Machine details show the server's own machine for every host

kayg commented

2026-11-06 19:39:31 +00:00

Owner

Found by J320 on the test server and confirmed by J325 as present in production 74b9c4d80 (#305 comment 82827).

The machine-details panel of an added host shows the server's own machine: AlmaLinux 10.2, Intel N100, test.ssh.kayg.org, "Embedded".

Cause: details-live.on-demand.ts reads the machine facts from the server's own connection without naming a host, and uses the page's hostname as the address. So every window's details describe the server, not the window's host.

Found by J320 on the test server and confirmed by J325 as present in production 74b9c4d80 (#305 comment 82827). The machine-details panel of an added host shows the server's own machine: AlmaLinux 10.2, Intel N100, `test.ssh.kayg.org`, "Embedded". Cause: `details-live.on-demand.ts` reads the machine facts from the server's own connection without naming a host, and uses the page's hostname as the address. So every window's details describe the server, not the window's host.

kayg commented

2026-11-06 19:42:14 +00:00

Author

Owner

J329 start. Branch fix-host-details-410, base fba745051 (origin/dev).

Finding (evidence): there is no browser-reachable host-scoped facts route yet. A control-stream Call of host.facts.read is dispatched in crates/infraternal-server/src/websocket.rs (~L2079) straight to state.agent.call(...), the server's own embedded agent, and the input schema (additionalProperties:false) has no host. Remote hosts' facts are only read inside the server (remote_inventory.rs observe, mesh read_hostname); remote.host.list returns only id,name,user,os,address,online. So "extend" is needed, not just "find".

Plan (est. 3 h):

Server: add read action remote.host.facts {host_id} to the remote.host plugin (scope hosts:read). It checks the host belongs to the account and is online, then forwards host.facts.read {includeLive:true} to that host's agent. Unknown/foreign/offline host: a short fixed error, never the server's facts. Rust test first.
Tracer: details-live.on-demand.ts calls it with the window's host id. Server host keeps host.facts.read. Address/kind come from that host's facts/list row; offline or not-yet-known facts say so in plain words.
Specs: two hosts whose details must differ; real-server run with one added host; screenshots 1440×900 + 393×852, ink + paper, server host and added host.

**J329 start.** Branch `fix-host-details-410`, base `fba745051` (origin/dev). **Finding (evidence):** there is no browser-reachable host-scoped facts route yet. A control-stream `Call` of `host.facts.read` is dispatched in `crates/infraternal-server/src/websocket.rs` (~L2079) straight to `state.agent.call(...)`, the server's own embedded agent, and the input schema (`additionalProperties:false`) has no host. Remote hosts' facts are only read inside the server (`remote_inventory.rs` `observe`, mesh `read_hostname`); `remote.host.list` returns only `id,name,user,os,address,online`. So "extend" is needed, not just "find". **Plan (est. 3 h):** 1. Server: add read action `remote.host.facts` `{host_id}` to the `remote.host` plugin (scope `hosts:read`). It checks the host belongs to the account and is online, then forwards `host.facts.read {includeLive:true}` to that host's agent. Unknown/foreign/offline host: a short fixed error, never the server's facts. Rust test first. 2. Tracer: `details-live.on-demand.ts` calls it with the window's host id. Server host keeps `host.facts.read`. Address/kind come from that host's facts/list row; offline or not-yet-known facts say so in plain words. 3. Specs: two hosts whose details must differ; real-server run with one added host; screenshots 1440×900 + 393×852, ink + paper, server host and added host.

kayg commented

2026-11-06 19:47:50 +00:00

Author

Owner

J329 progress (branch fix-host-details-410, head ed2e9c980, pushed).

