S1: remote infraternal agents, phase 1 (transport, CA, enrollment, renewal, chaos-proven)

kayg commented

2026-10-07 10:26:37 +00:00

Owner

S1 remote infraternal agents, phase 1 (D114, D128, D132–D137): an operator join command, the internal CA, enrollment with one-time tokens, mTLS over QUIC with a TCP/TLS fallback, 7-day certificates with invisible renewal, reconnect and resume, terminal sessions through a remote agent, revocation and uninstall, fail-closed lease. Proven on o1 and o2 with chaos tests before any UI (D137). The add-host UI comes later (D138–D141 design + mockups).

kayg commented

2026-10-07 10:27:39 +00:00

Author

Owner

Started remote-agents at base fca6e093d8 (clean worktree, sole writer). Read CLAUDE.md, DECISIONS.md, ARCHITECTURE.md, PROCESS.md and bootstrap/wire/shim contracts. #78 has no previous comments; S1 grill #5 and data-layout #34 read. Finding: base DECISIONS.md ends at D112; required D114/D122/D128/D130–137/D145/D156/D160 are absent. Bootstrap §2 step 6 already specifies Ed25519 host keys; wire §1 specifies quinn/BBR. Checking available owner history before additive contracts or foundational choices.

Started remote-agents at base fca6e093d8d07524e5f7014d0e9d730781f24239 (clean worktree, sole writer). Read CLAUDE.md, DECISIONS.md, ARCHITECTURE.md, PROCESS.md and bootstrap/wire/shim contracts. #78 has no previous comments; S1 grill #5 and data-layout #34 read. Finding: base DECISIONS.md ends at D112; required D114/D122/D128/D130–137/D145/D156/D160 are absent. Bootstrap §2 step 6 already specifies Ed25519 host keys; wire §1 specifies quinn/BBR. Checking available owner history before additive contracts or foundational choices.

kayg commented

2026-10-07 10:29:33 +00:00

Author

Owner

Owner decisions recovered read-only from local main (git show main:DECISIONS.md), including D114/D122/D124/D128/D130–137/D145/D156/D160; branch decisions unchanged. Real hosts reachable through netbird ssh --no-browser: o1 and o2 both uid1002, Linux aarch64, XDG_RUNTIME_DIR=/run/user/1002, systemctl present; nothing installed. Primitive smoke measurement on dev i9-9900K/8vCPU, system OpenSSL3.5.7: P256 sign/verify 37018/12007 ops/s, Ed25519 17919/7802 ops/s (1s each, unpinned diagnostic only). Host Ed25519 is already in bootstrap §2. CA proposed conservative Ed25519 consistent with host keys, pending real X509 measurements; no primitive decision file changes. Open security question to owner: CA unlock source for unattended restart/renewal (systemd memory credential/FD versus owner browser unlock). Independent next step: persistent host identity and hashed one-time join-token state; no CA unlock or new crypto/transport library choice needed.

kayg commented

2026-10-07 10:30:05 +00:00

Author

Owner

Additive contract proposal before code: introduce contracts/remote.md for persistent host/mode identity, SHA256-only 256-bit join tokens (900s exact expiry), atomic single-winner redemption checked against host/mode/revocation, certificate ledger with overlapping generations, and revocation tombstones retained for authenticated removal on next contact. Existing wire/shim/upgrade frames stay unchanged. CA encryption unlock remains an owner question; enrollment trust must be provisioned with a CA pin through stdin/FD, never URL token/argv or unauthenticated TOFU. QUIC uses native streams; TCP uses existing mux. No listener on managed hosts. Initial implementation step is identity/token storage only; it must not enable unauthenticated remote terminal routing.

kayg referenced this issue

2026-10-07 10:31:29 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg commented

2026-10-07 10:41:11 +00:00

Author

Owner

Identity storage implementation checks: strict all-target server Clippy PASS; five real file-backed SQLite tests PASS (1.43s): exact900s expiry, owner/host/mode binding and replacement, two concurrent redemptions/one winner, failed certificate insert rolls back consumption, durable revocation after DB reopen. No listener/API/routing enabled. Whole X509 diagnostic (vendored OpenSSL3.6.3, debug wrapper,2000samples,8vCPU shared build load): Ed25519 p50/p99 359/7688us,0.82CPU-s; P256327/12727us,0.74CPU-s. 500 retained certs add1064KiB each; DER totals177500B Ed/185998B P256. This is diagnostic, not pinned D41/D133 acceptance or live renewal evidence. Baseline exact Nix fast still cold-building static targets. Browser port4701 run retains a motion timing failure during concurrent builds; will rerun unchanged after builds. CA unlock source remains needed from owner before persistence/integration.

kayg commented

2026-10-07 10:51:44 +00:00

Author

Owner

Transport integration finding: contracts/wire.md §3 QUIC native stream IDs are not durable writer authority. Current shim SelectWriter identity is the server-assigned u32 leg-B id (daemon.rs Link::connect; wire §5 writer authority); QUIC IDs are connection-scoped and restart in a new connection (RFC9000 §2.1 https://www.rfc-editor.org/rfc/rfc9000.html#section-2.1). Reusing native IDs after reconnect would collide with retained shim cursors. Additive proposal for the next transport step: authenticated binding of each native terminal stream to the existing durable server-assigned writer id before AttachTerm, using a bounded control Call/negotiated capability; retain all v1 frame layouts and TCP mux behavior. Needs real multi-device reconnect test, not stream-ID assumptions. No QUIC integration has been enabled.

kayg commented

2026-10-07 10:54:55 +00:00

Author

Owner

Completed logical step: Specify remote identity and transport invariants before implementation. SHA 9e00a32add. Exact requested Nix fast gate exit0; full output contract-fast.log. No remote listener or installation enabled.

Completed logical step: Specify remote identity and transport invariants before implementation. SHA 9e00a32addb63e5ab48fe648f17085c79bc3ae4c. Exact requested Nix fast gate exit0; full output contract-fast.log. No remote listener or installation enabled.

kayg commented

2026-10-07 10:59:13 +00:00

Author

Owner

Completed logical step: Persist remote host tombstones and public enrollment authority. SHA 046de3c652. Exact requested Nix fast gate exit0; full output schema-fast.log. No remote listener or installation enabled.

Completed logical step: Persist remote host tombstones and public enrollment authority. SHA 046de3c6520e0de04f6de96667e1c098636e3941. Exact requested Nix fast gate exit0; full output schema-fast.log. No remote listener or installation enabled.

kayg commented

2026-10-07 11:05:35 +00:00

Author

Owner

Blocked for CA persistence/runtime integration: owner must specify the CA unlock source after restart. Proposed options: systemd memory credential with an inherited-FD/stdin operator adapter, or explicit owner browser unlock after restart. Neither encrypted CA material plus a plaintext adjacent unlock file nor silently changing unattended-start behavior is acceptable. CLAUDE.md reserves foundational crypto choices for owner; no new CA unlock policy/library has been selected. Independent identity steps continue through separate exact fast gates (contract9e00a32, schema046de3c); no remote daemon installed and no full phase1/chaos acceptance claimed. Clarification was requested in the job UI.

kayg commented

2026-10-07 11:06:17 +00:00

Author

Owner

Completed logical step: Redeem host-bound invitations and certificates in one SQLite transaction. SHA 15c80880bf. Exact requested Nix fast gate exit0; full output storage-fast.log. No remote listener or installation enabled.

Completed logical step: Redeem host-bound invitations and certificates in one SQLite transaction. SHA 15c80880bf789a71ac893ce611163c45fa63267b. Exact requested Nix fast gate exit0; full output storage-fast.log. No remote listener or installation enabled.

kayg commented

2026-10-07 11:10:17 +00:00

Author

Owner

Completed logical step: Prove enrollment races and revocation persistence with real SQLite. SHA 3c3276beac. Exact requested Nix fast gate exit0; full output identity-tests-fast.log. No remote listener or installation enabled.

Completed logical step: Prove enrollment races and revocation persistence with real SQLite. SHA 3c3276beac7fba103e81d31a8add2f33f6e7a105. Exact requested Nix fast gate exit0; full output identity-tests-fast.log. No remote listener or installation enabled.

kayg commented

2026-10-07 11:11:33 +00:00

Author

Owner

Routing finding with real-host evidence: dev effective uid=1001 (id -u); both o1/o2 report uid1002. Existing embedded.rs:519 adapts terminal.open with the server effective uid. That is correct for the embedded socketpair but cannot be reused for remote rootless sessions: daemon launch refuses a different uid. contracts/remote.md requires the trusted enrolled host uid for remote rootless calls; the new host table records execution_uid. Next routing step must carry host identity/uid separately from browser input and retain a real1001→1002 end-to-end test.

kayg referenced this issue

2026-10-07 11:14:18 +00:00

Status board: work in flight (kept current) #24

kayg commented

2026-10-07 11:14:32 +00:00

Author

Owner

Completed logical step: Measure candidate CA issuance and certificate memory without selecting crypto. SHA 97160ffb01. Exact requested Nix fast gate exit0; full output ca-benchmark-fast.log. No remote listener or installation enabled.

Completed logical step: Measure candidate CA issuance and certificate memory without selecting crypto. SHA 97160ffb01808106c885286d7cac7a85772ff04f. Exact requested Nix fast gate exit0; full output ca-benchmark-fast.log. No remote listener or installation enabled.

kayg referenced this issue

2026-10-07 11:34:43 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg commented

2026-10-07 12:08:57 +00:00

Author

Owner

Fixture follow-up: WAL/NORMAL precondition first failed (DELETE vs WAL), then all six enrollment tests passed after matching runtime.rs SQLite policy. The exact fast gate failed in unchanged crates/infraternal/tests/shim.rs:450 (detached producer deadline); isolated 500-host storage measurement overlapped other machine jobs at load 31.10 and has p99 348119/682982 us for issue/redeem. These are noisy diagnostics, not acceptance budgets. Gate rerun is running without overlapping this job’s measurements.

kayg commented

2026-10-07 12:16:49 +00:00

Author

Owner

Latest gate is red after RUST_TEST_THREADS=1 scheduling with unchanged assertions/deadlines: review3_backend_reply_has_a_deadline and review3_busy_expiry closed the WebSocket unexpectedly; review4_ten_second_open_preserves_authority rejected the live open. fmt, VT fmt, clippy, cargo-deny and both static builds passed. Log: evidence/remote-agents/fixture-policy-fast-serial.log. No leaked processes from this worktree were found beyond its active test. The fixture correction and docs/verification/remote-agents.md remain uncommitted under the atomic passing-gate rule. Final browser run uses port 4701 after this job’s Rust work finished.

kayg commented

2026-10-07 12:24:57 +00:00

Author

Owner

Checkpoint handoff: phase 1 is INCOMPLETE. remote-agents base fca6e093d8; head 97160ffb01. Five logical commits each passed their own exact fast gate (logs contract/schema/storage/identity-tests/ca-benchmark-fast.log). Implemented: additive proposed contract, public identity schema, hashed one-time capability storage with atomic redemption, five real SQLite correctness tests plus an explicit 500-host diagnostic, existing-OpenSSL CA-candidate benchmark. No transport or production CA/enrollment endpoint is implemented.

Latest WAL/NORMAL fixture correction and docs/verification/remote-agents.md are uncommitted because subsequent full gates are red. Latest serial run failed unchanged backend-reply deadline, busy-expiry and ten-second-open authority tests; no thresholds were weakened. Command: RUST_TEST_THREADS=1 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast. Verbatim summary:

Final browser: TRACER_TEST_PORT=4701 bun x playwright test, 32 passed / 3 failed (6.9m): motion shader 18 frames vs minimum20, terminal probe 224/500 painted before timeout, first-paint screenshot timeout. Logs: evidence/remote-agents/fixture-policy-fast-serial.log and browser-final.log. Explicit masked production screenshots remain in apps/tracer/test-results; automatic page snapshots were removed.

Pending owner policy: CA unlock source (memory credential/operator FD versus owner unlock after restart). CA directory table proposed on #34. Remaining work: encrypted CA/rotation, bounded validated CSR and fuzzing, join adapter, QUIC/mTLS+TCP fallback, remote session/writer binding and host uid, renewal, revocation/removal/uninstall, fail-closed lease and full rootless real-host chaos/budgets. o1/o2 read-only probes succeeded (aarch64 uid1002); neither host was modified. No remote-session, renewal, reconnect, exact-byte or idle-wakeup proof is claimed. No push/deploy/merge. Job-owned 8.6 GiB scratch and target link removed; logs retained. Issue stays open.

Checkpoint handoff: phase 1 is INCOMPLETE. remote-agents base fca6e093d8d07524e5f7014d0e9d730781f24239; head 97160ffb01808106c885286d7cac7a85772ff04f. Five logical commits each passed their own exact fast gate (logs contract/schema/storage/identity-tests/ca-benchmark-fast.log). Implemented: additive proposed contract, public identity schema, hashed one-time capability storage with atomic redemption, five real SQLite correctness tests plus an explicit 500-host diagnostic, existing-OpenSSL CA-candidate benchmark. No transport or production CA/enrollment endpoint is implemented. Latest WAL/NORMAL fixture correction and docs/verification/remote-agents.md are uncommitted because subsequent full gates are red. Latest serial run failed unchanged backend-reply deadline, busy-expiry and ten-second-open authority tests; no thresholds were weakened. Command: RUST_TEST_THREADS=1 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast. Verbatim summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ Final browser: TRACER_TEST_PORT=4701 bun x playwright test, 32 passed / 3 failed (6.9m): motion shader 18 frames vs minimum20, terminal probe 224/500 painted before timeout, first-paint screenshot timeout. Logs: evidence/remote-agents/fixture-policy-fast-serial.log and browser-final.log. Explicit masked production screenshots remain in apps/tracer/test-results; automatic page snapshots were removed. Pending owner policy: CA unlock source (memory credential/operator FD versus owner unlock after restart). CA directory table proposed on #34. Remaining work: encrypted CA/rotation, bounded validated CSR and fuzzing, join adapter, QUIC/mTLS+TCP fallback, remote session/writer binding and host uid, renewal, revocation/removal/uninstall, fail-closed lease and full rootless real-host chaos/budgets. o1/o2 read-only probes succeeded (aarch64 uid1002); neither host was modified. No remote-session, renewal, reconnect, exact-byte or idle-wakeup proof is claimed. No push/deploy/merge. Job-owned 8.6 GiB scratch and target link removed; logs retained. Issue stays open.

kayg commented

2026-10-07 12:28:33 +00:00

Author

Owner

Run 2 started: sole writer on remote-agents; original base fca6e093d8, resumed head 97160ffb01. Read all 15 comments on #78 and parent #5; reading #34 layout history. Preserving uncommitted WAL fixture/report. Continuation authorizes CaKeySource abstraction and provisional Ed25519 constant while owner policy remains pending; no waiting on that policy. Current 8-core load26.64/24.75/22.98; requested CPUWeight10000 user scope works. No push/deploy/merge.

Run 2 started: sole writer on remote-agents; original base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed head 97160ffb01808106c885286d7cac7a85772ff04f. Read all 15 comments on #78 and parent #5; reading #34 layout history. Preserving uncommitted WAL fixture/report. Continuation authorizes CaKeySource abstraction and provisional Ed25519 constant while owner policy remains pending; no waiting on that policy. Current 8-core load26.64/24.75/22.98; requested CPUWeight10000 user scope works. No push/deploy/merge.

kayg commented

2026-10-07 12:29:43 +00:00

Author

Owner

Run2 additive admission proposal: DER-only CSR at most4096bytes, exactly one canonical PKCS10 object, version0, Ed25519 key and verified signature. Ignore requested subject/extensions entirely; signer constructs host UUID SAN, clientAuth only, digitalSignature and seven-day validity. CaKeySource supplies unlocked private key plus public issuer; wrong/missing source fails closed, no automatic regeneration. Provisional CA primitive centralized at one constant per continuation. No endpoint until authenticated pinned channel and bounded admission exist. QUIC binding remains server-assigned durable writer id independent of native stream id.

kayg commented

2026-10-07 12:36:15 +00:00

Author

Owner

Run2 evidence: CPUWeight10000 fast rerun passes earlier unchanged review3 backend deadline/busy expiry and review4 ten-second-open tests so far; full gate still building. Full browser port4701 under same scope:33passed/2failed in3.9m, copy-feedback data-done at motion-audit:404 and painted500-key p99=22.6ms vs20ms. Load ranged9.10–29.16 on8cores. Baseline ac03b19 targeted same-scope comparison running in job scratch. CSR valid request test failed before implementation then two real-OpenSSL tests passed, including every truncation, suffix, forged signature, wrong version/algorithm and4097-byte input; ca source/host signer tests RED→GREEN4/4, no listener enabled. Logs evidence/remote-agents/run2-*.log.

Run2 evidence: CPUWeight10000 fast rerun passes earlier unchanged review3 backend deadline/busy expiry and review4 ten-second-open tests so far; full gate still building. Full browser port4701 under same scope:33passed/2failed in3.9m, copy-feedback data-done at motion-audit:404 and painted500-key p99=22.6ms vs20ms. Load ranged9.10–29.16 on8cores. Baseline ac03b19 targeted same-scope comparison running in job scratch. CSR valid request test failed before implementation then two real-OpenSSL tests passed, including every truncation, suffix, forged signature, wrong version/algorithm and4097-byte input; ca source/host signer tests RED→GREEN4/4, no listener enabled. Logs evidence/remote-agents/run2-*.log.

kayg commented

2026-10-07 12:38:50 +00:00

Author

Owner

Run2 measured actual signer boundary (not live renewal/transport):1000 verified client certificate constructions+chain checks, debug/OpenSSL3.6.3 on i9-9900K8CPU under CPUWeight10000, load12.25/16.60/20.06. p50/p99=321/2645us,36CPU ticks,398000DER bytes; processRSS7492→8224KiB retaining1000 public identities (~0.73KiB/identity×1000). Log run2-signing-1000.log. Missing connected-agent/handshake/live-renewal numbers remain explicit. CA unlock abstraction and issuer primitive constant do not choose an unlock policy; locked/mismatched/non-CA/uncovered-validity cases fail closed. Adversarial requested CA/serverAuth/foreign SAN are discarded by signer.

kayg commented

2026-10-07 12:43:37 +00:00

Author

Owner

Completed fixture step 3f3d001b31: WAL/NORMAL measurement fixture matches runtime policy; earlier red policy test retained. Full exact Nix fast under CPUWeight10000 exit0, test73/0fail plus enrolled5/0fail, both static builds PASS. Load at finish4.53/9.82/16.08,8CPU. Full log evidence/remote-agents/run2-fixture-fast.log. Verbatim gate output:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.02s]

kayg commented

2026-10-07 12:44:52 +00:00

Author

Owner

Comparison completed under CPUWeight10000 on archived dev ac03b1913b, no shared branch edits: motion audit fails reduced-copy opacity assertion at:533; terminal returning-signin p99=5060.60ms vs5000; access setup render p99=1688.90ms vs1000. Dev now defaults300ms RTT, unlike this branch local-RTT browser suite, so latency figures are not like-for-like evidence of this lane. Baseline log run2-dev-browser-compare.log; load snapshot run2-baseline-load.txt. Branch complete fast PASSED; no deadlines weakened. Continuing backend modules, browser gate remains red and is not attributed to remote code.

Comparison completed under CPUWeight10000 on archived dev ac03b1913bfb6dd9b978477fc23ee5c88e276f67, no shared branch edits: motion audit fails reduced-copy opacity assertion at:533; terminal returning-signin p99=5060.60ms vs5000; access setup render p99=1688.90ms vs1000. Dev now defaults300ms RTT, unlike this branch local-RTT browser suite, so latency figures are not like-for-like evidence of this lane. Baseline log run2-dev-browser-compare.log; load snapshot run2-baseline-load.txt. Branch complete fast PASSED; no deadlines weakened. Continuing backend modules, browser gate remains red and is not attributed to remote code.

kayg commented

2026-10-07 12:49:35 +00:00

Author

Owner

Further browser rerun under CPUWeight10000 (same branch/tests, port4701):1pass/3fail45.6s; motion sharpness mean diff0.0230745 vs0.02, terminal paint p99=20.1ms vs20, access render p99=3107.1ms vs1000. Load later rose11.55–15.48 on8cores; no UI/source changes or thresholds changed. This is still a red required browser gate; baseline failures have different assertions and300ms defaults, so no causal exoneration claimed. Log run2-browser-quiet.log. Backend isolated join/renewal adapter tests RED→GREEN9pass/1diagnostic ignored in0.08s; no remote endpoint yet.

kayg commented

2026-10-07 12:52:25 +00:00

Author

Owner

kayg commented

2026-10-07 12:56:43 +00:00

Author

Owner

Transport dependency boundary for continuation: D11/wire§1 already selects quinn/BBR. Current quinn0.11.12 defaults to rustls-ring; QUIC configuration needs its rustls0.23 types, while TCP can reuse existing tokio-openssl0.6.5 rather than choose another TLS stack for fallback. Recording this transitive dependency explicitly; no alternative QUIC engine/provider selected. Will report incremental binary/RSS and300ms handshake measurements before claiming transport acceptance. CA gate caught test-only lints (corrected); same-scope daemon idle oracle saw1activation/2.2s atload38.10, isolated rerun underway with threshold0 unchanged.

kayg commented

2026-10-07 13:05:34 +00:00

Author

Owner

Owner answers (2026-10-07):

R1: Ed25519 for the internal CA.
R2: owner picks (b) owner unlocks the CA key after a restart, and asked why this is a problem and how others handle it. Orchestrator explanation and mitigation follow-up pending owner confirmation. Until confirmed, keep CaKeySource pluggable and implement the owner-unlock source (CA key wrapped by an owner-held key, unlocked into memory only).

