumed-but-never-finishing command expires. #334: real waits are hang guards or deliberate fixture pacing, and virtual-time tests exercise the policy clock and real-sshd assertions check outcomes; no shared-VM speed threshold was added. Independent compute01 receipts: ```text process: 16 passed; 0 failed payload_source: 3 passed; 0 failed lease_progress: 2 passed; 0 failed duplex_progress: 1 passed; 0 failed FOCUSED_EXIT=0 duplex upload: 1 passed; 0 failed DUPLEX_EXIT=0 real sshd: 1 passed; 0 failed REAL_EXIT=0 ``` Artifacts: compute01 `/home/claude/.cache/codex-scratch/j293/evidence/`, copied to control `/home/kayg/.cache/j293/vm-evidence/`; attached review archive includes logs, per-read receipts, instrumentation source/diff and slow-link analysis. Author gate copied to `/home/kayg/.cache/j293/author-fast-final.log`; full public gate attachment: https://git.kayg.org/attachments/78df3cf6-327d-4d40-a6ff-fbc97a5a9487 . The author's reader benchmark was also read: `BENCH_EXIT=0`, with its acknowledged-reader overhead explicitly measured on the perf VM. This review makes no new end-to-end performance claim. No production code changed; no full reviewer gate run, per the reviewer brief. Read the author's full final-head gate; its summary is quoted verbatim: ```text | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [7.68s] FAST_EXIT=0 ``` All reviewer runs finished, own target removed, scratch-only instrumentation preserved as evidence and restored locally. The deliberately nonterminating remote shell/Python fixtures were retired by exact recorded PID/birth during cleanup; final own-process audit is zero (`cleanup.log`). No push, merge, deployment, live mesh mutation or issue closure. **APPROVE**
j293-review-evidence.tar.gz
42 KiB
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#378
No description provided.