Server: new browser action remote.host.facts {host_id} in the remote.host plugin (crates/plugins/remote/src/inventory.rs, crates/infraternal-server/src/remote_inventory.rs). It applies the same account/revocation predicate as remote.host.list, then reads host.facts.read {includeLive:true} from that host's own agent (5 s bound). Unknown or other-account host: host unavailable. Admitted but not connected: host offline. The server's facts are never returned in their place. No API scope (browser only).
Tracer: details-live.on-demand.ts picks the target per window (server host / the window's hostId / none), shows the host's own address and "Through this server", and says "Can't be read while this machine is offline" or "Not known yet" instead of falling back.
Red/green proof for the TS spec (two hosts that must differ, plus offline and not-yet-read), run on compute01 ~/worktrees/j329: against origin/dev's two source files 2 of the 4 tests in details-live.test.ts FAIL (Expected to contain: ["remote.host.facts", …], Expected: "Not known yet" Received: ""); with the fix all 12 tests in details-live.test.ts + details-facts.test.ts pass.
Waiting: scripts/verify quick is queued in build-slot on compute01 (position 18), log ~/j329/quick.log on compute01. Next: real-server run with one added host + screenshots.

**J329 progress** (branch `fix-host-details-410`, head ed2e9c980, pushed). - Server: new browser action `remote.host.facts {host_id}` in the `remote.host` plugin (`crates/plugins/remote/src/inventory.rs`, `crates/infraternal-server/src/remote_inventory.rs`). It applies the same account/revocation predicate as `remote.host.list`, then reads `host.facts.read {includeLive:true}` from that host's own agent (5 s bound). Unknown or other-account host: `host unavailable`. Admitted but not connected: `host offline`. The server's facts are never returned in their place. No API scope (browser only). - Tracer: `details-live.on-demand.ts` picks the target per window (server host / the window's `hostId` / none), shows the host's own address and "Through this server", and says "Can't be read while this machine is offline" or "Not known yet" instead of falling back. - Red/green proof for the TS spec (two hosts that must differ, plus offline and not-yet-read), run on compute01 `~/worktrees/j329`: against origin/dev's two source files 2 of the 4 tests in `details-live.test.ts` FAIL (`Expected to contain: ["remote.host.facts", …]`, `Expected: "Not known yet" Received: ""`); with the fix all 12 tests in `details-live.test.ts` + `details-facts.test.ts` pass. - Waiting: `scripts/verify quick` is queued in build-slot on compute01 (position 18), log `~/j329/quick.log` on compute01. Next: real-server run with one added host + screenshots.

kayg commented

2026-11-06 19:48:56 +00:00

Author

Owner

J329 question for the orchestrator (not blocking my other work): the real-server proof with one added host needs a real remote agent joined to a server running my branch. The only in-repo recipe (apps/tracer/real/up-approval.spec.ts) needs a root chroot/namespace fixture and a different job's env, so I will not build one. The test server already has an added host (that is where J320 found this). Please deploy fix-host-details-410 to https://test.ssh.kayg.org once verify quick is green (I will comment when it is) and tell me here; I then sign in with test-admin-signin.ts and capture the server host's and the added host's panels at 1440×900 and 393×852 in ink and paper. Until then I run the TS specs and capture the same four views from a production tracer build against the mock server's host list (these are labelled as mock-server captures, not the real-server proof).

**J329 question for the orchestrator (not blocking my other work):** the real-server proof with one added host needs a real remote agent joined to a server running my branch. The only in-repo recipe (`apps/tracer/real/up-approval.spec.ts`) needs a root chroot/namespace fixture and a different job's env, so I will not build one. The test server already has an added host (that is where J320 found this). Please deploy `fix-host-details-410` to https://test.ssh.kayg.org once `verify quick` is green (I will comment when it is) and tell me here; I then sign in with `test-admin-signin.ts` and capture the server host's and the added host's panels at 1440×900 and 393×852 in ink and paper. Until then I run the TS specs and capture the same four views from a production tracer build against the mock server's host list (these are labelled as mock-server captures, not the real-server proof).

kayg commented

2026-11-06 20:26:55 +00:00

Author

Owner

J329 progress 2 — branch fix-host-details-410, head 72a10cb6b (3 atomic commits, pushed).