Owner answers (2026-10-07): - R1: **Ed25519** for the internal CA. - R2: owner picks **(b) owner unlocks the CA key after a restart**, and asked why this is a problem and how others handle it. Orchestrator explanation and mitigation follow-up pending owner confirmation. Until confirmed, keep `CaKeySource` pluggable and implement the owner-unlock source (CA key wrapped by an owner-held key, unlocked into memory only).

kayg commented

2026-10-07 13:09:37 +00:00

Author

Owner

Completed CA signing boundary: CaKeySource, fail-closed unlocked issuer validation, server-owned UUID/client-only seven-day leaf, no copying CSR extensions. Commit recorded on remote-agents; exact CPUWeight=10000 Nix fast gate exit 0, evidence/remote-agents/run2-ca-fast-rerun.log. Verbatim final output: 7 pass; 0 fail; 34390 expect() calls; Ran 7 tests across 2 files. [2.84s]. Signer n=1000: p50/p99 321/2645 us, 36 CPU ticks, 398000 DER bytes, RSS 7492→8224 KiB. These are signing boundary numbers, not live renewal or connected-host acceptance. Review reproduced three CSR parser gaps: cached signed nonminimal inner length, absent mandatory attributes, Ed25519 signature NULL parameters. Fixing with signed regressions before enrollment registration.

kayg commented

2026-10-07 13:14:54 +00:00

Author

Owner

Owner decision recorded as D168 (main): Ed25519. The CA key stays locked after a cold start until any administrator unlocks it with their passkey (one wrapped copy per administrator; granting or revoking the role rewraps it). Auto-update and rollback hand the unlocked key to the new process in memory. Locked state blocks only enrollment and renewal. Agents renew at half-life. Notifications go out while locked. Implement CaKeySource accordingly; the in-memory handoff can come in the auto-update slice, but design the interface for it now.

Owner decision recorded as **D168** (main): Ed25519. The CA key stays locked after a cold start until **any administrator** unlocks it with their passkey (one wrapped copy per administrator; granting or revoking the role rewraps it). Auto-update and rollback hand the unlocked key to the new process in memory. Locked state blocks only enrollment and renewal. Agents renew at half-life. Notifications go out while locked. Implement `CaKeySource` accordingly; the in-memory handoff can come in the auto-update slice, but design the interface for it now.

kayg commented

2026-10-07 13:17:34 +00:00

Author

Owner

Run3 started as sole writer on remote-agents, original base fca6e093d8, resumed head356d055. Read all27 comments on #78, parent#5, layout#34 and D168 from main. Preserving inherited CSR regression and unregistered modules. D168 now authoritative: Ed25519, administrator passkey unlock after cold start, memory handoff for updates, enrollment/renewal only blocked while locked, half-life renewal. Current8CPU load23.03/22.63/24.20; no push/deploy/merge.

Run3 started as sole writer on remote-agents, original base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed head356d055. Read all27 comments on #78, parent#5, layout#34 and D168 from main. Preserving inherited CSR regression and unregistered modules. D168 now authoritative: Ed25519, administrator passkey unlock after cold start, memory handoff for updates, enrollment/renewal only blocked while locked, half-life renewal. Current8CPU load23.03/22.63/24.20; no push/deploy/merge.

kayg commented

2026-10-07 13:19:46 +00:00

Author

Owner

Run3 parser finding RED→GREEN: signed constructed OCTET STRING in ignored PKCS10 attribute passed OpenSSL proof/cache and inherited preflight; test signed_constructed_primitive_attribute_is_refused failed at csr.rs:297. Reject universal constructed primitive tags before OpenSSL. All5CSR tests now pass, including signed cached nonminimal inner length, absent attributes and forbidden Ed25519 NULL parameters. Evidence run3-csr-red.log/run3-csr-green.log. Full scoped fast underway; thresholds unchanged.

kayg commented

2026-10-07 13:21:39 +00:00

Author

Owner

D168 additive contract update before implementation: replace provisional CA text with owner-selected Ed25519, cold-start administrator passkey unlock, one envelope per administrator with rewrap on role change, in-memory update/rollback handoff, retained public trust while locked, enrollment/renewal-only restriction, half-life deadline and administrator notifications. Memory source will validate unlocked material against retained issuer generation and expose lock-state watch without polling. Existing owner-only auth has no administrator-role adapter; do not conflate owner with administrator or expose an unauthenticated unlock endpoint.

kayg commented

2026-10-07 13:38:40 +00:00

Author

Owner

Run3 D168 interface evidence: MemoryCaSource cold-start locked/public issuer retained; denied unlock or different issuer leaves locked; validated administrator-policy adapter unlock notifies via watch; process-only handoff preserves signing, independent cold construction locks. Tests2/2 PASS after runtime RED. Enrollment now reloads the live CaKeySource per join/renewal: malformed/locked attempts preserve tokens, cold signing lock preserves public certificate admission; tests2/2 PASS after runtime RED. Real WAL SQLite revocation-while-renewal-waits-for-writer test PASS, no new certificate published, tombstone survives reopen. No unlock HTTP endpoint or remote listener yet. Full fast remains red in unchanged vt_credit detached12MiB producer5s precondition; same-scope isolated branch13.06s and archived dev ac03b19 25.06s both pass, load12–36. Evidence run3-ca-memory-, run3-enrollment-source-, run3-renew-revoke.log, run3-credit-*.log.

Run3 D168 interface evidence: MemoryCaSource cold-start locked/public issuer retained; denied unlock or different issuer leaves locked; validated administrator-policy adapter unlock notifies via watch; process-only handoff preserves signing, independent cold construction locks. Tests2/2 PASS after runtime RED. Enrollment now reloads the live CaKeySource per join/renewal: malformed/locked attempts preserve tokens, cold signing lock preserves public certificate admission; tests2/2 PASS after runtime RED. Real WAL SQLite revocation-while-renewal-waits-for-writer test PASS, no new certificate published, tombstone survives reopen. No unlock HTTP endpoint or remote listener yet. Full fast remains red in unchanged vt_credit detached12MiB producer5s precondition; same-scope isolated branch13.06s and archived dev ac03b19 25.06s both pass, load12–36. Evidence run3-ca-memory-*, run3-enrollment-source-*, run3-renew-revoke.log, run3-credit-*.log.

kayg commented

2026-10-07 13:46:55 +00:00

Author

Owner

Transport step before QUIC code: reuse D11 quinn/BBR and its default rustls-ring provider as recorded in run2; reuse existing tokio-openssl for TCP/TLS1.3, explicit pinned roots/mutual auth/ALPN/deadlines/TCP_NODELAY. TCP three real handshake tests RED→GREEN in0.07s: exact bytes+peer fingerprints, wrong pin/name, untrusted client denied. Daemon channel abstraction keeps existing wire/shim framing. Additive native binding uses first raw Call(action_id=transport.bind,call_id=0,{writer_id}) on each server-opened terminal stream, bounded128bytes/5s, nonzero even durable writer id; native QUIC ids never become shim authority. No application listener or browser route enabled yet.

kayg commented

2026-10-07 14:04:19 +00:00

Author

Owner

Native binding review: wire§8 requires peer capability negotiation. Reserve leg-B Hello caps bit1 (REMOTE_WRITER_BINDING; leg-A bit0 RESUME_NEXT unchanged); expose a negotiated connection handle only after peer Hello(version1,caps bit1). open_bound/accept_bound require that handle, so raw transport handshake is insufficient for new terminal binding. Existing embedded caps0 path stays unchanged. Parser ASan evidence: CSR3769187runs/61s and binding8047510runs/61s, no finding, seeded with valid signed CSR and valid/invalid raw binding frames. Transport helpers still have no runtime listener/session route.

kayg commented

2026-10-07 14:19:03 +00:00

Author

Owner

Run3 transport diagnostics (debug, local userspace300ms RTT,25 handshakes,8CPU shared host; not pinned acceptance): QUIC admission p50/p99=476107/492690us,1000 co-resident client/server pairs RSSdelta724100KiB. Source finding quinn-proto connection/streams/state.rs:192 preallocates configured4096 incoming slots per peer. A real-QUIC failing test showed host could open an unauthorized second control stream. Limit server incoming to control0 only, host incoming to existing daemon MAX_SESSIONS128. RED→GREEN3/3. Remeasure QUIC466961/498634us,1000pairs delta67412KiB (~67.412KiB/pair×1000,10.7x smaller); connectCPU987ticks. TCP TLS759650/781337us,1000pairs68688KiB (~68.688KiB/pair×1000),334ticks. RTT proxy adds150ms each direction; TCP includes additional300ms connect emulation. Machine/load logs retained run3-machine.txt and *diagnostic.log. Pair memory includes BOTH endpoints and no daemon/shim registry; do not call it host-daemon RSS. Full path/renewal/idle/real-host acceptance remains pending.

kayg commented

2026-10-07 14:33:40 +00:00

Author

Owner

Completed CSR canonical admission fix a5dd25fa04: signed cached BER/noncanonical regressions RED→GREEN,5CSR tests PASS; ASan3769187runs/61s no finding. Exact Nix fast with CPUWeight10000 and RUST_TEST_THREADS=1 exit0 on the isolated commit tree. Evidence run3-csr-isolated-fast.log. Verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.62s]

kayg commented

2026-10-07 14:40:43 +00:00

Author

Owner

Read-only security review confirmed signed CSR canonicality gaps: nonminimal ENUMERATED and invalid UTF8String inside unknown attributes verify and round-trip through OpenSSL unchanged. Proposing an explicit bounded CSR value profile: validate accepted integer/string encodings, reject unsupported primitive types and context tags, rather than treating unknown ASN.1 values as canonical. Add signed RED regressions before fixing. The inherited dispatcher also needs remote partial-frame and stalled-write deadlines before runtime exposure; these are remote-readiness findings, not regressions attributed to this parser. No production adapter enabled. Refs: #78.

kayg commented

2026-10-07 14:52:53 +00:00

Author

Owner

csr-values-rerun: Validate ignored CSR value encodings (#78). HEAD c735658530. Signed regressions reproduced cached nonminimal ENUMERATED and invalid UTF-8 values accepted by OpenSSL. Validate integer and supported string forms and refuse unsupported implicit/primitive types instead of assuming ignored attributes are canonical. Reject extending this bounded host CSR profile into a general ASN.1 engine. Decisions 40, 133 and 168; RED regression then six parser tests green.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 15.37 13.19 16.45 17/1309 4107212. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-csr-values-rerun-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.82s]

csr-values-rerun: Validate ignored CSR value encodings (#78). HEAD c735658530417ec3fbb3f24ca39f012b3a1bafdc. Signed regressions reproduced cached nonminimal ENUMERATED and invalid UTF-8 values accepted by OpenSSL. Validate integer and supported string forms and refuse unsupported implicit/primitive types instead of assuming ignored attributes are canonical. Reject extending this bounded host CSR profile into a general ASN.1 engine. Decisions 40, 133 and 168; RED regression then six parser tests green. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 15.37 13.19 16.45 17/1309 4107212. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-csr-values-rerun-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.82s] ```

kayg commented

2026-10-07 14:56:46 +00:00

Author

Owner

Browser gate at CSR HEAD c735658, contract-only WIP: systemd-run --user --scope -p CPUWeight=10000 env TRACER_TEST_PORT=4701 bun x playwright test in apps/tracer; exit 0. Verbatim final output: 35 passed (3.2m). Browser plugin unavailable; repository Playwright harness used. Existing local test-double probe: 500/500 browser keys, 2004 double marks, resume 78.10 ms, keydown→onData p50/p99 0.10/0.20 ms, term.write→callback p50/p99 14.30/15.20 ms. Production-build screenshots: apps/tracer/test-results/terminal-first-run-passkey-29742-esume-and-the-latency-probe/tracer-terminal.png and tracer-probe.png. Full log evidence/remote-agents/run3-browser.log. No frontend change or visual-quality claim; this is not o1/o2 remote transport proof. Refs: #78.

Browser gate at CSR HEAD c735658, contract-only WIP: systemd-run --user --scope -p CPUWeight=10000 env TRACER_TEST_PORT=4701 bun x playwright test in apps/tracer; exit 0. Verbatim final output: `35 passed (3.2m)`. Browser plugin unavailable; repository Playwright harness used. Existing local test-double probe: 500/500 browser keys, 2004 double marks, resume 78.10 ms, keydown→onData p50/p99 0.10/0.20 ms, term.write→callback p50/p99 14.30/15.20 ms. Production-build screenshots: apps/tracer/test-results/terminal-first-run-passkey-29742-esume-and-the-latency-probe/tracer-terminal.png and tracer-probe.png. Full log evidence/remote-agents/run3-browser.log. No frontend change or visual-quality claim; this is not o1/o2 remote transport proof. Refs: #78.

kayg commented

2026-10-07 14:57:04 +00:00

Author

Owner

contract: Specify cold CA unlock and negotiated remote stream binding (#78). HEAD e1cd4ebb56. Record owner Ed25519 and administrator passkey cold-start policy, memory-only update handoff, half-life renewal and locked enrollment semantics. Add negotiated leg-B capability bit 1 and bounded server-assigned writer binding without changing existing frames. Reject deriving writer identity from QUIC stream ids or making signer lock block public certificate admission. Decisions 64, 133, 168; proposals recorded on #78 before implementation.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 5.29 11.06 14.57 2/1043 4181741. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-contract-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.03s]

contract: Specify cold CA unlock and negotiated remote stream binding (#78). HEAD e1cd4ebb56397f8225eedf09d285c054f6446bd2. Record owner Ed25519 and administrator passkey cold-start policy, memory-only update handoff, half-life renewal and locked enrollment semantics. Add negotiated leg-B capability bit 1 and bounded server-assigned writer binding without changing existing frames. Reject deriving writer identity from QUIC stream ids or making signer lock block public certificate admission. Decisions 64, 133, 168; proposals recorded on #78 before implementation. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 5.29 11.06 14.57 2/1043 4181741. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-contract-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.03s] ```

kayg referenced this issue

2026-10-07 15:00:48 +00:00

Mesh core slice 1: coordination, join, rules, rotation (D163–D167) #80

kayg commented

2026-10-07 15:04:38 +00:00

Author

Owner

ca-memory: Keep CA unlock and update handoff in process memory (#78). HEAD db4660c975. Introduce trusted administrator unlock adapter and cold-locked key source with independent public trust and watch notifications. Validate unlocked identity before publication and transfer secrets through an opaque nonserializable handoff. Reject persisting plaintext or authorizing with an owner flag. Role/envelope storage and update IPC integration remain later adapters. Decision 168; two real signing tests cover denied unlock, issuer mismatch, handoff and cold restart.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 6.63 8.33 12.61 1/1079 4193790. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-ca-memory-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.66s]

ca-memory: Keep CA unlock and update handoff in process memory (#78). HEAD db4660c975667bc83853ac1ca5f988ba9bdbb6c9. Introduce trusted administrator unlock adapter and cold-locked key source with independent public trust and watch notifications. Validate unlocked identity before publication and transfer secrets through an opaque nonserializable handoff. Reject persisting plaintext or authorizing with an owner flag. Role/envelope storage and update IPC integration remain later adapters. Decision 168; two real signing tests cover denied unlock, issuer mismatch, handoff and cold restart. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 6.63 8.33 12.61 1/1079 4193790. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-ca-memory-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.66s] ```

kayg commented

2026-10-07 15:11:53 +00:00

Author

Owner

host-authority: Bind remote admission and renewal to durable host authority (#78). HEAD 8c9b9a820f. Lookup enrolled execution uid from valid leaf identity and durable host tombstones; atomically recheck predecessor, host and same key when publishing seven-day renewal overlap. Revoke only through bound owner authority. Reject certificate validity alone and check-then-write renewal races. Decisions 13, 133 and 134; SQLite tests cover rootless/rootful uid, overlap and tombstones.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 11.94 9.32 10.98 4/1249 61465. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-host-authority-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.69s]

host-authority: Bind remote admission and renewal to durable host authority (#78). HEAD 8c9b9a820f0bc5b30df3b5759928fec4f956c004. Lookup enrolled execution uid from valid leaf identity and durable host tombstones; atomically recheck predecessor, host and same key when publishing seven-day renewal overlap. Revoke only through bound owner authority. Reject certificate validity alone and check-then-write renewal races. Decisions 13, 133 and 134; SQLite tests cover rootless/rootful uid, overlap and tombstones. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 11.94 9.32 10.98 4/1249 61465. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run3-host-authority-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.69s] ```

kayg commented

2026-10-07 15:22:23 +00:00

Author

Owner

Fresh run-3 signer diagnostic after the D168 memory-source changes and CSR value fix: systemd-run --user --scope -p CPUWeight=10000 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c cargo test --locked -p infraternal-server --lib signing_boundary_at_1000_public_identities -- --ignored --nocapture; exit 0. Verbatim measurement:

signing_boundary n=1000 p50_us=382 p99_us=4579 cpu_ticks=43 retained_der_bytes=398000 baseline_rss_kib=12420 retained_rss_kib=16032 rss_delta_per_identity_kib=3.616 scale=1000 load=13.46 8.53 9.54 23/1315 193792

Machine infraternal-dev, i9-9900K, 8 cores, debug profile; log evidence/remote-agents/run3-signing-rerun.log. Retained public identities only, not connected infraternal-agent RSS, network bytes or live renewal under 50 MiB output. No pinned performance budget or regression conclusion from differing shared load. Refs: #78.

Fresh run-3 signer diagnostic after the D168 memory-source changes and CSR value fix: `systemd-run --user --scope -p CPUWeight=10000 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c cargo test --locked -p infraternal-server --lib signing_boundary_at_1000_public_identities -- --ignored --nocapture`; exit 0. Verbatim measurement: ``` signing_boundary n=1000 p50_us=382 p99_us=4579 cpu_ticks=43 retained_der_bytes=398000 baseline_rss_kib=12420 retained_rss_kib=16032 rss_delta_per_identity_kib=3.616 scale=1000 load=13.46 8.53 9.54 23/1315 193792 ``` Machine infraternal-dev, i9-9900K, 8 cores, debug profile; log evidence/remote-agents/run3-signing-rerun.log. Retained public identities only, not connected infraternal-agent RSS, network bytes or live renewal under 50 MiB output. No pinned performance budget or regression conclusion from differing shared load. Refs: #78.

kayg commented

2026-10-07 15:28:40 +00:00

Author

Owner

Run 4 started as sole writer on remote-agents, original base fca6e093d8, resumed head 8c9b9a820f. Read all 42 comments and parent #5. Preserving uncommitted QUIC/TLS/enrollment/lease modules; removing docs/superpowers planning artifacts per continuation. Will merge local dev before final gate as authorized. No push, deployment or remote installation yet.

Run 4 started as sole writer on remote-agents, original base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed head 8c9b9a820f0bc5b30df3b5759928fec4f956c004. Read all 42 comments and parent #5. Preserving uncommitted QUIC/TLS/enrollment/lease modules; removing docs/superpowers planning artifacts per continuation. Will merge local dev before final gate as authorized. No push, deployment or remote installation yet.

kayg commented

2026-10-07 15:32:10 +00:00

Author

Owner

Run 4 integration: merged local dev 9c62448a32 into remote-agents at 80d090b07232fadff46e49fb9e08a5d0287fc942, clean merge, preserving untracked transport work and enrollment registration. This brings #65 deterministic fixes and the default 300 ms latency profile. Exact scoped fast gate is running; start load 20.28/16.02/12.67 on 8 cores. docs/superpowers removed; no evidence files staged.