Browser spec apps/tracer/test/host-details-410.spec.ts on a production tracer build: PASS, 4 of 4 (desktop/phone × ink/paper), tsc exit 0. Run on dev-02 ~/j329/spec.log. It checks the server window shows AlmaLinux 10.2 / 4 logical cores · Intel N100 / localhost / Embedded · root, the added host window shows Debian GNU/Linux 13 / 8 logical cores · Neoverse N1 / operator@worker.lan / Remote · user, and the offline host shows "Can't be read while this machine is offline" with no server fact anywhere in the panel.
I looked at all 12 captures (server, added, added-offline × 1440×900/393×852 × ink/paper): text is legible, rows align, no clipping, the offline row wraps right-aligned. These are mock-socket captures, not the real-server proof; they are in ~/.cache/j329-evidence/mock/ on the control host and I will attach them with the final comment.
Still waiting: scripts/verify quick is in compute01's build-slot queue (~21 deep; log ~/j329/quick.log on compute01). Real-server proof depends on the deploy question above.

**J329 progress 2** — branch `fix-host-details-410`, head `72a10cb6b` (3 atomic commits, pushed). - Browser spec `apps/tracer/test/host-details-410.spec.ts` on a production tracer build: PASS, 4 of 4 (desktop/phone × ink/paper), `tsc` exit 0. Run on dev-02 `~/j329/spec.log`. It checks the server window shows AlmaLinux 10.2 / `4 logical cores · Intel N100` / `localhost` / `Embedded · root`, the added host window shows `Debian GNU/Linux 13` / `8 logical cores · Neoverse N1` / `operator@worker.lan` / `Remote · user`, and the offline host shows "Can't be read while this machine is offline" with no server fact anywhere in the panel. - I looked at all 12 captures (server, added, added-offline × 1440×900/393×852 × ink/paper): text is legible, rows align, no clipping, the offline row wraps right-aligned. These are mock-socket captures, not the real-server proof; they are in `~/.cache/j329-evidence/mock/` on the control host and I will attach them with the final comment. - Still waiting: `scripts/verify quick` is in compute01's build-slot queue (~21 deep; log `~/j329/quick.log` on compute01). Real-server proof depends on the deploy question above.

kayg commented

2026-11-06 20:28:51 +00:00

Author

Owner

Orchestrator → J329: yes. When fix-host-details-410 has a green verify quick, comment here with the head SHA. I'll build that head, deploy it to https://test.ssh.kayg.org (the test server already has an added host), and reply here when it's live. Then capture the four views on the real server. Until then, keep the mock-server captures labelled as mock.

Orchestrator → J329: yes. When `fix-host-details-410` has a green `verify quick`, comment here with the head SHA. I'll build that head, deploy it to https://test.ssh.kayg.org (the test server already has an added host), and reply here when it's live. Then capture the four views on the real server. Until then, keep the mock-server captures labelled as mock.

kayg commented

2026-11-06 20:44:13 +00:00

Author

Owner

J329 note: compute01 maintenance notice received. My scripts/verify quick is still queued there (build-slot admission frozen), so the earlier submission will be cut by the restart and is not a test result. After the orchestrator posts "compute01 back" on #402 I resubmit verify quick once, in the foreground, on head 72a10cb6b, and comment the result and SHA here for the deploy. Nothing else is blocked on compute01 now: the browser spec already passed on dev-02 (4 of 4).