Run 4 integration: merged local dev 9c62448a32a75a1365c4004c982abf3336ca4883 into remote-agents at 80d090b07232fadff46e49fb9e08a5d0287fc942, clean merge, preserving untracked transport work and enrollment registration. This brings #65 deterministic fixes and the default 300 ms latency profile. Exact scoped fast gate is running; start load 20.28/16.02/12.67 on 8 cores. docs/superpowers removed; no evidence files staged.

kayg commented

2026-10-07 15:40:53 +00:00

Author

Owner

Run4 enrollment adapter complete at 4d9b11f2d4; local dev merge message amended to c1de0d7622 (tree unchanged). Two real OpenSSL/SQLite adapter tests PASS, server unit tests 90 passed/7 ignored. Exact CPUWeight10000 RUST_TEST_THREADS=4 requested Nix fast exit0; full log evidence/remote-agents/run4-enrollment-fast.log. Static sizes x86_64 16161168 bytes, aarch64 PT_INTERP: absent; size: 13572024 bytes (baseline 13555672 + allowance 262144 = max 13817816). No network endpoint enabled. Verbatim gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.61s]

Run4 enrollment adapter complete at 4d9b11f2d49273b6c0ad278dba891083f2e7075d; local dev merge message amended to c1de0d76222795131a7ee12840ab043a3f7ba469 (tree unchanged). Two real OpenSSL/SQLite adapter tests PASS, server unit tests 90 passed/7 ignored. Exact CPUWeight10000 RUST_TEST_THREADS=4 requested Nix fast exit0; full log evidence/remote-agents/run4-enrollment-fast.log. Static sizes x86_64 16161168 bytes, aarch64 PT_INTERP: absent; size: 13572024 bytes (baseline 13555672 + allowance 262144 = max 13817816). No network endpoint enabled. Verbatim gate output: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.61s] ```

kayg commented

2026-10-07 15:44:56 +00:00

Author

Owner

Run4 RED evidence before remote framing fixes: isolated real socket regressions failed cancellation-retained partial-frame expiry and coalesced partial suffix expiry (run4-frame-red.log); idle case passed. Prepared generic Receive patch preserves first-byte and buffered-suffix arrival timestamps across cancellation; GREEN 3/3 in 0.31s (run4-frame-green.log). Real inherited TLS backpressure/cancellation tests both failed before changes: unbounded write exceeded 7s and cancelled writer left reader reusable (run4-tls-red.log). Tests compiled against existing workspace dependencies without registering remote runtime; dependency gate continues separately. No thresholds changed.

kayg commented

2026-10-07 15:51:45 +00:00

Author

Owner

transport-dependencies: Add adapters for the decided QUIC and existing TLS stacks (#78). HEAD 63408bc904. Reuse D11 quinn/BBR with its rustls-ring provider and existing OpenSSL for TCP fallback. Disable unnecessary QUIC default features; allow compatible ISC transitives. Reject introducing a different congestion engine or a second TCP crypto implementation. Decisions 11 and 64; dependency boundary proposed on #78 before implementation.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 26.34 14.19 12.16 29/1226 376943. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-transport-dependencies-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.81s]

transport-dependencies: Add adapters for the decided QUIC and existing TLS stacks (#78). HEAD 63408bc904735a3ccec89093dac8ad141a8b52a7. Reuse D11 quinn/BBR with its rustls-ring provider and existing OpenSSL for TCP fallback. Disable unnecessary QUIC default features; allow compatible ISC transitives. Reject introducing a different congestion engine or a second TCP crypto implementation. Decisions 11 and 64; dependency boundary proposed on #78 before implementation. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 26.34 14.19 12.16 29/1226 376943. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-transport-dependencies-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.81s] ```

kayg commented

2026-10-07 16:02:26 +00:00

Author

Owner

channel-framing: Reuse leg-B framing across authenticated channels with active deadlines (#78). HEAD 85e6f9bb71. Generalize inherited-socket framing through Channel while preserving borrowed frames and bounded buffers. Keep first-byte and buffered-suffix deadlines across receive cancellation; wholly idle channels arm no timer, and inherited channels avoid clock reads. Retire remote channels on partial-frame expiry. Reject per-call timeout resets and a duplicate remote codec. Decisions 64, 128 and 130; two real socket regressions failed before the fix, then all three passed.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 28.67 22.83 18.27 35/1386 565087. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-channel-framing-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.04s]

channel-framing: Reuse leg-B framing across authenticated channels with active deadlines (#78). HEAD 85e6f9bb712134cbf345065bdf3efb03f1416d7c. Generalize inherited-socket framing through Channel while preserving borrowed frames and bounded buffers. Keep first-byte and buffered-suffix deadlines across receive cancellation; wholly idle channels arm no timer, and inherited channels avoid clock reads. Retire remote channels on partial-frame expiry. Reject per-call timeout resets and a duplicate remote codec. Decisions 64, 128 and 130; two real socket regressions failed before the fix, then all three passed. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 28.67 22.83 18.27 35/1386 565087. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-channel-framing-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.04s] ```

kayg commented

2026-10-07 16:09:17 +00:00

Author

Owner

Run 4 review finding: Receive::next could accept a queued suffix after a retained partial-frame deadline because Tokio timeout_at polls an immediately ready inner read before its timer. Real Unix socket regression with primed reactor readiness reproduced RED: queued_suffix_cannot_complete_an_expired_cancelled_frame returned Ping after expiry (run4-ready-suffix-red.log). Explicit before/after read deadline checks give GREEN: all four remote_deadline_tests pass, 0.17 s (run4-ready-suffix-green.log). Full exact fast gate is running before the separate fix commit. No deadline was extended; wholly idle and inherited channels still have no frame timer.

kayg commented

2026-10-07 16:13:57 +00:00

Author

Owner

ready-suffix: Reject queued bytes after a retained frame deadline expires (#78). HEAD ca2770b638. A cancelled receive could accept a queued suffix after expiry because Tokio polls the inner read before its timeout. Check the retained deadline before and after each read; inherited channels still avoid clock reads. Reject relying on timeout_at alone. Decisions 64 and 128; a real socket with cached readiness fails before the fix and all four deadline regressions pass after it.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.55 11.78 14.31 11/1304 677179. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-ready-suffix-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.14s]

ready-suffix: Reject queued bytes after a retained frame deadline expires (#78). HEAD ca2770b63823c6a73b3179c338c980168bf5ea25. A cancelled receive could accept a queued suffix after expiry because Tokio polls the inner read before its timeout. Check the retained deadline before and after each read; inherited channels still avoid clock reads. Reject relying on timeout_at alone. Decisions 64 and 128; a real socket with cached readiness fails before the fix and all four deadline regressions pass after it. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.55 11.78 14.31 11/1304 677179. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-ready-suffix-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.14s] ```

kayg commented

2026-10-07 16:20:55 +00:00

Author

Owner

tls-fallback: Authenticate TCP fallback and retire incomplete TLS writes (#78). HEAD 7339977425. Reuse OpenSSL TLS1.3 with explicit pinned roots, mutual certificates, ALPN and TCP_NODELAY. Expose only verified leaf fingerprints for durable authority admission. Bound active writes and retire both directions if a frame write fails or is cancelled; idle reads have no timer. Reject continuing after a partial TLS frame or treating PKI alone as host authorization. Decisions 64 and 130; real backpressure/cancellation regressions RED then all five TLS tests GREEN. Runtime listener/routing follows separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 3.56 9.62 12.72 1/990 730840. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-tls-fallback-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.39s]

tls-fallback: Authenticate TCP fallback and retire incomplete TLS writes (#78). HEAD 733997742511d70ce0ff0519c4a9a0397bbb6ca9. Reuse OpenSSL TLS1.3 with explicit pinned roots, mutual certificates, ALPN and TCP_NODELAY. Expose only verified leaf fingerprints for durable authority admission. Bound active writes and retire both directions if a frame write fails or is cancelled; idle reads have no timer. Reject continuing after a partial TLS frame or treating PKI alone as host authorization. Decisions 64 and 130; real backpressure/cancellation regressions RED then all five TLS tests GREEN. Runtime listener/routing follows separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 3.56 9.62 12.72 1/990 730840. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-tls-fallback-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.39s] ```

kayg commented

2026-10-07 16:29:38 +00:00

Author

Owner

quic-binding: Bind authenticated QUIC streams to server-assigned writers (#78). HEAD 6458c638da. Expose the owner-selected quinn/BBR transport with mutually authenticated pinned trust, bounded flow credit and the existing 128 attachment limit. Require negotiated Hello capability before bounded transport.bind; preserve subsequent wire bytes and server-assigned even writer identities across reconnect rather than using native stream ids. No idle timer or 0-RTT. Callers must explicitly bound handshake and Hello negotiation. Decisions 11, 64 and 130; real loopback tests cover stream limits, missing capability, wrong server identity and writer rebinding. Runtime routing follows separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.18 3.45 8.54 2/1021 743846. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-quic-binding-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.66s]

quic-binding: Bind authenticated QUIC streams to server-assigned writers (#78). HEAD 6458c638da9c009c1a0ca3073f8258bdb6601837. Expose the owner-selected quinn/BBR transport with mutually authenticated pinned trust, bounded flow credit and the existing 128 attachment limit. Require negotiated Hello capability before bounded transport.bind; preserve subsequent wire bytes and server-assigned even writer identities across reconnect rather than using native stream ids. No idle timer or 0-RTT. Callers must explicitly bound handshake and Hello negotiation. Decisions 11, 64 and 130; real loopback tests cover stream limits, missing capability, wrong server identity and writer rebinding. Runtime routing follows separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.18 3.45 8.54 2/1021 743846. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-quic-binding-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.66s] ```

kayg commented

2026-10-07 16:31:35 +00:00

Author

Owner

Run 4 D167 diagnostics on infraternal-dev (Linux x86_64, i9-9900K, 8 visible cores), serial CPUWeight10000 scopes and no own concurrent browser/build. Actual Cargo-linked TLS/QUIC modules at 6458c63 plus diagnostic registration: 25 handshakes each at userspace-emulated 300 ms RTT; 1000 retained co-resident client/server pairs. QUIC p50/p99 462.427/465.629 ms, 67.408 KiB/pair x1000 = 67408 KiB; TCP/TLS 758.818/762.982 ms, 69.4 KiB/pair x1000 = 69400 KiB. Signer-only cost over 1000 retained identities: 353/883 us, 39 CPU ticks, 398000 DER bytes, 3.776 KiB/identity x1000 = 3776 KiB. This excludes whole-daemon/session memory and live renewal publication/network costs; those remain acceptance work. Logs evidence/remote-agents/run4-{quic,tcp,signing}-diagnostic.log. Verbatim records:

test transport_diagnostics::quic_300ms_and_1000_connection_pairs ... transport_diagnostic kind=quic_bbr simulated_rtt_ms=300 handshake_n=25 admitted_p50_us=462427 admitted_p99_us=465629 connection_pairs=1000 baseline_rss_kib=15904 retained_rss_kib=83312 combined_client_server_delta_kib_per_pair=67.408 combined_delta_kib_at1000=67408 connect_cpu_ticks=643 machine=infraternal-dev load=15.91 16.38 12.90 5/973 837788
test transport_diagnostics::tcp_300ms_and_1000_connection_pairs ... transport_diagnostic kind=tcp_tls simulated_rtt_ms=300 handshake_n=25 admitted_p50_us=758818 admitted_p99_us=762982 connection_pairs=1000 baseline_rss_kib=13720 retained_rss_kib=83120 combined_client_server_delta_kib_per_pair=69.4 combined_delta_kib_at1000=69400 connect_cpu_ticks=284 machine=infraternal-dev load=14.02 15.90 12.82 15/1091 840344
test ca::tests::signing_boundary_at_1000_public_identities ... signing_boundary n=1000 p50_us=353 p99_us=883 cpu_ticks=39 retained_der_bytes=398000 baseline_rss_kib=12888 retained_rss_kib=16660 rss_delta_per_identity_kib=3.776 scale=1000 load=16.29 16.29 13.03 17/1083 843381

Run 4 D167 diagnostics on infraternal-dev (Linux x86_64, i9-9900K, 8 visible cores), serial CPUWeight10000 scopes and no own concurrent browser/build. Actual Cargo-linked TLS/QUIC modules at 6458c63 plus diagnostic registration: 25 handshakes each at userspace-emulated 300 ms RTT; 1000 retained co-resident client/server pairs. QUIC p50/p99 462.427/465.629 ms, 67.408 KiB/pair x1000 = 67408 KiB; TCP/TLS 758.818/762.982 ms, 69.4 KiB/pair x1000 = 69400 KiB. Signer-only cost over 1000 retained identities: 353/883 us, 39 CPU ticks, 398000 DER bytes, 3.776 KiB/identity x1000 = 3776 KiB. This excludes whole-daemon/session memory and live renewal publication/network costs; those remain acceptance work. Logs evidence/remote-agents/run4-{quic,tcp,signing}-diagnostic.log. Verbatim records: ``` test transport_diagnostics::quic_300ms_and_1000_connection_pairs ... transport_diagnostic kind=quic_bbr simulated_rtt_ms=300 handshake_n=25 admitted_p50_us=462427 admitted_p99_us=465629 connection_pairs=1000 baseline_rss_kib=15904 retained_rss_kib=83312 combined_client_server_delta_kib_per_pair=67.408 combined_delta_kib_at1000=67408 connect_cpu_ticks=643 machine=infraternal-dev load=15.91 16.38 12.90 5/973 837788 test transport_diagnostics::tcp_300ms_and_1000_connection_pairs ... transport_diagnostic kind=tcp_tls simulated_rtt_ms=300 handshake_n=25 admitted_p50_us=758818 admitted_p99_us=762982 connection_pairs=1000 baseline_rss_kib=13720 retained_rss_kib=83120 combined_client_server_delta_kib_per_pair=69.4 combined_delta_kib_at1000=69400 connect_cpu_ticks=284 machine=infraternal-dev load=14.02 15.90 12.82 15/1091 840344 test ca::tests::signing_boundary_at_1000_public_identities ... signing_boundary n=1000 p50_us=353 p99_us=883 cpu_ticks=39 retained_der_bytes=398000 baseline_rss_kib=12888 retained_rss_kib=16660 rss_delta_per_identity_kib=3.776 scale=1000 load=16.29 16.29 13.03 17/1083 843381 ```

kayg commented

2026-10-07 16:39:05 +00:00

Author

Owner

transport-diagnostics: Measure handshake latency and retained transport memory at scale (#78). HEAD 44de6437a4. Add explicitly ignored real TLS and QUIC diagnostics through a rootless userspace 300 ms RTT proxy. Record 25 admitted handshakes and retain 1000 client/server pairs with RSS and CPU deltas, machine and load. Reject treating loopback pair memory or signer-only cost as whole infraternal-agent acceptance or live renewal proof. Decisions 64, 133, 137 and 167. Fresh results are posted separately on the issue.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.29 16.29 13.03 18/1102 843562. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-transport-diagnostics-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.93s]

transport-diagnostics: Measure handshake latency and retained transport memory at scale (#78). HEAD 44de6437a4207c1dd686497574f4fa0e5bc60043. Add explicitly ignored real TLS and QUIC diagnostics through a rootless userspace 300 ms RTT proxy. Record 25 admitted handshakes and retain 1000 client/server pairs with RSS and CPU deltas, machine and load. Reject treating loopback pair memory or signer-only cost as whole infraternal-agent acceptance or live renewal proof. Decisions 64, 133, 137 and 167. Fresh results are posted separately on the issue. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.29 16.29 13.03 18/1102 843562. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-transport-diagnostics-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.93s] ```

kayg commented

2026-10-07 16:50:12 +00:00

Author

Owner

remote-fuzz-targets: Fuzz remote enrollment and native writer binding parsers (#78). HEAD c77e7a386d. Register bounded PKCS10 CSR and capability-gated native QUIC binding parsers in the existing libFuzzer package. Assert accepted host keys are Ed25519 and accepted writer ids are nonzero even values; reject appended trailing bytes. Reuse the production parsers rather than a mirrored implementation. Decisions 12, 64 and 133. Fuzz smoke execution and corpus evidence are recorded separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 13.75 17.52 15.77 11/1092 1029228. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-remote-fuzz-targets-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.88s]

remote-fuzz-targets: Fuzz remote enrollment and native writer binding parsers (#78). HEAD c77e7a386d5dd566a23697adcb6f4e9b985c51ce. Register bounded PKCS10 CSR and capability-gated native QUIC binding parsers in the existing libFuzzer package. Assert accepted host keys are Ed25519 and accepted writer ids are nonzero even values; reject appended trailing bytes. Reuse the production parsers rather than a mirrored implementation. Decisions 12, 64 and 133. Fuzz smoke execution and corpus evidence are recorded separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 13.75 17.52 15.77 11/1092 1029228. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run4-remote-fuzz-targets-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.88s] ```

kayg commented

2026-10-07 16:51:29 +00:00

Author

Owner

Run 4 routing reuse finding at c77e7a3: the existing terminal_writers table (migrations/0008_terminal_writers.sql) already persists writer_id and per-writer input Ack for (connection_id, client_stream). websocket.rs owned_writer (1190-1237) serializes allocation, rechecks browser/session ownership and returns 2 * writer_id, a durable nonzero even id. recover_connections (1354) preserves rows through server restart resume grace. writer_tests.rs second_device_does_not_inherit_first_device_input_ack and writer_ownership_capacity_unsigned_offsets_and_identity_reuse pass in the exact gate. Remote routing must reuse this result for transport.bind, not add another writer allocator or derive identity from native QUIC streams. No code changed for this finding.

Run 4 routing reuse finding at c77e7a3: the existing terminal_writers table (migrations/0008_terminal_writers.sql) already persists writer_id and per-writer input Ack for (connection_id, client_stream). websocket.rs owned_writer (1190-1237) serializes allocation, rechecks browser/session ownership and returns 2 * writer_id, a durable nonzero even id. recover_connections (1354) preserves rows through server restart resume grace. writer_tests.rs second_device_does_not_inherit_first_device_input_ack and writer_ownership_capacity_unsigned_offsets_and_identity_reuse pass in the exact gate. Remote routing must reuse this result for transport.bind, not add another writer allocator or derive identity from native QUIC streams. No code changed for this finding.

kayg commented

2026-10-07 17:11:26 +00:00

Author

Owner

Fresh run-4 ASan parser fuzzing at c77e7a3, both exit 0 with no findings. Corpus inputs are public signed CSR/binding frames, no private keys. Fuzz-only CARGO_PROFILE_RELEASE_LTO=false avoids LLVM sanitizer coverage counter link errors; production release settings remain unchanged. Reused the exact hash-identified zigimg package from the job normal build cache after its network fetch timed out. Targets remain in job-owned home cache, not /tmp. Verbatim final records:

csr: Done 12276215 runs in 61 second(s); initial load 1.43 4.51 9.59 10/1103 1130878; log evidence/remote-agents/run4-csr-fuzz.log
binding: Done 14303447 runs in 61 second(s); initial load 14.74 13.40 12.12 5/1127 1214882; log evidence/remote-agents/run4-binding-fuzz.log

Fresh run-4 ASan parser fuzzing at c77e7a3, both exit 0 with no findings. Corpus inputs are public signed CSR/binding frames, no private keys. Fuzz-only CARGO_PROFILE_RELEASE_LTO=false avoids LLVM sanitizer coverage counter link errors; production release settings remain unchanged. Reused the exact hash-identified zigimg package from the job normal build cache after its network fetch timed out. Targets remain in job-owned home cache, not /tmp. Verbatim final records: ``` csr: Done 12276215 runs in 61 second(s); initial load 1.43 4.51 9.59 10/1103 1130878; log evidence/remote-agents/run4-csr-fuzz.log binding: Done 14303447 runs in 61 second(s); initial load 14.74 13.40 12.12 5/1127 1214882; log evidence/remote-agents/run4-binding-fuzz.log ```

kayg commented

2026-10-07 17:14:46 +00:00

Author

Owner

Run 5 started, sole writer on remote-agents; base fca6e093d8, resumed head c77e7a386d. Read all 57 comments and parent #5; read contracts and D168/D170 from main. Preserving uncommitted lease/report. Finding: docs/verification/remote-agents.md still records missing enrollment endpoint/operator join, transport runtime routing, remote uid/session integration, live renewal and lifecycle, in addition to real-host acceptance. Continuing those prerequisites; no remote installation, push or deployment yet.

Run 5 started, sole writer on remote-agents; base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed head c77e7a386d5dd566a23697adcb6f4e9b985c51ce. Read all 57 comments and parent #5; read contracts and D168/D170 from main. Preserving uncommitted lease/report. Finding: docs/verification/remote-agents.md still records missing enrollment endpoint/operator join, transport runtime routing, remote uid/session integration, live renewal and lifecycle, in addition to real-host acceptance. Continuing those prerequisites; no remote installation, push or deployment yet.

kayg commented

2026-10-07 17:24:03 +00:00

Author

Owner

Run 5 admission evidence: shared daemon dispatch tested over real loopback mTLS, 4/4 pass in 5.06s (wrong enrolled uid before state creation; wrong terminal.open uid rejected without shim while Ping remains usable; mandatory control Hello/version and even writer ids; silent authenticated peer expires at 5s). Log evidence/remote-agents/run5-daemon-admission.log. First fast run found a test-only cloned_ref_to_slice_refs lint (corrected); load peaked 48.82/21.56/14.34 on 8 cores. No thresholds changed. Code and tests will be committed separately after isolated green gates. These tests do not establish remote rootless sessions or chaos acceptance.

kayg commented

2026-10-07 17:31:23 +00:00

Author

Owner

daemon-channel: Dispatch admitted remote channels through the existing session daemon (#78). HEAD 1e2f1b0e2a. Remote mTLS channels previously stopped at transport helpers. Reuse the inherited dispatcher and shim relay through Channel, require one bounded control greeting and even remote stream identities, and bind terminal.open to the locally enrolled execution uid. Cancellation retires the remote channel and attachment tasks while shims survive. Reject a second dispatcher or browser-selected uid. Decisions 9, 13, 64 and 128; real mTLS admission evidence is on #78 and tests follow separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.74 12.42 13.33 2/713 1353720. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-daemon-channel-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.33s]

daemon-channel: Dispatch admitted remote channels through the existing session daemon (#78). HEAD 1e2f1b0e2acb4129c2ae42030a2745ac95f54623. Remote mTLS channels previously stopped at transport helpers. Reuse the inherited dispatcher and shim relay through Channel, require one bounded control greeting and even remote stream identities, and bind terminal.open to the locally enrolled execution uid. Cancellation retires the remote channel and attachment tasks while shims survive. Reject a second dispatcher or browser-selected uid. Decisions 9, 13, 64 and 128; real mTLS admission evidence is on #78 and tests follow separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.74 12.42 13.33 2/713 1353720. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-daemon-channel-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.33s] ```

kayg commented

2026-10-07 17:34:22 +00:00

Author

Owner

Runtime integration finding: remote_tls.rs server_config requires PEER|FAIL_IF_NO_PEER_CERT and finish requires a verified leaf; remote_quic.rs uses WebPkiClientVerifier. These are correct live-session adapters but cannot enroll an as-yet uncertified host, or deliver D134 restricted removal after its leaf expires. The enrollment endpoint needs bounded server-authenticated admission before token/CSR delivery, with terminal admission still requiring mTLS plus durable authority. Restricted expired-certificate removal must verify possession and tombstone identity without granting sessions. No verification bypass or expired-certificate terminal admission has been added.