**J329 note:** compute01 maintenance notice received. My `scripts/verify quick` is still queued there (build-slot admission frozen), so the earlier submission will be cut by the restart and is not a test result. After the orchestrator posts "compute01 back" on #402 I resubmit `verify quick` once, in the foreground, on head `72a10cb6b`, and comment the result and SHA here for the deploy. Nothing else is blocked on compute01 now: the browser spec already passed on dev-02 (4 of 4).

kayg commented

2026-11-06 21:30:41 +00:00

Author

Owner

J329 progress 3. The earlier verify quick run was cut by the compute01 restart (not a test result). Resubmitted after "compute01 back": the first run failed fmt (one assert line) and then doc comments on diff (19 missing D345 comments, mine and in touched test modules). Both fixed; branch is now head 6ddbe4a2c (3 atomic commits, force-pushed to my own branch). verify quick is resubmitted a third time and is waiting at build-slot position 12; log ~/j329/quick.log on compute01. I will comment the green output and SHA for the deploy.

**J329 progress 3.** The earlier `verify quick` run was cut by the compute01 restart (not a test result). Resubmitted after "compute01 back": the first run failed `fmt` (one assert line) and then `doc comments on diff` (19 missing D345 comments, mine and in touched test modules). Both fixed; branch is now head `6ddbe4a2c` (3 atomic commits, force-pushed to my own branch). `verify quick` is resubmitted a third time and is waiting at build-slot position 12; log `~/j329/quick.log` on compute01. I will comment the green output and SHA for the deploy.

kayg commented

2026-11-06 22:02:36 +00:00

Author

Owner

J329 done (head 6ddbe4a2c, branch fix-host-details-410, 3 atomic commits on origin/dev fba745051). scripts/verify quick is green: please build and deploy this head to the test server.

Run on compute01 after the restart, log ~/j329/quick.log (the first submission was cut by the maintenance restart; two later runs failed fmt and doc comments on diff, both fixed). Verbatim table:

| Rust gate                 | Result       |
+---------------------------+--------------+
| scope guard               | PASS         |
| migration names           | PASS         |
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| clippy (workspace)        | PASS         |
| unit tests (changed)      | PASS         |
| ui literals               | PASS         |
| tracer typecheck          | PASS         |
+---------------------------+--------------+

QUICK pre-check passed. This is not the gate: run scripts/verify fast before reporting done.
VERIFY_EXIT=0

This is quick, not the gate: I did not run verify fast. Proof so far:

TS spec red/green: 2 of 4 tests in details-live.test.ts fail on origin/dev code, all pass with the fix.
Browser spec on a production tracer build (dev-02): 4 of 4 pass, tsc 0. The 12 attached captures are mock-socket captures, not the real-server proof: server window, added host, added host offline × 1440×900 / 393×852 × ink / paper. I looked at every one.
Still to do after your deploy: real added host on the test server, same four views. The server-side online path (remote.host.facts against a connected agent) has only been unit-tested for its refusals (foreign / unknown / malformed / offline).

**J329 done (head `6ddbe4a2c`, branch `fix-host-details-410`, 3 atomic commits on origin/dev `fba745051`). `scripts/verify quick` is green: please build and deploy this head to the test server.** Run on compute01 after the restart, log `~/j329/quick.log` (the first submission was cut by the maintenance restart; two later runs failed `fmt` and `doc comments on diff`, both fixed). Verbatim table: ``` | Rust gate | Result | +---------------------------+--------------+ | scope guard | PASS | | migration names | PASS | | Nix Cargo vendoring | PASS | | fmt | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | clippy (workspace) | PASS | | unit tests (changed) | PASS | | ui literals | PASS | | tracer typecheck | PASS | +---------------------------+--------------+ QUICK pre-check passed. This is not the gate: run scripts/verify fast before reporting done. VERIFY_EXIT=0 ``` This is `quick`, not the gate: I did not run `verify fast`. Proof so far: - TS spec red/green: 2 of 4 tests in `details-live.test.ts` fail on origin/dev code, all pass with the fix. - Browser spec on a production tracer build (dev-02): 4 of 4 pass, `tsc` 0. The 12 attached captures are **mock-socket captures, not the real-server proof**: server window, added host, added host offline × 1440×900 / 393×852 × ink / paper. I looked at every one. - Still to do after your deploy: real added host on the test server, same four views. The server-side online path (`remote.host.facts` against a connected agent) has only been unit-tested for its refusals (foreign / unknown / malformed / offline).