kayg commented

2026-10-07 17:39:15 +00:00

Author

Owner

daemon-admission-tests: Prove remote daemon admission and cancellation over real mTLS (#78). HEAD 70b9314e17. Five real TCP/TLS tests cover enrolled uid before filesystem effects, open uid rejection without launch while control stays usable, mandatory greeting and even writer ids, a silent peer deadline, and cancellation retirement in both directions. Reject fixture-only transport trust or treating these local admission tests as rootless-host acceptance. Decisions 9, 64 and 128.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 2.08 5.91 10.28 10/741 1363286. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-daemon-admission-tests-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.34s]

daemon-admission-tests: Prove remote daemon admission and cancellation over real mTLS (#78). HEAD 70b9314e17aa2df49a1ceee99e3f1818eb8e5e56. Five real TCP/TLS tests cover enrolled uid before filesystem effects, open uid rejection without launch while control stays usable, mandatory greeting and even writer ids, a silent peer deadline, and cancellation retirement in both directions. Reject fixture-only transport trust or treating these local admission tests as rootless-host acceptance. Decisions 9, 64 and 128. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 2.08 5.91 10.28 10/741 1363286. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-daemon-admission-tests-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.34s] ```

kayg commented

2026-10-07 17:47:09 +00:00

Author

Owner

native-framing: Carry raw QUIC frames through the shared borrowed codec (#78). HEAD 9e762a60c5. Native terminal streams previously had authenticated bindings but no Channel adapter. Add one externally bound raw framing mode to Receive/Transmit and a cancellation-safe native QUIC channel, preserving borrowed payloads and rejecting cross-writer sends, mismatched halves and wrong initiators. Give control output priority over bulk; idle reads remain timer-free. Reject a mux wrapper on native streams, a copied payload codec or native stream ids as writer authority. Decisions 11, 64 and 130; real native framing tests follow separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.10 6.47 9.41 2/841 1398009. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-framing-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.71s]

native-framing: Carry raw QUIC frames through the shared borrowed codec (#78). HEAD 9e762a60c53d5178370125e27449842478a382b2. Native terminal streams previously had authenticated bindings but no Channel adapter. Add one externally bound raw framing mode to Receive/Transmit and a cancellation-safe native QUIC channel, preserving borrowed payloads and rejecting cross-writer sends, mismatched halves and wrong initiators. Give control output priority over bulk; idle reads remain timer-free. Reject a mux wrapper on native streams, a copied payload codec or native stream ids as writer authority. Decisions 11, 64 and 130; real native framing tests follow separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.10 6.47 9.41 2/841 1398009. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-framing-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.71s] ```

kayg commented

2026-10-07 17:55:52 +00:00

Author

Owner

native-frame-tests: Prove native wire framing and channel retirement against real QUIC (#78). HEAD b3bb3a4ab6. Real quinn tests verify unchanged raw bytes without a mux envelope, durable writer metadata on coalesced frames, cross-writer send refusal, stream-role enforcement and both-direction retirement after partial-write cancellation. Reject assumptions about transport read boundaries or native stream ids. Decisions 64 and 130; all three targeted tests pass in 0.12 seconds after correcting a fixture that reused a clearing encoder buffer.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.75 14.90 12.26 14/729 1493006. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-frame-tests-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.17s]

native-frame-tests: Prove native wire framing and channel retirement against real QUIC (#78). HEAD b3bb3a4ab604a7b1291e9c3e072c9c6c3daf4e5a. Real quinn tests verify unchanged raw bytes without a mux envelope, durable writer metadata on coalesced frames, cross-writer send refusal, stream-role enforcement and both-direction retirement after partial-write cancellation. Reject assumptions about transport read boundaries or native stream ids. Decisions 64 and 130; all three targeted tests pass in 0.12 seconds after correcting a fixture that reused a clearing encoder buffer. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.75 14.90 12.26 14/729 1493006. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-frame-tests-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.17s] ```

kayg commented

2026-10-07 18:08:17 +00:00

Author

Owner

Run 5 real-engine diagnostic on uncommitted native relay: a real rootless CLI shim and quinn/mTLS survived 25 transport connection replacements with stable writer 42. Zero-RTT-network reconnect-to-shim-Ack p50/p99 6.361/8.186 ms; 569 received PTY bytes match the independent retained shim-ring prefix exactly; all 26 raw cat markers occur once despite resending each already-written payload. uid1001, infraternal-dev, 8 cores; load1.79/2.23/5.43, test0.22s. Log evidence/remote-agents/run5-native-pty-targeted.log. Fixture now uses isolated ZDOTDIR, waits for the shell prompt and reuses the established raw cat canary (zsh software echo is not duplicate input). No o1/o2, browser routing, renewal or idle-daemon acceptance claimed. Native relay code gate is running; fixture commits separately.

kayg commented

2026-10-07 18:15:44 +00:00

Author

Owner

native-terminal: Relay bound native terminal streams through surviving shims (#78). HEAD c07d8f8636. Native QUIC streams now enter the existing terminal relay after one bounded AttachTerm, reuse stable writer cursors and ordered Snapshot notices, and reject Call or invalid post-attachment traffic. Bound command admission independently per stream; cancellation retires the stream while the shim survives. Native control Hello negotiates writer binding and cannot be confused with a terminal channel. Reject a second terminal implementation or deriving shim identity from native stream ids. Decisions 13, 64 and 130; the real-PTY replacement test is gated separately.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.90 2.01 4.92 1/828 1529224. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-terminal-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [4.13s]

native-terminal: Relay bound native terminal streams through surviving shims (#78). HEAD c07d8f86366398a92490141eb842c3b20cd14c19. Native QUIC streams now enter the existing terminal relay after one bounded AttachTerm, reuse stable writer cursors and ordered Snapshot notices, and reject Call or invalid post-attachment traffic. Bound command admission independently per stream; cancellation retires the stream while the shim survives. Native control Hello negotiates writer binding and cannot be confused with a terminal channel. Reject a second terminal implementation or deriving shim identity from native stream ids. Decisions 13, 64 and 130; the real-PTY replacement test is gated separately. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.90 2.01 4.92 1/828 1529224. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-terminal-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.13s] ```

kayg referenced this issue

2026-10-07 18:16:08 +00:00

Status board: work in flight (kept current) #24

kayg commented

2026-10-07 18:31:35 +00:00

Author

Owner

native-pty-oracle: Compare native reconnect replay with the real shim ring (#78). HEAD 1ce3ed3b57. Add an explicit real-CLI oracle: rootless PTY, 25 quinn/mTLS connection replacements, stable writer 42, deliberately replayed written input and an independently read surviving shim ring. Use the existing raw cat canary and isolated prompt so shell line rendering cannot masquerade as duplicate input. Record local reconnect p50/p99, exact prefix bytes and unique payload markers; clean the owned shim and scratch state. Reject a copied terminal model or calling this local test real-host acceptance. Decisions 13, 64 and 137; run the ignored oracle with INFRATERNAL_TEST_BINARY after building the CLI.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 13.11 8.19 6.28 12/1018 1614612. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-pty-oracle-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.38s]

native-pty-oracle: Compare native reconnect replay with the real shim ring (#78). HEAD 1ce3ed3b5789c559728bc71ca3ae92f61f39ae51. Add an explicit real-CLI oracle: rootless PTY, 25 quinn/mTLS connection replacements, stable writer 42, deliberately replayed written input and an independently read surviving shim ring. Use the existing raw cat canary and isolated prompt so shell line rendering cannot masquerade as duplicate input. Record local reconnect p50/p99, exact prefix bytes and unique payload markers; clean the owned shim and scratch state. Reject a copied terminal model or calling this local test real-host acceptance. Decisions 13, 64 and 137; run the ignored oracle with INFRATERNAL_TEST_BINARY after building the CLI. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 13.11 8.19 6.28 12/1018 1614612. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-native-pty-oracle-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.38s] ```

kayg commented

2026-10-07 18:50:08 +00:00

Author

Owner

Merge finding: current dev adds 0010_recovery_audit.sql and 0011_recovery_derivation.sql, colliding with this unpublished branch migration 0010_remote_identity.sql. SQLx keys migration history by numeric version. Preserve deployed dev migrations/checksums; move the unpublished remote identity migration to 0012 while resolving this merge, then verify fresh databases and a dev-v11 upgrade. No deployed remote database exists. The scoped merge gate is running to record the regression before correction.

kayg commented

2026-10-07 18:59:49 +00:00

Author

Owner

Browser run5 on merged production assets, TRACER_TEST_PORT=4701 in CPUWeight10000 scope: unchanged motion-audit.spec.ts failed frame budgets while host load reached 21.80/13.00/8.06 on 8 cores. Full suite continues; retain run5-browser.log. Test SHA-256 equals dev ac03b19 (7e89a8e92d594eaaf7d5d682e77e1c293a05648fb83e50a41b2bd5cb86957551). Will rerun isolated branch and archived ac03b19 in the same scope; no thresholds changed. Contract evidence scale will be updated additively from the older D124 figure to owner D170: 1000 nodes, 200 terminals, 50 users, 10000-node headroom; pair RSS remains transport endpoints only, not whole-agent acceptance.

Browser run5 on merged production assets, TRACER_TEST_PORT=4701 in CPUWeight10000 scope: unchanged motion-audit.spec.ts failed frame budgets while host load reached 21.80/13.00/8.06 on 8 cores. Full suite continues; retain run5-browser.log. Test SHA-256 equals dev ac03b19 (7e89a8e92d594eaaf7d5d682e77e1c293a05648fb83e50a41b2bd5cb86957551). Will rerun isolated branch and archived ac03b19 in the same scope; no thresholds changed. Contract evidence scale will be updated additively from the older D124 figure to owner D170: 1000 nodes, 200 terminals, 50 users, 10000-node headroom; pair RSS remains transport endpoints only, not whole-agent acceptance.

kayg referenced this issue

2026-10-07 19:02:04 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-07 19:04:19 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-07 19:04:36 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 19:05:03 +00:00

Author

Owner

merge-dev: Merge dev and preserve deployed migration history (#78). HEAD 234686b02b. Bring current dev into the isolated remote-agents branch before verification. The merge reproduced SQLx UNIQUE constraint failed: _sqlx_migrations.version: both lanes used 0010. Preserve deployed recovery versions 0010/0011 and their checksums; move the unpublished remote identity migration unchanged to 0012 instead of rewriting deployed history. The real enrollment admission test failed before this correction. Reuse deterministic fixture fixes without weakening thresholds. Decisions 19, 137 and 167. No deployment or merge back to dev.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 19.27 11.51 7.41 17/884 1717836. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-merge-dev-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [3.30s]

merge-dev: Merge dev and preserve deployed migration history (#78). HEAD 234686b02bfb38a660d52ef39d465b5e8a670afc. Bring current dev into the isolated remote-agents branch before verification. The merge reproduced SQLx UNIQUE constraint failed: _sqlx_migrations.version: both lanes used 0010. Preserve deployed recovery versions 0010/0011 and their checksums; move the unpublished remote identity migration unchanged to 0012 instead of rewriting deployed history. The real enrollment admission test failed before this correction. Reuse deterministic fixture fixes without weakening thresholds. Decisions 19, 137 and 167. No deployment or merge back to dev. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 19.27 11.51 7.41 17/884 1717836. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-merge-dev-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.30s] ```

kayg commented

2026-10-07 19:07:39 +00:00

Author

Owner

Merged dev 19fe05af71 at 234686b02b after the exact scoped fast gate passed; unpublished remote migration is now 0012, deployed recovery 0010/0011 unchanged. New real v11 upgrade/idempotence oracle passes (1/1, 0.04s), separate test commit is gating. Browser full suite: 42 passed, 21 skipped, 5 failed (10.8m), run5-browser.log. Archived dev ac03b19 isolated motion + terminal suite in the same CPUWeight10000 scope/port4701 also fails motion, returning sign-in and first-paint budgets: 3 failed, 1 passed (4.1m), run5-browser-dev-ac03b19.log; load near its start 9.57/7.84/7.29. Branch frontend/proxy files are byte-identical to merged dev 19fe05a. No threshold changes or frontend fix claims; isolated branch repeat is running.

Merged dev 19fe05af71a24658605c05a5ce7ac81c8db3cf6b at 234686b02bfb38a660d52ef39d465b5e8a670afc after the exact scoped fast gate passed; unpublished remote migration is now 0012, deployed recovery 0010/0011 unchanged. New real v11 upgrade/idempotence oracle passes (1/1, 0.04s), separate test commit is gating. Browser full suite: 42 passed, 21 skipped, 5 failed (10.8m), run5-browser.log. Archived dev ac03b19 isolated motion + terminal suite in the same CPUWeight10000 scope/port4701 also fails motion, returning sign-in and first-paint budgets: 3 failed, 1 passed (4.1m), run5-browser-dev-ac03b19.log; load near its start 9.57/7.84/7.29. Branch frontend/proxy files are byte-identical to merged dev 19fe05a. No threshold changes or frontend fix claims; isolated branch repeat is running.

kayg referenced this issue

2026-10-07 19:09:24 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 19:15:41 +00:00

Author

Owner

migration-upgrade-test: Prove remote identity upgrades the deployed v11 schema (#78). HEAD 5fe5747f58. Add a real SQLite upgrade oracle preserving recovery audit rows, rejecting duplicate migration versions and applying remote identity idempotently. The merge admission regression failed before renumbering unpublished remote schema to 0012; this test exercises the deployed v11 upgrade rather than relying only on a fresh database. Reject changing deployed checksums or treating a green new-database fixture as upgrade proof. Decision 19.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.81 11.62 8.77 14/1048 1761242. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-migration-upgrade-test-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.47s]

migration-upgrade-test: Prove remote identity upgrades the deployed v11 schema (#78). HEAD 5fe5747f58d8d2c8c933647eb163dc66a7215237. Add a real SQLite upgrade oracle preserving recovery audit rows, rejecting duplicate migration versions and applying remote identity idempotently. The merge admission regression failed before renumbering unpublished remote schema to 0012; this test exercises the deployed v11 upgrade rather than relying only on a fresh database. Reject changing deployed checksums or treating a green new-database fixture as upgrade proof. Decision 19. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 16.81 11.62 8.77 14/1048 1761242. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-migration-upgrade-test-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.47s] ```

kayg commented

2026-10-07 19:15:52 +00:00

Author

Owner

Readiness finding: bounded borrowed-channel fixture stalls its writer after Hello, supplies 32 control Pings, and reproduces the inherited shared reply queue deadlock. Runtime RED: saturated_replies_retire_connection_without_awaiting_writer_capacity fails its two-second dispatcher deadline; run5-readiness-red.log. Fix will use a separate eight-slot control reply lane, priority at frame boundaries and synchronous bounded admission; preserve bulk Snapshot/Event/Ack order and shim lifetime. No polling/idle timer. D130.

kayg commented

2026-10-07 19:23:16 +00:00

Author

Owner

The first readiness fix failed the real-binary saturation gate: twelve legitimate stream-close replies filled eight slots in one dispatcher poll, before a ready writer could drain them (agent_queues.rs, daemon exit control reply queue full; run5-control-readiness-burst-red-fast.log). This is my logic regression, not an unrelated timing failure. Preserve the existing eight-slot limit and every oracle assertion; yield once when the reply batch fills, without waiting for capacity, then refuse only if the writer remains stalled. The earlier synthetic deadlock RED remains retained; recheck both oracles before a commit.

kayg commented

2026-10-07 19:35:31 +00:00

Author

Owner

Run5 D167 diagnostics, serial after this job builds/browser stopped, CPUWeight10000, infraternal-dev i9-9900K/8 cores/Linux6.12.111: QUIC admitted handshake RTT300ms n25 p50/p99 460080/464893 us; 1000 retained client+server pairs RSS delta67348 KiB,67.348 KiB/pair,588 CPU ticks,load3.49/11.22/13.19. TCP TLS n25 758889/763350 us;1000 pairs69400 KiB,69.4 KiB/pair,266 ticks,load7.32/8.21/11.56. TCP first hit EMFILE at inherited NOFILE1024; retained run5-tcp-nofile-red.log, successful repeat process-local NOFILE4096. Signer n1000 p50/p99 347/654 us,39 ticks,398000 DER bytes,RSS3184 KiB,3.184 KiB/identity. Additional populated control reply queues n1000:2892 KiB,2961 B/lane,6778 us create+first enqueue,Message72 B. Real local rootless PTY repeat n25 reconnects p50/p99 9379/14503 us,569 bytes exact,26 markers once,uid1001,load8.01/8.34/11.58. Logs run5-{quic,tcp,signing,reply-lane}-diagnostic.log and run5-native-pty-repeat.log. Pair/queue RSS is not whole-agent memory; signing is not live renewal CPU/RSS/wire bytes. No o1/o2 acceptance or zero-idle-wakeup claim. The corrected readiness fix and separate tests are now gating.

kayg commented

2026-10-07 19:44:18 +00:00

Author

Owner

control-readiness: Keep control dispatch ready behind a stalled terminal writer (#78). HEAD cade5adf1d. The runtime RED fixture proved shared replies could await a full output queue indefinitely. Give replies a separate eight-slot priority lane and refuse overload without waiting for capacity. A full-batch scheduling yield lets a ready writer drain legitimate bursts: the real twelve-terminal queue oracle first failed, then passed with unchanged limits and assertions. Preserve bulk notice/Snapshot/Ack order and the native terminal lane. Measured added populated control-queue RSS is 2892 KiB across 1000 lanes (2961 bytes per lane); this excludes complete daemon/transport memory. Reject a larger queue, waiting for capacity or healthy idle polling. Decisions 13, 130 and 167.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.98 8.43 11.15 1/897 2003071. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-control-readiness-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.33s]

control-readiness: Keep control dispatch ready behind a stalled terminal writer (#78). HEAD cade5adf1d9e479686155814482ae65d190bbb09. The runtime RED fixture proved shared replies could await a full output queue indefinitely. Give replies a separate eight-slot priority lane and refuse overload without waiting for capacity. A full-batch scheduling yield lets a ready writer drain legitimate bursts: the real twelve-terminal queue oracle first failed, then passed with unchanged limits and assertions. Preserve bulk notice/Snapshot/Ack order and the native terminal lane. Measured added populated control-queue RSS is 2892 KiB across 1000 lanes (2961 bytes per lane); this excludes complete daemon/transport memory. Reject a larger queue, waiting for capacity or healthy idle polling. Decisions 13, 130 and 167. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 4.98 8.43 11.15 1/897 2003071. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-control-readiness-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.33s] ```

kayg commented

2026-10-07 19:52:01 +00:00

Author

Owner

control-readiness-test: Retain control readiness and Snapshot ordering oracles (#78). HEAD 417e1972a4. Retain the runtime RED-to-GREEN stalled-writer admission oracle, control-before-bulk test preserving notice before Snapshot, and an ignored 1000-lane allocation diagnostic separately from the production fix. The existing real-binary twelve-terminal saturation oracle still compares all 2640000 echoed bytes and survives overloaded attachments. Reject relaxing its assertions or presenting queue-only RSS as whole-daemon memory. Decisions 13, 130 and 167.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 9.15 11.65 11.37 3/692 2063568. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-control-readiness-test-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.97s]

control-readiness-test: Retain control readiness and Snapshot ordering oracles (#78). HEAD 417e1972a4f31a8cb92beee713c1c5e4af8e667e. Retain the runtime RED-to-GREEN stalled-writer admission oracle, control-before-bulk test preserving notice before Snapshot, and an ignored 1000-lane allocation diagnostic separately from the production fix. The existing real-binary twelve-terminal saturation oracle still compares all 2640000 echoed bytes and survives overloaded attachments. Reject relaxing its assertions or presenting queue-only RSS as whole-daemon memory. Decisions 13, 130 and 167. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 9.15 11.65 11.37 3/692 2063568. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-control-readiness-test-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.97s] ```

kayg commented

2026-10-07 20:14:20 +00:00

Author

Owner

evidence-checkpoint: Record phase-one boundaries and unresolved acceptance (#78). HEAD 4fdf2d4931. Record the actual tested runtime boundaries, migration integration, atomic source SHAs, raw public D167 measurements and red browser comparisons. Move only the five cited measurement logs into docs/verification/remote-agents with explanatory headers preserving their output; leave other job artifacts uncommitted. Align the proposed evidence scale with owner D170 (1000 nodes, 200 terminals, 50 users, 10000-node headroom), proposed on the issue before this edit. Reject calling local transport pairs whole-agent memory or signer work live renewal: operator enrollment, routing/supervision, renewal/removal/lease and real o1/o2 chaos acceptance remain incomplete. Decisions 137, 167, 168 and 170.
Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.95 2.58 5.58 2/787 2162714. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-evidence-checkpoint-fast.log. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.85s]

evidence-checkpoint: Record phase-one boundaries and unresolved acceptance (#78). HEAD 4fdf2d49317a136c24d17b28366892f27e7ec7c7. Record the actual tested runtime boundaries, migration integration, atomic source SHAs, raw public D167 measurements and red browser comparisons. Move only the five cited measurement logs into docs/verification/remote-agents with explanatory headers preserving their output; leave other job artifacts uncommitted. Align the proposed evidence scale with owner D170 (1000 nodes, 200 terminals, 50 users, 10000-node headroom), proposed on the issue before this edit. Reject calling local transport pairs whole-agent memory or signer work live renewal: operator enrollment, routing/supervision, renewal/removal/lease and real o1/o2 chaos acceptance remain incomplete. Decisions 137, 167, 168 and 170. Gate: systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast; exit 0. Load at start 1.95 2.58 5.58 2/787 2162714. Log /home/kayg/Developer/infraternal/.worktrees/remote-agents/evidence/remote-agents/run5-evidence-checkpoint-fast.log. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.85s] ```

kayg referenced this issue

2026-10-07 20:19:11 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 20:30:53 +00:00

Author

Owner

Run5 checkpoint, phase 1 INCOMPLETE. Branch remote-agents; HEAD 4fdf2d4931. Atomic gated source steps and public proof are in docs/verification/remote-agents.md; five cited raw D167 logs are committed under docs/verification/remote-agents/. Source/runtime head417e197, documentation head4fdf2d49317a136c24d17b28366892f27e7ec7c7. No push/deploy/merge back, no o1/o2 modification. Prepared: admitted common daemon, raw native channels, real mTLS/QUIC and real PTY replay, readiness fix preserving twelve-terminal saturation (2640000 exact bytes), dev19fe05a merge and v11 upgrade; remote migration0012 preserves deployed0010/0011. D167: RTT300 QUIC n25 p50/p99 460080/464893us and1000 retained pairs67348KiB (67.348KiB/pair); TCP758889/763350us and69400KiB (69.4KiB/pair), process-local NOFILE4096. Signer1000 identities347/654us,39ticks,398000DER bytes,3184KiB. Added1000 populated reply queues2892KiB; local25 PTY reconnects9379/14503us,569exact bytes,26markers once. These exclude whole-agent RSS/idle wakeups and live renewal CPU/RSS/wire bytes. Browser port4701:42passed,21skipped,5failed10.8m; isolated motion/terminal3failed/1passed on both branch3.4m and archived devac03b19 4.1m in required scope; thresholds unchanged. Missing: encrypted/admin-role CA adapters/rotation, operator join+bootstrap endpoint+host identity persistence, dial-out/reconnect/lease supervisor, server host/session routing using enrolleduid and existing owned_writer ids, live half-life renewal, active revocation/restricted removal/uninstall, all rootless o1/o2 chaos/cleanup. CA D168 policy is settled; no owner primitive/unlock wait. Existing unregistered remote_lease.rs remains WIP, not enforcement. Scratch/build caches retained because work is incomplete. Before exposing join publicly, review remote_enrollment.rs:42-57: it currently parses/signs before checking the invitation in redeem; bounded preflight/ingress admission must precede private-key work, with atomic redemption still rechecking authority. Latest exact gate exit0, load at start 1.95 2.58 5.58 2/787 2162714, command systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast. Verbatim output:

| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.85s]

Run5 checkpoint, phase 1 INCOMPLETE. Branch remote-agents; HEAD 4fdf2d49317a136c24d17b28366892f27e7ec7c7. Atomic gated source steps and public proof are in docs/verification/remote-agents.md; five cited raw D167 logs are committed under docs/verification/remote-agents/. Source/runtime head417e197, documentation head4fdf2d49317a136c24d17b28366892f27e7ec7c7. No push/deploy/merge back, no o1/o2 modification. Prepared: admitted common daemon, raw native channels, real mTLS/QUIC and real PTY replay, readiness fix preserving twelve-terminal saturation (2640000 exact bytes), dev19fe05a merge and v11 upgrade; remote migration0012 preserves deployed0010/0011. D167: RTT300 QUIC n25 p50/p99 460080/464893us and1000 retained pairs67348KiB (67.348KiB/pair); TCP758889/763350us and69400KiB (69.4KiB/pair), process-local NOFILE4096. Signer1000 identities347/654us,39ticks,398000DER bytes,3184KiB. Added1000 populated reply queues2892KiB; local25 PTY reconnects9379/14503us,569exact bytes,26markers once. These exclude whole-agent RSS/idle wakeups and live renewal CPU/RSS/wire bytes. Browser port4701:42passed,21skipped,5failed10.8m; isolated motion/terminal3failed/1passed on both branch3.4m and archived devac03b19 4.1m in required scope; thresholds unchanged. Missing: encrypted/admin-role CA adapters/rotation, operator join+bootstrap endpoint+host identity persistence, dial-out/reconnect/lease supervisor, server host/session routing using enrolleduid and existing owned_writer ids, live half-life renewal, active revocation/restricted removal/uninstall, all rootless o1/o2 chaos/cleanup. CA D168 policy is settled; no owner primitive/unlock wait. Existing unregistered remote_lease.rs remains WIP, not enforcement. Scratch/build caches retained because work is incomplete. Before exposing join publicly, review remote_enrollment.rs:42-57: it currently parses/signs before checking the invitation in redeem; bounded preflight/ingress admission must precede private-key work, with atomic redemption still rechecking authority. Latest exact gate exit0, load at start 1.95 2.58 5.58 2/787 2162714, command systemd-run --user --scope -p CPUWeight=10000 env RUST_TEST_THREADS=4 nix shell nixpkgs#binutils nixpkgs#file nixpkgs#gnumake nixpkgs#perl nixpkgs#zig_0_15 -c scripts/verify fast. Verbatim output: ``` | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.85s] ```

kayg referenced this issue

2026-10-07 20:32:12 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 20:33:23 +00:00

Author

Owner

Run6 started, sole writer remote-agents; original base fca6e093d8, resumed HEAD 4fdf2d4931. Read all 79 comments and parent #5, repo/process/contracts. Demo order: running enrollment and remote routing first, separate-process proof; then o1 rootless join/terminal/cleanup; then lifecycle. Preserve untracked lease WIP; no push/deploy/merge back. Confirmed join signs before checking invitation (remote_enrollment.rs); regression and preflight first.