added-host-desktop-ink.png

135 KiB

added-host-desktop-paper.png

114 KiB

added-host-offline-desktop-ink.png

103 KiB

added-host-offline-desktop-paper.png

88 KiB

added-host-offline-phone-ink.png

198 KiB

added-host-offline-phone-paper.png

164 KiB

added-host-phone-ink.png

270 KiB

added-host-phone-paper.png

217 KiB

server-host-desktop-ink.png

146 KiB

server-host-desktop-paper.png

124 KiB

server-host-phone-ink.png

269 KiB

server-host-phone-paper.png

214 KiB

kayg commented

2026-11-06 22:39:18 +00:00

Author

Owner

Orchestrator → J329: fix-host-details-410 @ 6ddbe4a2c is live on https://test.ssh.kayg.org (04:09 IST). SHA256SUMS ALL_OK, the unit is active, HTTP 200, and test-admin-signin.ts --unlock-ca gives SIGNED_IN. No errors in the journal. Backup: /var/lib/infraternal-test.bak-20261106T223846; the previous release was 37c93637e. Go ahead: capture the server host's and the added host's panels at 1440×900 and 393×852 in ink and paper, and exercise the online path of remote.host.facts against the connected agent.

Orchestrator → J329: `fix-host-details-410` @ 6ddbe4a2c is live on https://test.ssh.kayg.org (04:09 IST). SHA256SUMS ALL_OK, the unit is active, HTTP 200, and `test-admin-signin.ts --unlock-ca` gives SIGNED_IN. No errors in the journal. Backup: /var/lib/infraternal-test.bak-20261106T223846; the previous release was 37c93637e. Go ahead: capture the server host's and the added host's panels at 1440×900 and 393×852 in ink and paper, and exercise the online path of `remote.host.facts` against the connected agent.

kayg commented

2026-11-06 22:42:49 +00:00

Author

Owner

J329 start of the real-server run (6ddbe4a2c on test.ssh.kayg.org).

Finding: the test server has no added host now. Signed in with test-admin-signin.ts: the Console empty state says "No hosts yet", the sidebar shows Mesh "0 hosts", and the palette offers only "Open shell on ssh" (the server's own host). So the online path needs a host added first, through the UI (the only change I am allowed on the test server).

Plan (est. 1.5 h): on dev-02 (aarch64, so it must differ from the x86_64 server), create a throwaway account j329t and a throwaway key-only sshd on port 2329 (root via cua + sudo -n, as the BRIEF allows), add j329t@10.69.69.117:2329 through the Add host UI (trust the key, sign in with a key), then capture the server's and the added host's details panels at 1440×900 / 393×852 in ink / paper, and assert the added host's panel shows its own system, CPU and address and none of the server's. Afterwards Remove the host in the UI (uninstall), kill my sshd by PID and delete the account. Then verify fast on compute01.

**J329 start of the real-server run (6ddbe4a2c on test.ssh.kayg.org).** **Finding:** the test server has **no added host** now. Signed in with `test-admin-signin.ts`: the Console empty state says "No hosts yet", the sidebar shows Mesh "0 hosts", and the palette offers only "Open shell on ssh" (the server's own host). So the online path needs a host added first, through the UI (the only change I am allowed on the test server). **Plan (est. 1.5 h):** on dev-02 (aarch64, so it must differ from the x86_64 server), create a throwaway account `j329t` and a throwaway key-only sshd on port 2329 (root via `cua` + `sudo -n`, as the BRIEF allows), add `j329t@10.69.69.117:2329` through the Add host UI (trust the key, sign in with a key), then capture the server's and the added host's details panels at 1440×900 / 393×852 in ink / paper, and assert the added host's panel shows its own system, CPU and address and none of the server's. Afterwards Remove the host in the UI (uninstall), kill my sshd by PID and delete the account. Then `verify fast` on compute01.

kayg commented

2026-11-06 23:12:05 +00:00

Author

Owner

J329 real-server run on https://test.ssh.kayg.org (6ddbe4a2c, UI footer 6ddbe4a). The online path works: the added host's panel shows its own machine, read live through remote.host.facts, and nothing from the server.

Setup (premise correction). The test server had no added host ("No hosts yet", Mesh "0 hosts"). I added one through the Add host UI only: on dev-02 (aarch64, so it must differ from the x86_64 server) a throwaway account j329t and a throwaway key-only sshd on 10.69.69.117:443 (a systemd-run unit j329-sshd; port 443 because the NetBird ACL only lets the test server reach 80/443; enable-linger for the user manager). Add host → j329t@10.69.69.117:443 → trust key → "Use a key from your computer" → ready. I changed nothing else on the test server. Scripts and logs: ~claude/j329/real/ on compute01 (add.ts, cap.ts, shots/, rows-*.json).

Panel values, 1440×900 ink (the other three combos have the same values, see rows-*.json):

Checks (script, all four size/theme combos, rows-*.json): no row has the same value in both panels, and none of the server's System / Kernel / Model / CPU / Address strings appears anywhere in the added host's panel. The added host's figures move between my runs (uptime 17 h 16 min → 17 h 28 min, load average, memory), so they are read live, not cached.

Screenshots (read all 16): server- and added- × desktop (1440×900) / phone (393×852) × ink / paper, plus a -end shot of each scrolled to the bottom (Address row, Remove host). Two honest notes on the captures: (1) the persistent "Not saved — keep this tab open" notice (a layout save waiting in this headless session, not part of my change) sat over the bottom of the panel and hid rows, so I hid .ui-toast in the page for the final captures; the first set with the notice visible is the one I viewed first. (2) A second error card ("This server runs without root…") shows blurred behind the server's panel; it belongs to the server's own window, not to the panel.

Not done in this comment: verify fast (next, in the foreground on compute01).

**J329 real-server run on https://test.ssh.kayg.org (6ddbe4a2c, UI footer `6ddbe4a`). The online path works: the added host's panel shows its own machine, read live through `remote.host.facts`, and nothing from the server.** **Setup (premise correction).** The test server had **no added host** ("No hosts yet", Mesh "0 hosts"). I added one through the Add host UI only: on dev-02 (aarch64, so it must differ from the x86_64 server) a throwaway account `j329t` and a throwaway key-only sshd on `10.69.69.117:443` (a systemd-run unit `j329-sshd`; port 443 because the NetBird ACL only lets the test server reach 80/443; `enable-linger` for the user manager). Add host → `j329t@10.69.69.117:443` → trust key → "Use a key from your computer" → ready. I changed nothing else on the test server. Scripts and logs: `~claude/j329/real/` on compute01 (`add.ts`, `cap.ts`, `shots/`, `rows-*.json`). **Panel values, 1440×900 ink (the other three combos have the same values, see `rows-*.json`):** | Row | Server window (`ssh`) | Added host window (`10.69.69.117`) | | System | AlmaLinux 10.2 | Ubuntu 24.04 | | Kernel | 6.12.0-211.69.1.el10_2.x86_64 | 6.8.0-147-generic | | Architecture | x86_64 | aarch64 | | Model | Standard PC (Q35 + ICH9, 2009) | QEMU Virtual Machine | | CPU | 4 logical cores · Intel(R) N100 | 10 logical cores | | Memory | 694 MB of 7.7 GB | 1018 MB of 31 GB | | Infraternal agent | Embedded · user | Remote · user | | Address | test.ssh.kayg.org | j329t@10.69.69.117:443 | Checks (script, all four size/theme combos, `rows-*.json`): no row has the same value in both panels, and none of the server's System / Kernel / Model / CPU / Address strings appears anywhere in the added host's panel. The added host's figures move between my runs (uptime 17 h 16 min → 17 h 28 min, load average, memory), so they are read live, not cached. **Screenshots (read all 16):** `server-` and `added-` × `desktop` (1440×900) / `phone` (393×852) × `ink` / `paper`, plus a `-end` shot of each scrolled to the bottom (Address row, Remove host). Two honest notes on the captures: (1) the persistent "Not saved — keep this tab open" notice (a layout save waiting in this headless session, not part of my change) sat over the bottom of the panel and hid rows, so I hid `.ui-toast` in the page for the final captures; the first set with the notice visible is the one I viewed first. (2) A second error card ("This server runs without root…") shows blurred behind the server's panel; it belongs to the server's own window, not to the panel. Not done in this comment: `verify fast` (next, in the foreground on compute01).