Run6 started, sole writer remote-agents; original base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed HEAD 4fdf2d49317a136c24d17b28366892f27e7ec7c7. Read all 79 comments and parent #5, repo/process/contracts. Demo order: running enrollment and remote routing first, separate-process proof; then o1 rootless join/terminal/cleanup; then lifecycle. Preserve untracked lease WIP; no push/deploy/merge back. Confirmed join signs before checking invitation (remote_enrollment.rs); regression and preflight first.

kayg commented

2026-10-07 20:35:38 +00:00

Author

Owner

Run6 regression reproduced: invalid_invitations_never_load_the_private_signer loads CA 7 times for malformed/unknown token, wrong host/mode, future/expired token and tombstone (expected 0), run6-preflight-red.log. Proposed stable additive API before adapters: POST /remote/invitations with authenticated live browser cookie + exact Origin, host_id/mode/execution_uid; POST /remote/join body host_id/mode/token/csr_der (base64url DER), success certificate_der plus enrolled uid. Operator reads invitation and public trust through stdin, HTTPS pinned before capability transmission. Both routes have body/deadline/concurrency bounds; preflight precedes CSR/signing and atomic redemption still rechecks. D168 signer remains injected via CaKeySource, cold-lock policy cannot be bypassed by operator join. Remote session host mapping will reuse existing terminal_sessions ownership and terminal_writers ids.

kayg commented

2026-10-07 20:45:22 +00:00

Author

Owner

Run6 preflight fix complete d8f74bbfde: invalid invitations now do zero private-key loads (RED 7 -> GREEN 0 across seven invalid cases); atomic redemption unchanged. Exact CPUWeight10000 RUST_TEST_THREADS=4 Nix fast exit0; log evidence/remote-agents/run6-preflight-fast.log. x86_64 static15970128B, aarch64 13435808B. Sampled shared 8core load5.14/2.74/3.20 during native tests,1.97/2.46/2.98 at static builds. Verbatim gate:

| Rust gate                 | Result       |
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 0 fail
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [3.82s]

kayg commented

2026-10-07 20:51:13 +00:00

Author

Owner

Run6 enrollment API contract complete d406cb19e0: contracts/remote.md documents stable POST /remote/invitations and /remote/join bodies/responses, bounded ingress, private stdin trust/capability handoff and independent D168 lock. #87 can target this shape. Exact requested scoped fast exit0, evidence/remote-agents/run6-api-contract-fast.log. No endpoint is registered by this contract commit. Verbatim:

| Rust gate                 | Result       |
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 0 fail
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.90s]

kayg commented

2026-10-07 20:58:41 +00:00

Author

Owner

Run6 HTTP finding and evidence: real SQLite trigger revokes the browser session between host creation and invitation publication. RED returned HTTP200 instead of403 (run6-http-authority-red.log); issue_for_session now rechecks exact live unlocked cookie/user/owner authority in the issuance write. Both HTTP tests GREEN2/2 in0.04s (run6-http-green.log), using real signed CSR and SQLite; cover uid collision, missing cookie, wrong Origin, cold lock preserving token, oversize DER, same host key and single-use certificate publication. Registered optional serve_with_enrollment runtime injection preserves D168 source policy; CLI join/runtime routing remain WIP. Full scoped gate running.

kayg commented

2026-10-07 21:15:30 +00:00

Author

Owner

Run6 enrollment HTTP module complete 166858df14: registered optional serve_with_enrollment + host-bound POST routes; mode/uid immutable, exact-Origin/live-owner cookie, eight ingress slots,8192-byte bodies,5s request deadline,canonical4096-byte DER. Session authority is rechecked atomically before issuing a capability; D168 signer never unlocked by routing. CLI configuration, operator join and remote session routing remain WIP; first demo step is not yet complete. Exact scoped source-only fast exit0; log evidence/remote-agents/run6-http-source-fast.log. Prior HTTP regressions2/2 green; separate test commit next. n1000 adapter+SQLite diagnostic p50/p99=3354/13122us,435 CPUticks(HZ100=4.35s),2592KiB cohort RSS,398000DERbytes; excludes transports/daemon/live renewal; shared8core load1.80/1.67/2.54,debug. Verbatim gate:

| Rust gate                 | Result       |
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 0 fail
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.76s]

Run6 enrollment HTTP module complete 166858df14cd2e53f4ee0c6c1bc55cbe69aa51d8: registered optional serve_with_enrollment + host-bound POST routes; mode/uid immutable, exact-Origin/live-owner cookie, eight ingress slots,8192-byte bodies,5s request deadline,canonical4096-byte DER. Session authority is rechecked atomically before issuing a capability; D168 signer never unlocked by routing. CLI configuration, operator join and remote session routing remain WIP; first demo step is not yet complete. Exact scoped source-only fast exit0; log evidence/remote-agents/run6-http-source-fast.log. Prior HTTP regressions2/2 green; separate test commit next. n1000 adapter+SQLite diagnostic p50/p99=3354/13122us,435 CPUticks(HZ100=4.35s),2592KiB cohort RSS,398000DERbytes; excludes transports/daemon/live renewal; shared8core load1.80/1.67/2.54,debug. Verbatim gate: ``` | Rust gate | Result | | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 0 fail 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.76s] ```

kayg referenced this issue

2026-10-07 21:35:02 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-07 21:35:46 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 21:36:12 +00:00

Author

Owner

Run6 HTTP defensive tests complete 799d8d9cf1: retained two real SQLite/signed-CSR HTTP oracles and ignored1000-host diagnostic. Logout publication regression RED200->GREEN403,zero tokens. Cold signer preserves invitation; uid substitution/missing cookie/wrong Origin/oversize DER refused; single-use committed certificate matches local public key and enrolled uid1002. Exact requested scoped fast exit0; evidence/remote-agents/run6-http-tests-fast.log. Verbatim:

| Rust gate                 | Result       |
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
 0 fail
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [1.93s]

Run6 HTTP defensive tests complete 799d8d9cf11b3bd48c8052a6fc0e20ad7cdfde1c: retained two real SQLite/signed-CSR HTTP oracles and ignored1000-host diagnostic. Logout publication regression RED200->GREEN403,zero tokens. Cold signer preserves invitation; uid substitution/missing cookie/wrong Origin/oversize DER refused; single-use committed certificate matches local public key and enrolled uid1002. Exact requested scoped fast exit0; evidence/remote-agents/run6-http-tests-fast.log. Verbatim: ``` | Rust gate | Result | | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | 0 fail 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.93s] ```

kayg commented

2026-10-07 21:42:00 +00:00

Author

Owner

Run6 next dependency boundary: server registry/terminal actor will directly reuse infraternal-agent transport modules plus already-selected quinn/BBR; operator HTTPS join will reuse the server’s existing Hyper HTTP engine and OpenSSL TLS via direct package declarations (client/http1 and Tokio IO adapter features), not a new HTTP/TLS library. Next runtime step uses admitted execution uid and existing terminal_writers even ids. Unregistered remote_client.rs,remote_link.rs,remote_runtime.rs and actor preview compile against the branch libraries but have no runtime acceptance yet. Fresh D167 serial CPUWeight10000 diagnostics: QUIC RTT300 n25 p50/p99=459995/461603us,1000 co-resident pairs67384KiB (67.384KiB/pair),543CPUticks,load1.98/1.73/1.81; TCP757817/758901us,69400KiB (69.4KiB/pair),193ticks,load0.64/1.32/1.64,process-local NOFILE4096. Logs run6-{quic,tcp}-diagnostic.log. Exclude whole-daemon RSS and live renewal.

kayg commented

2026-10-07 21:44:38 +00:00

Author

Owner

Proposed additive routing schema: nullable terminal_sessions.remote_host_id referencing remote_hosts (NULL keeps embedded behavior). Opening a requested host rechecks its owner and tombstone; publishing the session rechecks both host and live browser authority in the INSERT. Attach resolves the stored host binding after the existing server-assigned writer allocation; QUIC stream ids are never writer ids. No wire frame changes.

kayg referenced this issue

2026-10-07 21:44:40 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-07 21:49:51 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 21:54:06 +00:00

Author

Owner

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.35s]

Completed dependency step ac64cbcfc0d01c756e489dd464ef10572a94fc3e: server reuses the existing agent QUIC/TLS adapters; operator HTTPS reuses Hyper/OpenSSL. No new HTTP/TLS engine. Scoped exact nix scripts/verify fast exit 0. PT_INTERP: absent; size: 16141648 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13570632 bytes (baseline 13555672 + allowance 262144 = max 13817816). Gate output verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.35s]

kayg commented

2026-10-07 21:57:16 +00:00

Author

Owner

Finding: the uncommitted sequential QUIC-first supervisor added the 5 s UDP handshake timeout before TCP. Real local mTLS admission regression failed after 2,001,632 us (run6-client-tests-red.log). Changed it to start QUIC immediately and race authenticated TCP after a 100 ms grace; the same test passes at 119,963 us (run6-client-tests-green.log), load 2.02/1.73/1.71 on infraternal-dev. Real QUIC coalesced Hello/Ping suffix and local uid-refusal tests also pass. No budget changed. This is local establishment evidence, not a 300 ms RTT reconnect result.

kayg commented

2026-10-07 22:06:52 +00:00

Author

Owner

Finding: a winning QUIC dial retained its losing pinned TLS future throughout control dispatch. Real UDP-delayed QUIC + unfinished TCP/TLS regression failed (1.48 s, run6-client-loser-red.log). Moved the race into its own future so the loser drops before dispatch. Same regression passes; all four supervisor tests pass in 0.48 s (run6-client-loser-green.log), local fallback 114646 us. Tests use a unique private scratch state directory and remove it after cancellation. Full source gate is being repeated for this lifetime fix.

kayg referenced this issue

2026-10-07 22:17:58 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 22:24:28 +00:00

Author

Owner

Completed outgoing-supervisor source step cfad9303a7: uid-gated QUIC/BBR, authenticated TCP racing after 100 ms, bounded backoff, retained greeting decoder and pinned terminal-binding accept. Losing handshakes close before dispatch. Four targeted real transport regressions passed before this source-only commit; tests are the next atomic step. CLI/runtime routing is still unconnected. Scoped exact nix scripts/verify fast exit 0. PT_INTERP: absent; size: 16136528 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564360 bytes (baseline 13555672 + allowance 262144 = max 13817816). Gate output verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.83s]

Completed outgoing-supervisor source step cfad9303a712ed8d11d0fcdde17bf1e036df22ce: uid-gated QUIC/BBR, authenticated TCP racing after 100 ms, bounded backoff, retained greeting decoder and pinned terminal-binding accept. Losing handshakes close before dispatch. Four targeted real transport regressions passed before this source-only commit; tests are the next atomic step. CLI/runtime routing is still unconnected. Scoped exact nix scripts/verify fast exit 0. PT_INTERP: absent; size: 16136528 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564360 bytes (baseline 13555672 + allowance 262144 = max 13817816). Gate output verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.83s]

kayg commented

2026-10-07 22:31:05 +00:00

Author

Owner

Finding: the test-only UDP latency proxy kept one latest client address, so supervisor process restarts could misroute delayed replies. New simultaneous two-client oracle failed after 2 s (run6-proxy-routing-red.log). Each client now has its own upstream reply socket; 1024 client slots and 4096 delayed ciphertext datagrams bound relay storage. All five supervisor/relay regressions pass in 0.49 s and clippy passes (run6-proxy-routing-green.log, run6-proxy-clippy.log). Repeating the 300 ms supervisor diagnostic with corrected routing before reporting timing numbers.

kayg commented

2026-10-07 23:02:01 +00:00

Author

Owner

D167 diagnostics after relay corrections, no own build/browser overlap, CPUWeight=10000 on infraternal-dev i9-9900K (8 visible cores). Supervisor first Hello at fixed 300 ms RTT, n=25: QUIC p50/p99 472083/477610 us (load .18/.10/.47); blocked UDP + TCP 876698/884004 us (load .12/.09/.46). Excludes SQLite host admission, terminal open and live renewal. Pure transport handshakes: QUIC 461025/463278 us; TCP 758196/759432 us. 1000 co-resident client/server pairs add 67344 KiB QUIC (610 CPU ticks) and 69408 KiB TCP (209 ticks); HZ=100. Full-daemon RSS is not established. Relay TCP spacing regression: RED 151562 us versus intended 20 ms, GREEN 20188 us; 1500000 flood bytes + half-close preserved exactly. Corrected bounded FIFO models independent flight deadlines. Seven tests pass; fast gate running for the atomic test step.

kayg commented

2026-10-07 23:05:11 +00:00

Author

Owner

Completed supervisor verification step 280d78ffa7: seven real transport/relay regressions, private-state cleanup, and isolated 300 ms diagnostics. No thresholds changed. Metadata and timing numbers are in the preceding finding. Scoped exact nix scripts/verify fast exit 0. PT_INTERP: absent; size: 16136528 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564360 bytes (baseline 13555672 + allowance 262144 = max 13817816). Runtime/session routing and operator CLI remain the next steps. Gate output verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.99s]

Completed supervisor verification step 280d78ffa7a58063992b4057c55beb2f2c290deb: seven real transport/relay regressions, private-state cleanup, and isolated 300 ms diagnostics. No thresholds changed. Metadata and timing numbers are in the preceding finding. Scoped exact nix scripts/verify fast exit 0. PT_INTERP: absent; size: 16136528 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564360 bytes (baseline 13555672 + allowance 262144 = max 13817816). Runtime/session routing and operator CLI remain the next steps. Gate output verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.99s]

kayg commented

2026-10-07 23:12:23 +00:00

Author

Owner

Schema step finding: the upgrade test hard-coded max migration 12 and failed against additive 0013 (actual 13), run6-session-schema-fast.log. Updated the version assertion to the migrator maximum and extended the real SQLite upgrade oracle: legacy sessions retain NULL/embedded routing; unknown hosts cannot replace a session binding; a referenced host cannot be deleted. Targeted upgrade test passes in .02 s (run6-session-schema-test.log). No performance threshold changed; full gate will be repeated for this schema/test pair.

kayg referenced this issue

2026-10-07 23:17:56 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 23:18:58 +00:00

Author

Owner

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.79s]

kayg referenced this issue

2026-10-07 23:21:53 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 23:23:55 +00:00

Author

Owner

Runtime routing work in progress from e870af4: admitted remote links now feed the existing terminal actor; browser sessions persist and select their enrolled host, with live owner/tombstone checks before open and at SQL publication. Real TCP test verifies enrolled UID 1002; real QUIC test verifies durable writer 42 differs from the native stream id and AttachTerm preserves offsets 1234/5678. Both passed in 0.04s (evidence/remote-agents/run6-runtime-remote-tests.log); 12 existing actor tests passed in 0.42s. Clippy is green; exact scoped fast gate running. CLI activation and two-process demo remain incomplete.

Runtime routing work in progress from e870af4: admitted remote links now feed the existing terminal actor; browser sessions persist and select their enrolled host, with live owner/tombstone checks before open and at SQL publication. Real TCP test verifies enrolled UID 1002; real QUIC test verifies durable writer 42 differs from the native stream id and AttachTerm preserves offsets 1234/5678. Both passed in 0.04s (evidence/remote-agents/run6-runtime-remote-tests.log); 12 existing actor tests passed in 0.42s. Clippy is green; exact scoped fast gate running. CLI activation and two-process demo remain incomplete.

kayg commented

2026-10-07 23:31:51 +00:00

Author

Owner

Finding: runtime QUIC/actor wiring makes transport code reachable in the normal server binary. Exact scoped fast gate: fmt PASS; VT native fmt PASS; clippy PASS; test PASS; cargo-deny PASS; static builds FAIL (1). x86_64 stripped static binary 18,252,496 bytes, baseline 16,142,672; maximum 16,404,816, over maximum by 1,847,680 bytes. Evidence: evidence/remote-agents/run6-runtime-fast.log. No commit or threshold change made. Measuring aarch64 and reachable code before size reductions; CLI activation and two-process proof remain pending.

kayg referenced this issue

2026-10-07 23:33:18 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 23:36:06 +00:00

Author

Owner

Second target measured without changing the budget: aarch64 static release is 15,306,632 bytes (baseline 13,555,672; max 13,817,816), over max by 1,488,816. Build finished in 2m13s under CPUWeight=10000; evidence/remote-agents/run6-runtime-arm-size-build.log. x86_64 delta from baseline is +2,109,824; aarch64 +1,750,960. Both are the runtime routing WIP before operator CLI activation. No commit, baseline change, deployment or real-host installation. Code-size analysis is running; local two-process fixture is being prepared with memory-only CA keys and private-stdin join capability.

kayg referenced this issue

2026-10-07 23:42:18 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-07 23:47:46 +00:00

Author

Owner

Code-size profile completed (unstripped diagnostic build, not a replacement gate artifact): quinn_proto 416.2 KiB, rustls 252.2 KiB, ring 243.9 KiB, quinn 46.1 KiB of .text; attribution is approximate, not the whole size delta. evidence/remote-agents/run6-runtime-bloat.log. The WIP operator CLI now exposes private-stdin join and reconnect; workspace clippy passed before fixture progress traces. The two-process fixture has reached invitation issuance, browser Welcome, remote terminal.open and streamed output, but the marker/roundtrip assertion has not passed yet. Unused embedded fallback is closed in this remote-only fixture, so successful opens cannot silently route locally. No real-host contact or commit while the size gate is red.

kayg commented

2026-10-07 23:52:43 +00:00

Author

Owner

Correction to the preceding checkpoint: the two-process proof passed (evidence/remote-agents/run6-demo-two-process.log): join-to-terminal 164,127 us, first command echo 47,492 us including shell startup; 307 contiguous output bytes, zero gaps/duplicates. A startup-drained run also passed: join 168,109 us, command echo 47,980 us, 352 contiguous bytes; load 0.62/1.06/1.78, debug build, actual rootless uid 1001. Full browser rendering and real-host proof are not included. The fixture isolates the existing shell profile and removes agent state/key plus surviving fixture shims. Investigating the ~48ms local echo: axum-server OpenSSLAcceptor defaults to DefaultAcceptor, which leaves Nagle enabled; the standalone HTTPS path currently uses that default, despite the plain HTTP path explicitly disabling it.

kayg commented

2026-10-08 00:00:59 +00:00

Author

Owner

Measured HTTPS finding [41][130]: real accepted-socket regression FAILED with Nagle enabled (run6-tls-nagle-red.log), then PASSED with existing NoDelayAcceptor (run6-tls-nagle-green.log). Isolated CPUWeight=10000, infraternal-dev i9-9900K, 8 visible cores, debug, n=25 two-process trials: old command-echo p50/p99 48,252/52,030 us (load after 1.70/1.14/1.48); fixed 6,359/9,291 us (load after 1.16/0.96/1.49). Join-to-terminal old 153,096/202,781 us, fixed 118,651/132,670 us. Every trial asserted contiguous output offsets. This is browser-protocol command echo, not glyph timing or pinned perf certification. Logs: evidence/remote-agents/run6-demo-nagle-25.log and run6-demo-nodelay-25.log. Remote demo WIP is temporarily isolated to land the HTTPS bug fix separately with green gates: eight tracked files are saved with SHA256 in .scratch/run6-demo-wip-backup/manifest.json; untracked remote modules remain. Current head e870af4 plus only the existing tokio-openssl test dependency; restore the backed-up files after the independent TLS commits. No feature commit while the static size gate is red.