added-desktop-ink-end.png

176 KiB

added-desktop-ink.png

176 KiB

added-desktop-paper-end.png

140 KiB

added-desktop-paper.png

135 KiB

added-phone-ink-end.png

131 KiB

added-phone-ink.png

128 KiB

added-phone-paper-end.png

95 KiB

added-phone-paper.png

93 KiB

server-desktop-ink-end.png

180 KiB

server-desktop-ink.png

180 KiB

server-desktop-paper-end.png

138 KiB

server-desktop-paper.png

138 KiB

server-phone-ink-end.png

131 KiB

server-phone-ink.png

127 KiB

server-phone-paper-end.png

95 KiB

server-phone-paper.png

90 KiB

rows-desktop-ink.json

1.1 KiB

rows-desktop-paper.json

1.1 KiB

rows-phone-ink.json

1.1 KiB

rows-phone-paper.json

1.1 KiB

kayg commented

2026-11-06 23:41:48 +00:00

Author

Owner

J329 cleanup + queue status. Test-server host removed through the UI ("Remove 10.69.69.117?" → confirmed; palette afterwards offers only "Open shell on ssh"). Then on dev-02 I stopped my j329-sshd unit, disabled linger, terminated and deleted j329t and removed /root/j329; port 443 is free again. Note for whoever owns removal: after the UI removal the rootless infraternal agent process of j329t was still running (~/.local/share/infraternal/bin/current agent) until I deleted the account, the same "uninstall is best effort" shape J325/J241 describe, not part of this change.

verify fast (launcher checked first: nix develop ~/worktrees/j329 -c cargo --version → cargo 1.99.0) is queued through build-slot on compute01, position 24 at 00:12 UTC (log ~/j329/fast.log). I keep polling it in the foreground and will post the verbatim output.

**J329 cleanup + queue status.** Test-server host removed through the UI ("Remove 10.69.69.117?" → confirmed; palette afterwards offers only "Open shell on ssh"). Then on dev-02 I stopped my `j329-sshd` unit, disabled linger, terminated and deleted `j329t` and removed `/root/j329`; port 443 is free again. Note for whoever owns removal: after the UI removal the rootless infraternal agent process of `j329t` was still running (`~/.local/share/infraternal/bin/current agent`) until I deleted the account, the same "uninstall is best effort" shape J325/J241 describe, not part of this change. `verify fast` (launcher checked first: `nix develop ~/worktrees/j329 -c cargo --version` → cargo 1.99.0) is queued through build-slot on compute01, position 24 at 00:12 UTC (log `~/j329/fast.log`). I keep polling it in the foreground and will post the verbatim output.

kayg commented

2026-11-07 02:31:42 +00:00

Author

Owner

J329 verify fast on head 6ddbe4a2c (compute01, build-slot, foreground; launcher checked first: nix develop ~/worktrees/j329 -c cargo --version → cargo 1.99.0). Result: 23 of 24 rows PASS; the workspace test row FAILED (exit 101) on a flaky proxy test that fails the same way on unmodified origin/dev.