Measured HTTPS finding [41][130]: real accepted-socket regression FAILED with Nagle enabled (run6-tls-nagle-red.log), then PASSED with existing NoDelayAcceptor (run6-tls-nagle-green.log). Isolated CPUWeight=10000, infraternal-dev i9-9900K, 8 visible cores, debug, n=25 two-process trials: old command-echo p50/p99 48,252/52,030 us (load after 1.70/1.14/1.48); fixed 6,359/9,291 us (load after 1.16/0.96/1.49). Join-to-terminal old 153,096/202,781 us, fixed 118,651/132,670 us. Every trial asserted contiguous output offsets. This is browser-protocol command echo, not glyph timing or pinned perf certification. Logs: evidence/remote-agents/run6-demo-nagle-25.log and run6-demo-nodelay-25.log. Remote demo WIP is temporarily isolated to land the HTTPS bug fix separately with green gates: eight tracked files are saved with SHA256 in .scratch/run6-demo-wip-backup/manifest.json; untracked remote modules remain. Current head e870af4 plus only the existing tokio-openssl test dependency; restore the backed-up files after the independent TLS commits. No feature commit while the static size gate is red.

kayg commented

2026-10-08 00:09:05 +00:00

Author

Owner

Completed test dependency step: 72d2c9492d. Reused the existing tokio-openssl adapter as a server dev dependency for the real accepted-socket regression; no production TLS engine change. Remote feature WIP remains in .scratch/run6-demo-wip-backup. Exact CPUWeight=10000 fast gate exit 0; PT_INTERP: absent; size: 16140720 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564456 bytes (baseline 13555672 + allowance 262144 = max 13817816):
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.02s]

Completed test dependency step: 72d2c9492d49280c0c6fd01426390f3b3c4275ee. Reused the existing tokio-openssl adapter as a server dev dependency for the real accepted-socket regression; no production TLS engine change. Remote feature WIP remains in .scratch/run6-demo-wip-backup. Exact CPUWeight=10000 fast gate exit 0; PT_INTERP: absent; size: 16140720 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564456 bytes (baseline 13555672 + allowance 262144 = max 13817816): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.02s]

kayg commented

2026-10-08 00:18:41 +00:00

Author

Owner

Completed standalone HTTPS fix: c0815d2142. Shared NoDelayAcceptor factory disables Nagle before TLS; real accepted-socket regression passes in 0.01s (previously failed with Nagle). Compared n=25 protocol command echoes in prior comment. Reviewer check: no TLS trust/version or authority change, keys memory-only in test, existing engine reused, shared factory, no protocol/layout change. Exact CPUWeight=10000 fast gate exit 0; PT_INTERP: absent; size: 16141104 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564968 bytes (baseline 13555672 + allowance 262144 = max 13817816):
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.05s]

Completed standalone HTTPS fix: c0815d21428e1ca63c60ec80fa5af01d080989cd. Shared NoDelayAcceptor factory disables Nagle before TLS; real accepted-socket regression passes in 0.01s (previously failed with Nagle). Compared n=25 protocol command echoes in prior comment. Reviewer check: no TLS trust/version or authority change, keys memory-only in test, existing engine reused, shared factory, no protocol/layout change. Exact CPUWeight=10000 fast gate exit 0; PT_INTERP: absent; size: 16141104 bytes (baseline 16142672 + allowance 262144 = max 16404816); PT_INTERP: absent; size: 13564968 bytes (baseline 13555672 + allowance 262144 = max 13817816): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.05s]

kayg commented

2026-10-08 00:25:57 +00:00

Author

Owner

Fixture finding/correction: Cargo executes server unit tests from the crate directory. Relative paths to idle_canary.py and the Python cleanup importer failed; 7 local fixture shims remained despite deleted scratch paths. Stopped only processes matching the current UID, exact infraternal executable and ra6/<8-hex>/s state argument. Fixed helper paths/cwd and check cleanup status; the optional real idle test now PASSED: 0 scheduler activations over 10.000s, 2 threads, full-daemon debug RSS 28,548 KiB, n=1 (not a 1000-daemon RSS proof). Post-test scan: 0 fixture shims remaining. Evidence: run6-demo-idle.log, run6-demo-idle-fixed.log. No real-host installations occurred. TLS fix c0815d2 has green fast gate; all eight remote WIP files restored with matching backup hashes. Complete-feature static sizes and owner budget resolution remain pending before the feature commit.

Fixture finding/correction: Cargo executes server unit tests from the crate directory. Relative paths to idle_canary.py and the Python cleanup importer failed; 7 local fixture shims remained despite deleted scratch paths. Stopped only processes matching the current UID, exact infraternal executable and ra6/<8-hex>/s state argument. Fixed helper paths/cwd and check cleanup status; the optional real idle test now PASSED: 0 scheduler activations over 10.000s, 2 threads, full-daemon debug RSS 28,548 KiB, n=1 (not a 1000-daemon RSS proof). Post-test scan: 0 fixture shims remaining. Evidence: run6-demo-idle.log, run6-demo-idle-fixed.log. No real-host installations occurred. TLS fix c0815d2 has green fast gate; all eight remote WIP files restored with matching backup hashes. Complete-feature static sizes and owner budget resolution remain pending before the feature commit.

kayg commented

2026-10-08 00:29:51 +00:00

Author

Owner

Complete WIP x86_64 static release (operator join/reconnect plus remote routing) is 18,957,072 bytes: +2,814,400 versus baseline, +2,552,256 above the unchanged 16,404,816 maximum. Scoped build finished in 1m38s; evidence/remote-agents/run6-complete-x86-build.log. aarch64 build running. c0815d2 remains the last green committed head; no feature commit, threshold change, deploy or real-host install. The fixture now also asserts that no shim with its exact --state argument survives cleanup.

Complete WIP x86_64 static release (operator join/reconnect plus remote routing) is 18,957,072 bytes: +2,814,400 versus baseline, +2,552,256 above the unchanged 16,404,816 maximum. Scoped build finished in 1m38s; evidence/remote-agents/run6-complete-x86-build.log. aarch64 build running. c0815d2 remains the last green committed head; no feature commit, threshold change, deploy or real-host install. The fixture now also asserts that no shim with its exact --state argument survives cleanup.

kayg referenced this issue

2026-10-08 00:30:06 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 00:31:34 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 00:32:40 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 00:34:37 +00:00

Author

Owner

Complete-feature aarch64 static release measured 15,909,600 bytes: +2,353,928 versus baseline, +2,091,784 above unchanged maximum 13,817,816. Build 1m47s (run6-complete-arm-build.log). Both complete artifacts are stripped/static with no PT_INTERP (run6-complete-static-identities.log). Release x86_64 real CLI idle proof PASSED: 0 activations/10.001s, 2 threads, 12,824 KiB RSS with a terminal attached, n=1; 12,824,000 KiB for 1000 separate hosts is multiplication only, not an at-scale daemon collection. The metric says profile=debug for the harness; CLI is the static release artifact passed via INFRATERNAL_REMOTE_TEST_BINARY. run6-demo-release-idle.log. Full TCP-fallback session proof is running. Feature commit remains gated by unchanged static size limits.

kayg commented

2026-10-08 00:38:31 +00:00

Author

Owner

Demo boundary for owner review: real local server router + rootless static CLI passed QUIC terminal and forced-TCP terminal. TCP fallback: join-to-terminal 228,355 us, command echo 3,966 us, 203 contiguous bytes, zero gaps/duplicates (run6-demo-release-tcp.log). QUIC release idle: 12,824 KiB, 0 activations/10.001s, 2 threads. Existing D167 transport-only 1000-pair/300ms metrics remain in earlier comment; full 1000-daemon collection and live renewal cost remain unproved. Complete stripped static artifacts: x86_64 18,957,072; aarch64 15,909,600. Current maxima: 16,404,816/13,817,816. Owner question pending in the session: keep reducing within those limits, or review an intentional feature baseline under PROCESS §7. No threshold changed and no feature commit. c0815d2 is the last green head; remote WIP is restored, not isolated. Production administrator-envelope adapter/default CLI server startup wiring, browser-rendering proof and o1 installation are still not delivered.

Demo boundary for owner review: real local server router + rootless static CLI passed QUIC terminal and forced-TCP terminal. TCP fallback: join-to-terminal 228,355 us, command echo 3,966 us, 203 contiguous bytes, zero gaps/duplicates (run6-demo-release-tcp.log). QUIC release idle: 12,824 KiB, 0 activations/10.001s, 2 threads. Existing D167 transport-only 1000-pair/300ms metrics remain in earlier comment; full 1000-daemon collection and live renewal cost remain unproved. Complete stripped static artifacts: x86_64 18,957,072; aarch64 15,909,600. Current maxima: 16,404,816/13,817,816. Owner question pending in the session: keep reducing within those limits, or review an intentional feature baseline under PROCESS §7. No threshold changed and no feature commit. c0815d2 is the last green head; remote WIP is restored, not isolated. Production administrator-envelope adapter/default CLI server startup wiring, browser-rendering proof and o1 installation are still not delivered.

kayg commented

2026-10-08 00:57:14 +00:00

Author

Owner

Local rendered-browser proof PASSED with actual static rootless CLI and production tracer assets: run6-real-browser-restart.log. Desktop/iPhone command rendered; actual browser probe n=25 at RTT0: keydown-to-glyph p50/p99 14.90/21.60 ms and 14.60/23.80 ms, respectively; load 1.66/1.77/1.51 before, 1.77/1.79/1.52 after. These are dev diagnostics, not pinned certification; p99 exceeds 17ms. Foreign owner open denied with unchanged session count. Local process restart left one shim running during 650ms absence, recovered in 18,971us, checked 1,313 contiguous bytes without gaps/duplicates, then cleanup asserted zero surviving fixture shims. Screenshots: evidence/remote-agents/screenshots/run6-real-remote-desktop.png and run6-real-remote-iphone.png; no visual-quality judgement. Fixture compatibility finding: Chromium rejected the Ed25519 HTTPS leaf with net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH (run6-browser-ed25519-red.log); P-256 browser-facing fixture leaf fixed it, retaining Ed25519 internal CA/host keys and independently configured production HTTPS. Browser suite port4701: 44 passed, 21 skipped, 3 failed (9.9m): motion frames169/190, confirmed echo364ms/334ms, access first paint1692ms/1000ms; scoped baseline comparison pending. Static size limits remain unchanged; no feature commit, o1 contact or deploy.

kayg referenced this issue

2026-10-08 00:58:03 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 01:01:43 +00:00

Author

Owner

Correction to the prior browser summary: motion-audit failed tooltipDuringMove.width (169px received, 190px expected), not a frame count. Evidence: run6-tracer-browser.log lines207-223 and motion-audit.spec.ts:452. Isolated branch rerun under CPUWeight10000/port4701 reproduced all three failures: tooltip169/190px; confirmed echo p99 370ms/334ms (n20); setup access upper-bound p99 1514.6ms/1000ms and sign-in1864.4ms/1000ms. Load after0.96/1.39/1.42. Archived dev ac03b19 comparison is running serially with the same scope/port and pinned browser packages.

Correction to the prior browser summary: motion-audit failed tooltipDuringMove.width (169px received, 190px expected), not a frame count. Evidence: run6-tracer-browser.log lines207-223 and motion-audit.spec.ts:452. Isolated branch rerun under CPUWeight10000/port4701 reproduced all three failures: tooltip169/190px; confirmed echo p99 370ms/334ms (n20); setup access upper-bound p99 1514.6ms/1000ms and sign-in1864.4ms/1000ms. Load after0.96/1.39/1.42. Archived dev ac03b19 comparison is running serially with the same scope/port and pinned browser packages.

kayg commented

2026-10-08 01:06:35 +00:00

Author

Owner

Scoped baseline comparison completed: ac03b19 had 1 passed/2 failed (4.0m); branch isolated had 3 failed. Both confirmed-echo/access timing tests fail on baseline: echo p99 364.30ms/334ms (branch370ms), setup access p99 1763.90ms/1000ms (branch1514.60ms), sign-in1846.30ms/1000ms (branch1864.40ms). Baseline final load0.34/1.02/1.28; branch0.96/1.39/1.42. Baseline motion passed; branch tooltip width169px/190px fails after upstream UI typography changes (shared tooltip uses --text-secondary; see 4ec7553/dfe2f6e). No timing threshold or UI assertion changed. Logs run6-browser-isolated-ac03b19.log and run6-browser-isolated-branch.log. Required dev merge is staged with no conflicts; demo WIP safely stashed and source/hash backed up in .scratch/run6-pre-dev-wip. Original complete-feature static artifacts retained under job scratch, SHA256 x86 12f44e66365b8124cac50932935c3af05e01dd2c6ee70e4651edcbd72c0e824a / ARM fa2f3f48aca9c086761bd1de5d9310910b11a32c66d8e4d78de57290b35aa42f. Checking committed-tree fast gate before merge commit; no baseline change, o1 contact, push or deploy.

Scoped baseline comparison completed: ac03b19 had 1 passed/2 failed (4.0m); branch isolated had 3 failed. Both confirmed-echo/access timing tests fail on baseline: echo p99 364.30ms/334ms (branch370ms), setup access p99 1763.90ms/1000ms (branch1514.60ms), sign-in1846.30ms/1000ms (branch1864.40ms). Baseline final load0.34/1.02/1.28; branch0.96/1.39/1.42. Baseline motion passed; branch tooltip width169px/190px fails after upstream UI typography changes (shared tooltip uses --text-secondary; see 4ec7553/dfe2f6e). No timing threshold or UI assertion changed. Logs run6-browser-isolated-ac03b19.log and run6-browser-isolated-branch.log. Required dev merge is staged with no conflicts; demo WIP safely stashed and source/hash backed up in .scratch/run6-pre-dev-wip. Original complete-feature static artifacts retained under job scratch, SHA256 x86 12f44e66365b8124cac50932935c3af05e01dd2c6ee70e4651edcbd72c0e824a / ARM fa2f3f48aca9c086761bd1de5d9310910b11a32c66d8e4d78de57290b35aa42f. Checking committed-tree fast gate before merge commit; no baseline change, o1 contact, push or deploy.

kayg referenced this issue

2026-10-08 01:11:05 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 01:17:01 +00:00

Author

Owner

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.83s]

Checking restored complete-feature WIP separately; its previously measured 18,957,072/15,909,600-byte artifacts still exceed unchanged limits. No feature commit, host contact, push or deploy.

Required dev merge completed at 3a92ea2 (dev e19c4eb), conflict-free; demo WIP restored afterward with all 14 source hashes matching .scratch/run6-pre-dev-wip/manifest.json. Committed-tree exact CPUWeight10000 fast gate exit0; both static binaries have no PT_INTERP: x86_64 16,141,104 bytes / max16,404,816; aarch64 13,564,968 / max13,817,816. run6-dev-merge-fast.log: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.83s] Checking restored complete-feature WIP separately; its previously measured 18,957,072/15,909,600-byte artifacts still exceed unchanged limits. No feature commit, host contact, push or deploy.

kayg referenced this issue

2026-10-08 01:26:24 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 01:27:48 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 01:27:57 +00:00

Author

Owner

Restored complete-feature fast gate is RED in two places (run6-complete-final-fast.log): unchanged static x86 maximum16,404,816 vs18,957,072; real embedded-fd daemon idle RSS assertion <15,360KiB. Measured actual debug inherited-fd process n25, scoped CPUWeight10000, no PTY: RSS min/p50/p99 15,040/15,292/15,432KiB, anonymous p50/p99 2,392/2,396KiB; load after0.20/1.14/1.43 (run6-embedded-debug-rss-before.log). This is a mapped-code/CLI working-set regression near the limit, not permission to raise it. Measuring a narrow existing-Clap parser for the trusted inherited-fd startup, sharing its flag definitions with the public CLI; reject parsing the whole server/join command tree on every embedded startup. No parser engine or threshold change. 3a92ea2 committed tree remains green; full feature remains uncommitted.

Restored complete-feature fast gate is RED in two places (run6-complete-final-fast.log): unchanged static x86 maximum16,404,816 vs18,957,072; real embedded-fd daemon idle RSS assertion <15,360KiB. Measured actual debug inherited-fd process n25, scoped CPUWeight10000, no PTY: RSS min/p50/p99 15,040/15,292/15,432KiB, anonymous p50/p99 2,392/2,396KiB; load after0.20/1.14/1.43 (run6-embedded-debug-rss-before.log). This is a mapped-code/CLI working-set regression near the limit, not permission to raise it. Measuring a narrow existing-Clap parser for the trusted inherited-fd startup, sharing its flag definitions with the public CLI; reject parsing the whole server/join command tree on every embedded startup. No parser engine or threshold change. 3a92ea2 committed tree remains green; full feature remains uncommitted.

kayg commented

2026-10-08 01:52:50 +00:00

Author

Owner

Completed independent fd-startup module: 5d9baa4. Existing Clap engine, shared fd/state definitions; help/data/operator invocations retain public parser. Before/after real debug daemon n25 with demo WIP enabled: RSS p50/p99 15,292/15,432 -> 14,516/14,768KiB; anonymous p50 2,392 -> 2,204KiB. Real 24-stop oracle PASSED: 4,710,396 exact payload bytes; idle scheduler slices0. Cited proof logs moved under docs/verification/remote-agents/ in this commit (same filenames, role header added). No RSS/size/release-profile threshold changed. Module self-review: no runtime before __shim fork, no descriptor ownership change, unknown inherited-fd actions/options reject through Clap, public help still complete. Committed-tree exact scoped fast gate exit0, run6-embedded-isolated-fast.log; x8616,146,032 / max16,404,816, ARM13,573,104 / max13,817,816, no PT_INTERP:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.96s]

Separate parser compatibility tests are prepared and gating. Demo feature remains stashed with current source/hash backup .scratch/run6-post-perf-wip. No o1 contact or deploy.

Completed independent fd-startup module: 5d9baa4. Existing Clap engine, shared fd/state definitions; help/data/operator invocations retain public parser. Before/after real debug daemon n25 with demo WIP enabled: RSS p50/p99 15,292/15,432 -> 14,516/14,768KiB; anonymous p50 2,392 -> 2,204KiB. Real 24-stop oracle PASSED: 4,710,396 exact payload bytes; idle scheduler slices0. Cited proof logs moved under docs/verification/remote-agents/ in this commit (same filenames, role header added). No RSS/size/release-profile threshold changed. Module self-review: no runtime before __shim fork, no descriptor ownership change, unknown inherited-fd actions/options reject through Clap, public help still complete. Committed-tree exact scoped fast gate exit0, run6-embedded-isolated-fast.log; x8616,146,032 / max16,404,816, ARM13,573,104 / max13,817,816, no PT_INTERP: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.96s] Separate parser compatibility tests are prepared and gating. Demo feature remains stashed with current source/hash backup .scratch/run6-post-perf-wip. No o1 contact or deploy.

kayg commented

2026-10-08 02:00:22 +00:00

Author

Owner

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.09s]

Restored all14 demo source files, including the fd working-set fix, with matching .scratch/run6-post-perf-wip hashes; dropped the temporary stash only after verification. Complete-feature gate rerunning now. Feature remains uncommitted pending unchanged static size limits; no real-host installation or deploy.

Completed separate parser compatibility tests at 4c5e638: fd bounds/order/invalid values, shared public-parser result, help/operator/foreign-mode dispatch. Exact CPUWeight10000 fast gate exit0 (run6-embedded-compat-fast.log); unchanged stripped/static x8616,146,032 and ARM13,573,104 bytes: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.09s] Restored all14 demo source files, including the fd working-set fix, with matching .scratch/run6-post-perf-wip hashes; dropped the temporary stash only after verification. Complete-feature gate rerunning now. Feature remains uncommitted pending unchanged static size limits; no real-host installation or deploy.

kayg commented

2026-10-08 02:07:15 +00:00

Author

Owner

Verification correction: manual WIP restoration used copy2 and preserved old source mtimes. Cargo's timestamp cache reused the committed 16,146,032/13,573,104-byte binaries, so run6-complete-after-fastpath-fast.log is STALE and is NOT complete-feature evidence despite a green table. No feature commit was made. Refreshed mtimes on all14 restored sources without content changes and restarted the exact scoped gate (run6-complete-fresh-fast.log). Future manual restores must refresh mtimes or clean the affected package. Committed-tree gates for 5d9baa4/4c5e638 are valid; feature prototype remains uncommitted.

kayg commented

2026-10-08 02:25:07 +00:00

Author

Owner

Fresh forced-TCP two-process idle check failed: 3 scheduler activations in 10.000 s, remote daemon RSS 12,668 KiB (n=1), CPUWeight=10000. Evidence: evidence/remote-agents/run6-current-tcp-idle.log; current server harness infraternal_server-8221050da9f55350 and freshly rebuilt static CLI. Investigating activation sources; zero-wakeup requirement unchanged. No o1/o2 installation or feature commit.

kayg commented

2026-10-08 02:30:24 +00:00

Author

Owner

TCP idle finding resolved in source: per-attempt Quinn/Tokio driver ownership cancels losing UDP tasks before TCP dispatch; no transport engine or idle threshold change. Real static CLI: TCP idle 0 activations/10.000s, RSS 14,652 KiB, join171,494us; QUIC idle 0/10.001s, RSS15,052KiB, join70,680us (n=1 each). TCP restart: recovery117,278us, shim preserved,614 contiguous bytes,0 lost/duplicated. Evidence run6-tcp-driver-idle-green.log, run6-quic-driver-idle-green.log, run6-tcp-driver-restart-green.log under evidence/remote-agents. Seven supervisor regressions and new silent-UDP cancellation test pass. Feature isolated for an atomic fix gate; static demo limits remain unchanged.

kayg commented

2026-10-08 02:42:11 +00:00

Author

Owner

Completed isolated TCP driver cancellation fix 382ffb8b9d. Real rootless TCP/QUIC idle checks now both show zero activations; failing and passing evidence cited by commit lives under docs/verification/remote-agents/. Seven supervisor regressions passed; no engines, idle thresholds or static limits changed. Exact CPUWeight10000, TRACER_TEST_PORT=4701 fast gate exit 0. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 16146032 bytes (baseline 16142672 + allowance 262144 = max 16404816)
PT_INTERP: absent; size: 13573104 bytes (baseline 13555672 + allowance 262144 = max 13817816)
7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.82s]

Completed isolated TCP driver cancellation fix 382ffb8b9d5c65007ae6976f8d8df98d2b5f7a2a. Real rootless TCP/QUIC idle checks now both show zero activations; failing and passing evidence cited by commit lives under docs/verification/remote-agents/. Seven supervisor regressions passed; no engines, idle thresholds or static limits changed. Exact CPUWeight10000, TRACER_TEST_PORT=4701 fast gate exit 0. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 16146032 bytes (baseline 16142672 + allowance 262144 = max 16404816) PT_INTERP: absent; size: 13573104 bytes (baseline 13555672 + allowance 262144 = max 13817816) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.82s]

kayg commented

2026-10-08 02:47:26 +00:00

Author

Owner

Completed separate real silent-UDP driver cancellation regression 0c72688cef. Pending real Quinn handshake fails promptly on attempt cancellation; normal gate covers it. Exact CPUWeight10000/TRACER_TEST_PORT4701 scripts/verify fast exit0. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 16146032 bytes (baseline 16142672 + allowance 262144 = max 16404816)
PT_INTERP: absent; size: 13573104 bytes (baseline 13555672 + allowance 262144 = max 13817816)
7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.87s]

Completed separate real silent-UDP driver cancellation regression 0c72688cef6f1d5f0002fabc24989a90a71bd753. Pending real Quinn handshake fails promptly on attempt cancellation; normal gate covers it. Exact CPUWeight10000/TRACER_TEST_PORT4701 scripts/verify fast exit0. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 16146032 bytes (baseline 16142672 + allowance 262144 = max 16404816) PT_INTERP: absent; size: 13573104 bytes (baseline 13555672 + allowance 262144 = max 13817816) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.87s]

kayg commented

2026-10-08 02:49:22 +00:00

Author

Owner

D167 repeat after 0c72688 on current workspace test executable, CPUWeight10000, infraternal-dev i9-9900K/8 cores, no parallel build/browser: 300ms RTT, n25 each. Verbatim:
supervisor_diagnostic rtt_ms=300 udp_blocked=false n=25 first_hello_p50_us=462153 p99_us=464347 machine=infraternal-dev load=0.46 0.68 0.71 1/605 2732688 excludes=session_open,live_renewal
supervisor_diagnostic rtt_ms=300 udp_blocked=true n=25 first_hello_p50_us=868902 p99_us=872135 machine=infraternal-dev load=0.30 0.62 0.69 1/625 2732774 excludes=session_open,live_renewal
No latency regression against earlier first-Hello QUIC472083/477610us and TCP876698/884004us; excludes sessions and live renewal. Demo WIP restored byte-for-byte and source mtimes explicitly refreshed; running exact final restored-feature fast gate, with static limits unchanged.

D167 repeat after 0c72688 on current workspace test executable, CPUWeight10000, infraternal-dev i9-9900K/8 cores, no parallel build/browser: 300ms RTT, n25 each. Verbatim: supervisor_diagnostic rtt_ms=300 udp_blocked=false n=25 first_hello_p50_us=462153 p99_us=464347 machine=infraternal-dev load=0.46 0.68 0.71 1/605 2732688 excludes=session_open,live_renewal supervisor_diagnostic rtt_ms=300 udp_blocked=true n=25 first_hello_p50_us=868902 p99_us=872135 machine=infraternal-dev load=0.30 0.62 0.69 1/625 2732774 excludes=session_open,live_renewal No latency regression against earlier first-Hello QUIC472083/477610us and TCP876698/884004us; excludes sessions and live renewal. Demo WIP restored byte-for-byte and source mtimes explicitly refreshed; running exact final restored-feature fast gate, with static limits unchanged.

kayg commented

2026-10-08 02:56:33 +00:00

Author

Owner

kayg commented

2026-10-08 02:59:25 +00:00

Author

Owner

Final fresh artifacts at head0c72688: x8618,982,128/max16,404,816 (over2,577,312); ARM15,934,232/max13,817,816 (over2,116,416); both stripped static/no PT_INTERP. SHA256/evidence evidence/remote-agents/run6-final-static-identities.log. Real current browser proof passes: join90,996us, protocolecho4,870us, QUICidle0 activations/10s RSS15,112KiB (n1); three independently acknowledged durable writers; same-session restart16,919us,1,313 contiguous bytes,0 lost/duplicated,zero surviving shims after cleanup. Real production Ghostty desktop/iPhone keydown-to-glyph n25 p50/p99 15.1/21.7ms and14.9/22.7ms; p99 exceeds17ms, not pinned certification. Screenshots evidence/remote-agents/screenshots/run6-real-remote-{desktop,iphone}.png for human review. ScopeCPUWeight10000; machine i9-9900K/8cores load0.69/0.76/0.74. Evidence run6-final-real-browser.log. Fresh full browser suite now running port4701; no o1/o2 contacts, deployment, push or merge back.

kayg commented

2026-10-08 03:14:34 +00:00

Author

Owner

Fresh merged-dev production browser suite: CPUWeight10000/TRACER_TEST_PORT4701, exit1,45 passed/21 skipped/8 failed (13.9m). Motion width169/190; palettefilter0.1610ms/0.13; prediction50MB throughput -5.45%/-5%; glyph cell alignmentDPR1/2/3; reconnectp99946.2ms/900; accessfirstpaint. Predicted glyph17ms assertion and returning sign-in5s passed. Evidence evidence/remote-agents/run6-final-tracer-browser.log. Frontend/test/proxy sources are byte-identical to dev e19c4eb (git diff dev -- apps/tracer packages/ui scripts/latency_proxy.py empty); no UI assertions/thresholds changed. Running those eight cases on isolated dev e19c4eb with frozen dependencies and same scope/port, without parallel builds. Prior ac03b19 comparison remains recorded for pre-merge timing failures; new dev features need this current-dev comparison. Remote real-host proof still not attempted because first-slice static gate is red.

Fresh merged-dev production browser suite: CPUWeight10000/TRACER_TEST_PORT4701, exit1,45 passed/21 skipped/8 failed (13.9m). Motion width169/190; palettefilter0.1610ms/0.13; prediction50MB throughput -5.45%/-5%; glyph cell alignmentDPR1/2/3; reconnectp99946.2ms/900; accessfirstpaint. Predicted glyph17ms assertion and returning sign-in5s passed. Evidence evidence/remote-agents/run6-final-tracer-browser.log. Frontend/test/proxy sources are byte-identical to dev e19c4eb (git diff dev -- apps/tracer packages/ui scripts/latency_proxy.py empty); no UI assertions/thresholds changed. Running those eight cases on isolated dev e19c4eb with frozen dependencies and same scope/port, without parallel builds. Prior ac03b19 comparison remains recorded for pre-merge timing failures; new dev features need this current-dev comparison. Remote real-host proof still not attempted because first-slice static gate is red.

kayg commented

2026-10-08 03:24:06 +00:00

Author

Owner

Current-dev e19c4eb comparison complete, same CPUWeight10000/TRACER_TEST_PORT4701:6 failed/2 passed (6.8m). Same motion169/190 and all three DPR geometry assertions fail; reconnectp99944.7ms/900, accessp991552.0/1856.9ms/1000 fail. Palette0.1040ms and prediction throughput -0.05% pass, unlike the full branch run; repeating only those two on the branch. Evidence evidence/remote-agents/run6-current-dev-browser-failures.log. Verbatim metrics:
METRIC name=palette_filter_handler_ms_per_input value=0.1040 inputs=100 viewport=1440x900
METRIC name=browser_bulk_output_throughput_delta source=tracer-production-build n=3 off_median_mbps=3.03 on_median_mbps=3.03 change_percent=-0.05 budget_percent=-5 result=PASS
METRIC name=reconnect_resumed source=tracer-production-build n=20 p50_ms=695.70 p99_ms=944.70 budget_ms=900 result=FAIL
METRIC name=access_screen_render_upper_bound_setup source=tracer-production-build n=30 configured_rtt_ms=300 p50_ms=1069.40 p99_ms=1552.00 budget_ms=1000 result=FAIL
METRIC name=access_screen_render_upper_bound_signin source=tracer-production-build n=30 configured_rtt_ms=300 p50_ms=1780.10 p99_ms=1856.90 budget_ms=1000 result=FAIL
Fresh final static CLI forced-TCP proof also passes:0 idle activations/10.001s, RSS12,684KiB,n1; join215,568us,echo4,012us; restart117,953us,614 contiguous bytes,0 loss/duplication,shim preserved then fully removed. Evidence run6-final-tcp-idle-restart.log. No real-host installation.

Current-dev e19c4eb comparison complete, same CPUWeight10000/TRACER_TEST_PORT4701:6 failed/2 passed (6.8m). Same motion169/190 and all three DPR geometry assertions fail; reconnectp99944.7ms/900, accessp991552.0/1856.9ms/1000 fail. Palette0.1040ms and prediction throughput -0.05% pass, unlike the full branch run; repeating only those two on the branch. Evidence evidence/remote-agents/run6-current-dev-browser-failures.log. Verbatim metrics: METRIC name=palette_filter_handler_ms_per_input value=0.1040 inputs=100 viewport=1440x900 METRIC name=browser_bulk_output_throughput_delta source=tracer-production-build n=3 off_median_mbps=3.03 on_median_mbps=3.03 change_percent=-0.05 budget_percent=-5 result=PASS METRIC name=reconnect_resumed source=tracer-production-build n=20 p50_ms=695.70 p99_ms=944.70 budget_ms=900 result=FAIL METRIC name=access_screen_render_upper_bound_setup source=tracer-production-build n=30 configured_rtt_ms=300 p50_ms=1069.40 p99_ms=1552.00 budget_ms=1000 result=FAIL METRIC name=access_screen_render_upper_bound_signin source=tracer-production-build n=30 configured_rtt_ms=300 p50_ms=1780.10 p99_ms=1856.90 budget_ms=1000 result=FAIL Fresh final static CLI forced-TCP proof also passes:0 idle activations/10.001s, RSS12,684KiB,n1; join215,568us,echo4,012us; restart117,953us,614 contiguous bytes,0 loss/duplication,shim preserved then fully removed. Evidence run6-final-tcp-idle-restart.log. No real-host installation.

kayg commented

2026-10-08 03:27:54 +00:00

Author

Owner

Run6 checkpoint at head 0c72688cef; phase1/demo step1 INCOMPLETE. Completed new atomic commits382ffb8 (cancel losing QUIC drivers) and0c72688 (real silent-UDP regression); each exact scoped fast gate passed. Fresh complete-feature fast gate is red solely on static size. Owner decision needed under PROCESS§7: approve intentional measured baseline update or direct packaging/foundation work; limits remain unchanged. Fresh x8618,982,128/max16,404,816; ARM15,934,232/max13,817,816, no INTERP. Unapplied review patch .scratch/run6-static-baseline-proposal.patch retains256KiB allowance (candidate maxima19,244,272/16,196,376); git apply --check passes. No engine/release/threshold changes assumed.

Local rootless QUIC/TCP enrollment→production browser terminal proof passes,3 independent writers,0 missing/duplicated bytes,QUICrestart16,919us/TCP117,953us,zero idle wakeups10s each; fresh RSS QUIC15,112KiB/TCP12,684KiB (n1). D167 300ms first-Hello n25:QUIC462153/464347us,TCP868902/872135us. Whole1000-daemon memory/live renewal remain unproved. Full browser45pass/21skip/8fail13.9m; isolated currentdev6fail/2pass6.8m; branch two variable-case repeats2pass2.5m (palette0.111ms,throughput0.00%). No assertion/threshold changes. All evidence logs under evidence/remote-agents/run6-final-*,run6-current-dev-browser-failures.log,run6-branch-browser-variable-repeat.log; screenshots evidence/remote-agents/screenshots/run6-real-remote-{desktop,iphone}.png. Author area checklist run; visual quality left for independent review.

Resume from active WIP: server remote_runtime.rs/remote_link.rs/embedded.rs/runtime.rs/websocket.rs plus remote_runtime_tests.rs/remote_demo_tests.rs; CLIremote.rs/main.rs; Cargo metadata, registration and scripts/verify-remote-browser.mjs. Public serve_with_remote accepts trusted MemorySource; normal CLI startup/encrypted administrator adapter still pending. Stable join shape documented contracts/remote.md for#87. Verification checkpoint docs/verification/remote-agents-run6.md is uncommitted. Then commit/gate slice1; only then o1 rootless proof/cleanup; then renewal,revocation/removal/uninstall,integrated lease,o1/o2 chaos. remote_lease.rs is unregistered, not enforcement. No o1/o2 contact,push,deployment,mergeback or issue closure. Byte-verified WIP restored/timestamps refreshed; no stash,zero surviving job shims; completed comparison/binary scratch removed,buildcache retained for unfinished job.

Run6 checkpoint at head 0c72688cef6f1d5f0002fabc24989a90a71bd753; phase1/demo step1 INCOMPLETE. Completed new atomic commits382ffb8 (cancel losing QUIC drivers) and0c72688 (real silent-UDP regression); each exact scoped fast gate passed. Fresh complete-feature fast gate is red solely on static size. Owner decision needed under PROCESS§7: approve intentional measured baseline update or direct packaging/foundation work; limits remain unchanged. Fresh x8618,982,128/max16,404,816; ARM15,934,232/max13,817,816, no INTERP. Unapplied review patch .scratch/run6-static-baseline-proposal.patch retains256KiB allowance (candidate maxima19,244,272/16,196,376); git apply --check passes. No engine/release/threshold changes assumed. Local rootless QUIC/TCP enrollment→production browser terminal proof passes,3 independent writers,0 missing/duplicated bytes,QUICrestart16,919us/TCP117,953us,zero idle wakeups10s each; fresh RSS QUIC15,112KiB/TCP12,684KiB (n1). D167 300ms first-Hello n25:QUIC462153/464347us,TCP868902/872135us. Whole1000-daemon memory/live renewal remain unproved. Full browser45pass/21skip/8fail13.9m; isolated currentdev6fail/2pass6.8m; branch two variable-case repeats2pass2.5m (palette0.111ms,throughput0.00%). No assertion/threshold changes. All evidence logs under evidence/remote-agents/run6-final-*,run6-current-dev-browser-failures.log,run6-branch-browser-variable-repeat.log; screenshots evidence/remote-agents/screenshots/run6-real-remote-{desktop,iphone}.png. Author area checklist run; visual quality left for independent review. Resume from active WIP: server remote_runtime.rs/remote_link.rs/embedded.rs/runtime.rs/websocket.rs plus remote_runtime_tests.rs/remote_demo_tests.rs; CLIremote.rs/main.rs; Cargo metadata, registration and scripts/verify-remote-browser.mjs. Public serve_with_remote accepts trusted MemorySource; normal CLI startup/encrypted administrator adapter still pending. Stable join shape documented contracts/remote.md for#87. Verification checkpoint docs/verification/remote-agents-run6.md is uncommitted. Then commit/gate slice1; only then o1 rootless proof/cleanup; then renewal,revocation/removal/uninstall,integrated lease,o1/o2 chaos. remote_lease.rs is unregistered, not enforcement. No o1/o2 contact,push,deployment,mergeback or issue closure. Byte-verified WIP restored/timestamps refreshed; no stash,zero surviving job shims; completed comparison/binary scratch removed,buildcache retained for unfinished job. Exact final restored gate CPUWeight10000/TRACER_TEST_PORT4701 exit1; evidence run6-final-restored-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-08 03:31:03 +00:00

Author

Owner

Run7 started, sole writer on remote-agents at 0c72688cef; original base fca6e093d8, merged dev e19c4eb. Read #78 history and parent #5; preserving demo WIP. First measure before/after static-musl crate attribution and duplicates, then remove justified crypto/dependency duplication with RTT300/throughput comparisons before any baseline change. Current 8-core load0.02/0.23/0.50. No push/deploy/merge back or host contact.

Run7 started, sole writer on remote-agents at 0c72688cef6f1d5f0002fabc24989a90a71bd753; original base fca6e093d8d07524e5f7014d0e9d730781f24239, merged dev e19c4eb. Read #78 history and parent #5; preserving demo WIP. First measure before/after static-musl crate attribution and duplicates, then remove justified crypto/dependency duplication with RTT300/throughput comparisons before any baseline change. Current 8-core load0.02/0.23/0.50. No push/deploy/merge back or host contact.

kayg commented

2026-10-08 03:33:20 +00:00

Author

Owner

Run7 static musl bloat at complete WIP: quinn_proto431.4KiB, quinn55.9KiB, rustls352.6KiB, ring243.9KiB, webpki44.6KiB; .text12.9MiB (symbol attribution approximate). Quinn0.11.12/0.11.19 only enables rustls backend via rustls-ring or rustls-aws-lc-rs; Retry AEAD/default reset/token keys also directly use ring. No OpenSSL-only configuration exists. Measuring rustls-openssl0.4.2 (MIT, uses existing OpenSSL) as an uncommitted reuse candidate; disable TLS1.2/PQ defaults and preserve X25519/cipher preference. This cannot eliminate Quinn ring dependency without a new backend/fork, which is not chosen. Baseline dev attribution is building; no size limit change.

kayg commented

2026-10-08 03:56:16 +00:00

Author

Owner

Run7 measurement finding: new exact50MiB RTT300 diagnostic timed out at90s, not a crypto regression. ConnectionStats show client8819lost packets/33767sent, server24858received, RTT303.3ms. Existing userspace UDP relay releases many delayed sends on one current-thread reactor; testing burst delivery/socket capacity before using its throughput results. One earlier transfer completed61.65s with exact bytes, but subsequent deadline failures invalidate a clean-link throughput comparison. Production transport, BBR/window limits and all gates unchanged. Logs in HOME-cache run7/ring-bulk-stats.txt.

kayg commented

2026-10-08 04:13:28 +00:00

Author

Owner

Run7 size finding: static-musl cargo bloat against dev e19c4eb gives .text 10.8→12.9 MiB; Quinn-proto +431.4 KiB, Rustls +352.6, ring +243.9 Rust KiB plus native symbols, server 545.0→682.8, daemon 88.9→249.5, std ~1.0→1.3 MiB, Tokio319.1→448.1. ELF deltas: code+2,267,752, rodata+292,416, unwind+197,516 bytes. cargo tree -d has no duplicate Quinn/Rustls/OpenSSL versions. Stock Quinn forces Rustls and ring for Retry/reset/token code. Measured reuse candidate rustls-openssl0.4.2 (same existing OpenSSL, defaults/PQ disabled, same cipher/group order) saves394,528 stripped x86 bytes, insufficient for +1.5MB. Rejected for D41 performance: repeated 1,000-pair CPU ring97/94 ticks vs OpenSSL182/193; RTT300 QUIC p99 ring456.361/456.465ms vs457.798/458.998ms. Local50MiB candidate faster; RTT300 exact50MiB ring76.57s vs candidate74.62s, but relay retransmits, not clean-link throughput evidence. RSS delta/1,000 pairs ring67,680/67,724KiB vs candidate60,688/60,648. Low load .09–.18 on8cores, CPUWeight10000, release tests. No provider/foundation change retained. New QUIC backend or maintained crypto fork requires owner choice; runtime calls also make shared actor/Tokio/std code reachable. Raw logs in HOME cache run7; will cite under docs/verification with justified baseline commit.

Run7 size finding: static-musl cargo bloat against dev e19c4eb gives .text 10.8→12.9 MiB; Quinn-proto +431.4 KiB, Rustls +352.6, ring +243.9 Rust KiB plus native symbols, server 545.0→682.8, daemon 88.9→249.5, std ~1.0→1.3 MiB, Tokio319.1→448.1. ELF deltas: code+2,267,752, rodata+292,416, unwind+197,516 bytes. cargo tree -d has no duplicate Quinn/Rustls/OpenSSL versions. Stock Quinn forces Rustls and ring for Retry/reset/token code. Measured reuse candidate rustls-openssl0.4.2 (same existing OpenSSL, defaults/PQ disabled, same cipher/group order) saves394,528 stripped x86 bytes, insufficient for +1.5MB. Rejected for D41 performance: repeated 1,000-pair CPU ring97/94 ticks vs OpenSSL182/193; RTT300 QUIC p99 ring456.361/456.465ms vs457.798/458.998ms. Local50MiB candidate faster; RTT300 exact50MiB ring76.57s vs candidate74.62s, but relay retransmits, not clean-link throughput evidence. RSS delta/1,000 pairs ring67,680/67,724KiB vs candidate60,688/60,648. Low load .09–.18 on8cores, CPUWeight10000, release tests. No provider/foundation change retained. New QUIC backend or maintained crypto fork requires owner choice; runtime calls also make shared actor/Tokio/std code reachable. Raw logs in HOME cache run7; will cite under docs/verification with justified baseline commit.

kayg commented

2026-10-08 04:17:07 +00:00

Author

Owner

Canonical locked release artifacts remain x86 18,982,128 / ARM15,934,232 bytes, static/stripped, after rejecting the slower OpenSSL provider. Proposed authorized baseline-only change records those exact values with the unchanged262,144-byte allowance: maxima19,244,272 /16,196,376. Growth over old baselines2,839,456 /2,378,560. This exceeds the requested target: stock-provider reuse saves only394,528, retains mandatory Rustls+ring Quinn machinery, and nearly doubles repeated connection CPU. No release setting, timing budget or engine changed. Breakdown and raw proof saved in docs/verification/remote-agents-run7-size.md and cited run7 logs. Isolated exact baseline source excludes inherited feature work; full fast gate now running before its own commit. Subsequent implementation commits get separate full gates.

kayg commented

2026-10-08 04:21:33 +00:00

Author

Owner

Orchestrator note: the +2.8 MB growth is an owner decision (binary size is a standing owner priority). Options put to the owner in the morning: (a) accept, (b) measure OpenSSL 3.6 native QUIC instead of quinn (no second crypto stack; foundational transport change), (c) TCP+TLS only for the demo, QUIC later. Do not merge a baseline raise to dev before the owner answers; keeping it on this branch is fine.

kayg commented

2026-10-08 04:24:38 +00:00

Author

Owner

Run7 completed step: baseline/evidence-only commit 33bd23a255. Exact isolated full fast gate exit0; no feature source included. Baselines18,982,128 /15,934,232; allowance unchanged262,144. Per-crate comparison, rejected provider CPU regression and target miss are in docs/verification/remote-agents-run7-size.md with cited logs. Gate summary verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.30s]

kayg commented

2026-10-08 04:30:18 +00:00

Author

Owner

Run7 completed dependency step a4d1c653e1: add only server dev access to existing Hyper/Hyper-util (2 manifest +2 lockfile lines); no new versions/provider/production features. Exact full fast gate exit0, all Rust rows PASS, TS7pass/0fail and134streams/11,439schedules/zero divergences. Static x86 16,146,032 /ARM13,573,104 bytes. Full log retained for final verification report. Next: operator join adapter, then coupled host admission/actor/browser routing.