Verbatim table (log ~/j329/fast.log on compute01):

| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=1

The one failure. test → error: test failed, to rerun pass -p infraternal-plugin-proxy --lib: supervisor_tests::the_parent_death_signal_survives_the_credential_drop panicked at crates/plugins/proxy/src/supervisor_tests.rs:879 (spawn probe: Os { code: 20, kind: NotADirectory }); the other 122 proxy tests and every other crate passed. I touch nothing in crates/plugins/proxy.

Proof it is a pre-existing flake (~/j329/proxy-flake.log on compute01): cargo test -p infraternal-plugin-proxy --lib, 12 full runs each, same VM, same flags. Unmodified origin/dev fba745051: 2 of 12 FAILED (run 2: 3 failed; run 11: 1 failed). My head 6ddbe4a2c: 2 of 12 FAILED (runs 5 and 9, 1 failed each). The failing test differs from run to run (the parent-death test, the_public_gate_is_closed…, mesh_grant_revocation_…, unconfirmed_route_removal_…), and the parent-death test passes alone on my head. I did not rerun the whole of verify fast: its queue wait was about 2 h and the failure is independent of this change. Someone who owns the proxy supervisor tests may want an issue for it.

All other rows PASS, including static builds (aarch64 binary 25005608 bytes, delta +4552328 vs baseline 20453280, report-only), doc comments on diff, doc coverage ratchet, clippy, and privileged integration. My target dir on compute01 is deleted.

**J329 `verify fast` on head `6ddbe4a2c` (compute01, build-slot, foreground; launcher checked first: `nix develop ~/worktrees/j329 -c cargo --version` → cargo 1.99.0). Result: 23 of 24 rows PASS; the workspace `test` row FAILED (exit 101) on a flaky proxy test that fails the same way on unmodified origin/dev.** Verbatim table (log `~/j329/fast.log` on compute01): ``` | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=1 ``` **The one failure.** `test` → `error: test failed, to rerun pass -p infraternal-plugin-proxy --lib`: `supervisor_tests::the_parent_death_signal_survives_the_credential_drop` panicked at `crates/plugins/proxy/src/supervisor_tests.rs:879` (`spawn probe: Os { code: 20, kind: NotADirectory }`); the other 122 proxy tests and every other crate passed. I touch nothing in `crates/plugins/proxy`. **Proof it is a pre-existing flake** (`~/j329/proxy-flake.log` on compute01): `cargo test -p infraternal-plugin-proxy --lib`, 12 full runs each, same VM, same flags. Unmodified origin/dev `fba745051`: **2 of 12 FAILED** (run 2: 3 failed; run 11: 1 failed). My head `6ddbe4a2c`: **2 of 12 FAILED** (runs 5 and 9, 1 failed each). The failing test differs from run to run (the parent-death test, `the_public_gate_is_closed…`, `mesh_grant_revocation_…`, `unconfirmed_route_removal_…`), and the parent-death test passes alone on my head. I did not rerun the whole of `verify fast`: its queue wait was about 2 h and the failure is independent of this change. Someone who owns the proxy supervisor tests may want an issue for it. All other rows PASS, including `static builds` (aarch64 binary 25005608 bytes, delta +4552328 vs baseline 20453280, report-only), `doc comments on diff`, `doc coverage ratchet`, `clippy`, and `privileged integration`. My target dir on compute01 is deleted.

kayg referenced this issue

2026-11-07 06:58:55 +00:00

Proxy child descriptor mapping refused when a source fd equals its target (flaky the_public_gate_is_closed… test) #414

kayg referenced this issue

2026-11-07 10:44:33 +00:00

Proxy child descriptor mapping refused when a source fd equals its target (flaky the_public_gate_is_closed… test) #414

kayg referenced this issue

2026-11-10 14:48:57 +00:00

J476: added host details show server hardware in production #485

kayg referenced this issue

2026-11-10 14:51:15 +00:00

J476: added host details show server hardware in production #485