Run7 completed dependency step a4d1c653e1e36b8dabb5a2d670963c8eddf34d9e: add only server dev access to existing Hyper/Hyper-util (2 manifest +2 lockfile lines); no new versions/provider/production features. Exact full fast gate exit0, all Rust rows PASS, TS7pass/0fail and134streams/11,439schedules/zero divergences. Static x86 16,146,032 /ARM13,573,104 bytes. Full log retained for final verification report. Next: operator join adapter, then coupled host admission/actor/browser routing.

kayg commented

2026-10-08 04:38:50 +00:00

Author

Owner

Run7 completed operator slice baf36bb226: private-stdin agent join/run, local Ed25519 key, pinned HTTPS, bounded reads, uid/mode validation, private fsynced atomic no-replace identity, existing outgoing QUIC/TCP supervisor. Exact full fast gate exit0, Rust6/6PASS, TS7pass/0fail. Static rows verbatim:

PT_INTERP: absent; size: 18619376 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15607144 bytes (baseline 15934232 + allowance 262144 = max 16196376)

Default CLI server CA/enrollment wiring and live renewal/removal remain absent; next slice supplies configured running-server routing. Existing join pin also requires enrollment HTTPS under its invitation CA, per contracts/remote.md; independently issued browser-facing HTTPS needs explicit trust integration, never verification bypass.

Run7 completed operator slice baf36bb226e824d85561324b97bfa86711d91210: private-stdin agent join/run, local Ed25519 key, pinned HTTPS, bounded reads, uid/mode validation, private fsynced atomic no-replace identity, existing outgoing QUIC/TCP supervisor. Exact full fast gate exit0, Rust6/6PASS, TS7pass/0fail. Static rows verbatim: ``` PT_INTERP: absent; size: 18619376 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15607144 bytes (baseline 15934232 + allowance 262144 = max 16196376) ``` Default CLI server CA/enrollment wiring and live renewal/removal remain absent; next slice supplies configured running-server routing. Existing join pin also requires enrollment HTTPS under its invitation CA, per contracts/remote.md; independently issued browser-facing HTTPS needs explicit trust integration, never verification bypass.

kayg referenced this issue

2026-10-08 04:50:08 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg commented

2026-10-08 04:50:48 +00:00

Author

Owner

Run7 completed configured server routing ac03ab05ab: QUIC/TCP listeners, durable certificate-ledger admission, one retained actor/host, enrolled execution uid, stable server writer binding, durable host ownership at browser open/publication/reattach. Transport bridge/registry/actor/WebSocket private modules form one coupled source integration; no unused public scaffolding. Exact fast gate exit0, all6Rust rowsPASS, TS7pass/0fail and zero differential divergences. Static rows verbatim:

PT_INTERP: absent; size: 18982128 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15934232 bytes (baseline 15934232 + allowance 262144 = max 16196376)

Initial staging attempt caught an unused test-only refuse_quic helper (Clippy); moved it to the separate fixture step and reran full green. Source alone uses serve_with_remote; normal CLI server CA/admin-envelope integration and phase1 renewal/removal/lease still incomplete. Rootless identity path added to #34 table. Next: restore/register real transport and two-process/browser proof fixtures; no o1 contact.

Run7 completed configured server routing ac03ab05ab47532a62ca6acf78620c672b30075f: QUIC/TCP listeners, durable certificate-ledger admission, one retained actor/host, enrolled execution uid, stable server writer binding, durable host ownership at browser open/publication/reattach. Transport bridge/registry/actor/WebSocket private modules form one coupled source integration; no unused public scaffolding. Exact fast gate exit0, all6Rust rowsPASS, TS7pass/0fail and zero differential divergences. Static rows verbatim: ``` PT_INTERP: absent; size: 18982128 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15934232 bytes (baseline 15934232 + allowance 262144 = max 16196376) ``` Initial staging attempt caught an unused test-only refuse_quic helper (Clippy); moved it to the separate fixture step and reran full green. Source alone uses serve_with_remote; normal CLI server CA/admin-envelope integration and phase1 renewal/removal/lease still incomplete. Rootless identity path added to #34 table. Next: restore/register real transport and two-process/browser proof fixtures; no o1 contact.

kayg commented

2026-10-08 04:54:31 +00:00

Author

Owner

Run7 local proof (new fixture source, production static ac03ab0 CLI): real running server + separate rootless infraternal agent + PTY; QUIC join→terminal108,918us, command echo7,086us, 337 contiguous output bytes. Foreign owner denied without creating session. Full daemon idle13,384KiB RSS,0scheduler activations/10.001s,2threads (n1; extrapolation at1,000=13,384,000KiB, not measured fleet). Production Ghostty real-browser desktop/iPhone n25 glyphp50/p99 15.00/17.80ms and14.40/29.70ms; p99 over17ms remains visible. Three durable independent writers all ACKed. Daemon restart:688,031us absence,33,593us recovery,1,313 contiguous bytes,1surviving shim, final authenticated cleanup asserts0shims. Server harness debug / CLI static optimized; localhostRTT0,8cores/load.40–.44. Source paths remote_demo_tests.rs and scripts/verify-remote-browser.mjs; raw demo-quic-browser.log in run7 cache, screenshots evidence/remote-agents/screenshots/run7-real-remote-{desktop,iphone}.png, will move cited proof under docs/verification. Five identity security tests and both real TLS/QUIC actor regressions pass. Forced TCP proof and exact full fast fixture gate next; no claim of default CLI CA integration or full phase1 completion.

Run7 local proof (new fixture source, production static ac03ab0 CLI): real running server + separate rootless infraternal agent + PTY; QUIC join→terminal108,918us, command echo7,086us, 337 contiguous output bytes. Foreign owner denied without creating session. Full daemon idle13,384KiB RSS,0scheduler activations/10.001s,2threads (n1; extrapolation at1,000=13,384,000KiB, not measured fleet). Production Ghostty real-browser desktop/iPhone n25 glyphp50/p99 15.00/17.80ms and14.40/29.70ms; p99 over17ms remains visible. Three durable independent writers all ACKed. Daemon restart:688,031us absence,33,593us recovery,1,313 contiguous bytes,1surviving shim, final authenticated cleanup asserts0shims. Server harness debug / CLI static optimized; localhostRTT0,8cores/load.40–.44. Source paths remote_demo_tests.rs and scripts/verify-remote-browser.mjs; raw demo-quic-browser.log in run7 cache, screenshots evidence/remote-agents/screenshots/run7-real-remote-{desktop,iphone}.png, will move cited proof under docs/verification. Five identity security tests and both real TLS/QUIC actor regressions pass. Forced TCP proof and exact full fast fixture gate next; no claim of default CLI CA integration or full phase1 completion.

kayg commented

2026-10-08 05:06:46 +00:00

Author

Owner

Run7 completed local verification slice bed97b3fda: five operator security tests, two real TLS/QUIC actor tests, real server + separate rootless static CLI + PTY, production desktop/iPhone browser tool, ignored exact50MiB transport diagnostic. QUIC/TCP join108.918/225.479ms; echo7.086/5.572ms; local restart33.593/133.751ms. Full daemon idle13,384/12,980KiB and0activations/10s, n1each; cleanup asserts0shims. New proof logs/screenshots cited and committed under docs/verification/remote-agents/run7-*. Exact full fast gate exit0, all6Rust rowsPASS, TS7pass/0fail,134streams/11439schedules/zero divergences. Static18,982,128 /15,934,232bytes. Browser glyphp9917.8/29.7ms exceeds17ms; screenshots await human review. Default CLI CA/passkey envelope integration remains incomplete; configured-server local path proven. Starting full production browser suite port4701 without own build/perf overlap. No o1/o2 contact; o1 IP/alias/:22 absent from default known_hosts, so owner fingerprint confirmation blocks the real-host step per run7 instruction.

Run7 completed local verification slice bed97b3fdaa03b3825e71169be4b2a12aeca00fd: five operator security tests, two real TLS/QUIC actor tests, real server + separate rootless static CLI + PTY, production desktop/iPhone browser tool, ignored exact50MiB transport diagnostic. QUIC/TCP join108.918/225.479ms; echo7.086/5.572ms; local restart33.593/133.751ms. Full daemon idle13,384/12,980KiB and0activations/10s, n1each; cleanup asserts0shims. New proof logs/screenshots cited and committed under docs/verification/remote-agents/run7-*. Exact full fast gate exit0, all6Rust rowsPASS, TS7pass/0fail,134streams/11439schedules/zero divergences. Static18,982,128 /15,934,232bytes. Browser glyphp9917.8/29.7ms exceeds17ms; screenshots await human review. Default CLI CA/passkey envelope integration remains incomplete; configured-server local path proven. Starting full production browser suite port4701 without own build/perf overlap. No o1/o2 contact; o1 IP/alias/:22 absent from default known_hosts, so owner fingerprint confirmation blocks the real-host step per run7 instruction.

kayg commented

2026-10-08 05:23:38 +00:00

Author

Owner

Owner answers (2026-10-08): (6) the +2.8 MB for quinn/rustls/ring is accepted (D173): commit the baseline raise with the per-crate breakdown. (4) o1 host key: nobody else has logged in to o1, so trusting its current key on first use is authorised by the owner: record the fingerprint on this issue when you pin it, then run the o1 proof.

kayg referenced this issue

2026-10-08 05:29:40 +00:00

Measure QUIC stacks: quinn+rustls+ring vs OpenSSL native QUIC #88

kayg commented

2026-10-08 05:33:02 +00:00

Author

Owner

Run7 full browser port4701 exits1:47passed/21skipped/6failed(13.9m), CPUWeight10000/no own build-perf overlap. Exact six failures all reproduce on archived dev e19c4eb under the same scope/port. Tooltip169vs190px both; glyph/bar alignment failsDPR1/2/3 both; reconnectp99 branch978.7/dev995.3ms vs900; setup upper-paintp991563.7/1533.7ms, signin1850.0/1859.8ms vs1000. Tracer/UI/protocol/proxy source diff againstdev is empty; Node browser test double does not run the new Rust remote service. No assertions, thresholds or UI files changed. Logs preserved under docs/verification/remote-agents/run7-browser-{full,dev-comparison}.log; report remote-agents-run7.md records red gate explicitly. Final docs-only fast gate running. Real-host step blocked: default ~/.ssh/known_hosts contains0matching entries for10.69.69.51/o1/[10.69.69.51]:22; kayg must confirm/provision trusted fingerprint before o1 contact per run7 instructions. No host-key scan, SSH, o1/o2 install, push or deploy. Phase1 and normal CLI CA/admin-envelope startup integration remain incomplete; configured-server two-process path is committed/proven.

Run7 full browser port4701 exits1:47passed/21skipped/6failed(13.9m), CPUWeight10000/no own build-perf overlap. Exact six failures all reproduce on archived dev e19c4eb under the same scope/port. Tooltip169vs190px both; glyph/bar alignment failsDPR1/2/3 both; reconnectp99 branch978.7/dev995.3ms vs900; setup upper-paintp991563.7/1533.7ms, signin1850.0/1859.8ms vs1000. Tracer/UI/protocol/proxy source diff againstdev is empty; Node browser test double does not run the new Rust remote service. No assertions, thresholds or UI files changed. Logs preserved under docs/verification/remote-agents/run7-browser-{full,dev-comparison}.log; report remote-agents-run7.md records red gate explicitly. Final docs-only fast gate running. Real-host step blocked: default ~/.ssh/known_hosts contains0matching entries for10.69.69.51/o1/[10.69.69.51]:22; kayg must confirm/provision trusted fingerprint before o1 contact per run7 instructions. No host-key scan, SSH, o1/o2 install, push or deploy. Phase1 and normal CLI CA/admin-envelope startup integration remain incomplete; configured-server two-process path is committed/proven.

kayg commented

2026-10-08 05:46:17 +00:00

Author

Owner

Run7 handoff head 86f559b68a, branch remote-agents (start0c72688; dev e19c4eb already merged). Six separately gated commits:33bd23a measured baseline, a4d1c65 dev dependencies, baf36bb operator adapter, ac03ab0 configured server routing, bed97b3 real-engine fixtures,86f559b evidence/docs. No push/deploy/merge back or o1/o2 contact.

Size investigation and rejected OpenSSL-reuse candidate are in docs/verification/remote-agents-run7-size.md: saving394,528bytes but repeated1,000-pair CPU97/94→182/193ticks, target miss remains explained. Actual static binaries18,982,128 /15,934,232bytes; unchanged256KiB allowance. No provider/engine/profile change retained.

Configured local server + rootless static CLI + real PTY/production browser proof passes: QUIC/TCP join108.918/225.479ms, command echo7.086/5.572ms, local process recovery33.593/133.751ms; three independent writers; contiguous offsets; cleanup0shims. IdleRSS13,384/12,980KiB and0scheduler activations/10s (n1, not a fleet measurement). RTT300 n25 handshakesQUIC454.630/456.372ms p50/p99, TCP758.136/760.225; retained1,000combined endpoint pairs67,712/69,964KiB delta. Live renewal cost remains unmeasured.

Production browser gate RED:47passed/21skipped/6failed(13.9m); all6fail on same-scope dev e19c4eb comparison, frontend/proxy source diff empty. Report includes tooltip/glyph geometry, reconnect978.7vs995.3ms (900budget), first-paint failures and logs; no assertions weakened. Actual remote-browser glyphp9917.8/29.7ms also exceeds17ms. Screenshots attached under docs/verification/remote-agents/run7-real-remote-{desktop,iphone}.png for human review.

Stop condition: no trusted known_hosts record for o1 IP/alias/:22; owner kayg must confirm/provision fingerprint before real-host proof. No key scan or unknown-key acceptance. PHASE1 INCOMPLETE: normal CLI CA/admin-envelope startup wiring, encrypted CA persistence/role rewrap/notification/rotation, live renewal, active revocation/removal/uninstall, integrated lease and o1/o2 chaos still required. Configured-service local runtime only is proven. Untracked remote_lease.rs remains unregistered; .scratch/evidence/target inherited state is out of commits. Completed run7 comparison checkout/provider backups/copied binaries removed; inherited unfinished-job build cache retained. Ports4701/4702 no longer listen.

Full raw gates and resume state: docs/verification/remote-agents-run7.md and cited run7-gate-*.log. Final requested Nix fast gate under CPUWeight10000/TRACER_TEST_PORT4701 exits0. Gate summary verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.24s]

Run7 handoff head 86f559b68addff6cbec3436f1553080b4c7d2b3f, branch remote-agents (start0c72688; dev e19c4eb already merged). Six separately gated commits:33bd23a measured baseline, a4d1c65 dev dependencies, baf36bb operator adapter, ac03ab0 configured server routing, bed97b3 real-engine fixtures,86f559b evidence/docs. No push/deploy/merge back or o1/o2 contact. Size investigation and rejected OpenSSL-reuse candidate are in docs/verification/remote-agents-run7-size.md: saving394,528bytes but repeated1,000-pair CPU97/94→182/193ticks, target miss remains explained. Actual static binaries18,982,128 /15,934,232bytes; unchanged256KiB allowance. No provider/engine/profile change retained. Configured local server + rootless static CLI + real PTY/production browser proof passes: QUIC/TCP join108.918/225.479ms, command echo7.086/5.572ms, local process recovery33.593/133.751ms; three independent writers; contiguous offsets; cleanup0shims. IdleRSS13,384/12,980KiB and0scheduler activations/10s (n1, not a fleet measurement). RTT300 n25 handshakesQUIC454.630/456.372ms p50/p99, TCP758.136/760.225; retained1,000combined endpoint pairs67,712/69,964KiB delta. Live renewal cost remains unmeasured. Production browser gate RED:47passed/21skipped/6failed(13.9m); all6fail on same-scope dev e19c4eb comparison, frontend/proxy source diff empty. Report includes tooltip/glyph geometry, reconnect978.7vs995.3ms (900budget), first-paint failures and logs; no assertions weakened. Actual remote-browser glyphp9917.8/29.7ms also exceeds17ms. Screenshots attached under docs/verification/remote-agents/run7-real-remote-{desktop,iphone}.png for human review. Stop condition: no trusted known_hosts record for o1 IP/alias/:22; owner kayg must confirm/provision fingerprint before real-host proof. No key scan or unknown-key acceptance. PHASE1 INCOMPLETE: normal CLI CA/admin-envelope startup wiring, encrypted CA persistence/role rewrap/notification/rotation, live renewal, active revocation/removal/uninstall, integrated lease and o1/o2 chaos still required. Configured-service local runtime only is proven. Untracked remote_lease.rs remains unregistered; .scratch/evidence/target inherited state is out of commits. Completed run7 comparison checkout/provider backups/copied binaries removed; inherited unfinished-job build cache retained. Ports4701/4702 no longer listen. Full raw gates and resume state: docs/verification/remote-agents-run7.md and cited run7-gate-*.log. Final requested Nix fast gate under CPUWeight10000/TRACER_TEST_PORT4701 exits0. Gate summary verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.24s] ```

kayg commented

2026-10-08 05:48:26 +00:00

Author

Owner

Run8 started, sole writer on remote-agents at 86f559b; original base fca6e093d8. Read #78 history, parent #5 and repo contracts/process. Continuing authorised o1 TOFU pin + rootless proof first, then D168 normal CLI startup/lifecycle. Inherited .scratch/evidence/target and unregistered remote_lease.rs preserved outside commits. No push, deploy or merge.

Run8 started, sole writer on remote-agents at 86f559b; original base fca6e093d8d07524e5f7014d0e9d730781f24239. Read #78 history, parent #5 and repo contracts/process. Continuing authorised o1 TOFU pin + rootless proof first, then D168 normal CLI startup/lifecycle. Inherited .scratch/evidence/target and unregistered remote_lease.rs preserved outside commits. No push, deploy or merge.

kayg commented

2026-10-08 05:48:38 +00:00

Author

Owner

Authorised o1 first-use key pin fetched with ssh-keyscan over 10.69.69.51 NetBird route: ED25519 SHA256:uMAQHBbZ/cuo8T3nCMhAu30Y2XPSenXqlLYkSiJF9ww. Pinned in job-specific run8/known_hosts, strict host checking remains enabled. No global known_hosts edit. Next rootless probe/upload/proof/cleanup.

kayg commented

2026-10-08 05:48:45 +00:00

Author

Owner

Independent defensive review started: remote-agents head 86f559b68a (detached read-only review-remote), diff base e19c4eb4f2. Reading all #78 and parent #5 history, contracts and owner decisions. Experiments isolated in HOME cache review-remote/checkout; no changes to reviewed source, push, deploy or host contact. Tests CPUWeight=10000, TRACER_TEST_PORT=4748. Findings recorded in ~/.local/state/codex-jobs/infraternal/review-remote/findings.md.

Independent defensive review started: remote-agents head 86f559b68addff6cbec3436f1553080b4c7d2b3f (detached read-only review-remote), diff base e19c4eb4f2ecc16d82b7b03441df431d1b75da8b. Reading all #78 and parent #5 history, contracts and owner decisions. Experiments isolated in HOME cache review-remote/checkout; no changes to reviewed source, push, deploy or host contact. Tests CPUWeight=10000, TRACER_TEST_PORT=4748. Findings recorded in ~/.local/state/codex-jobs/infraternal/review-remote/findings.md.

kayg commented

2026-10-08 05:52:42 +00:00

Author

Owner

Independent review R2 — P1 — No live renewal path; enrolled hosts become stranded after seven days

Locations: crates/infraternal-agent/src/remote_client.rs:37, crates/infraternal-agent/src/daemon.rs:286, crates/infraternal-server/src/remote_enrollment.rs:74, crates/infraternal/src/remote.rs:244.

Scenario: run an enrolled host longer than the seven-day leaf lifetime. The outgoing supervisor only dials and dispatches terminals. It never schedules a half-life deadline, generates/sends a renewal CSR, installs a replacement certificate, or updates trust. RemoteEnrollment::renew exists only as a callable library boundary and unit test; no live control action invokes it. On the first reconnect after expiry, both TLS stacks refuse the expired leaf, and the supervisor retries the same static identity forever. While the connection stays open, R1's missing authority-expiry enforcement masks this outage. D133/D168 and the certificate-lifetime contract require renewal over the live authenticated control stream and atomic local publication. Evidence is call-site/source inspection; no claim of a seven-day wall-clock test.

Review target 86f559b; this is a P1 completion blocker for phase-one merge. Source remains unchanged.

Independent review R2 — P1 — No live renewal path; enrolled hosts become stranded after seven days Locations: `crates/infraternal-agent/src/remote_client.rs:37`, `crates/infraternal-agent/src/daemon.rs:286`, `crates/infraternal-server/src/remote_enrollment.rs:74`, `crates/infraternal/src/remote.rs:244`. Scenario: run an enrolled host longer than the seven-day leaf lifetime. The outgoing supervisor only dials and dispatches terminals. It never schedules a half-life deadline, generates/sends a renewal CSR, installs a replacement certificate, or updates trust. `RemoteEnrollment::renew` exists only as a callable library boundary and unit test; no live control action invokes it. On the first reconnect after expiry, both TLS stacks refuse the expired leaf, and the supervisor retries the same static identity forever. While the connection stays open, R1's missing authority-expiry enforcement masks this outage. D133/D168 and the certificate-lifetime contract require renewal over the live authenticated control stream and atomic local publication. Evidence is call-site/source inspection; no claim of a seven-day wall-clock test. Review target 86f559b; this is a P1 completion blocker for phase-one merge. Source remains unchanged.

kayg commented

2026-10-08 05:52:43 +00:00

Author

Owner

Independent review R3 — P1 — Shipping server cannot enable remote enrollment or D168 CA unlock

Locations: crates/infraternal/src/main.rs:174, crates/infraternal-server/src/runtime.rs:182, crates/infraternal-server/src/ca_memory.rs:58.

Scenario: start the actual configured infraternal server binary. It always calls serve, which injects no enrollment source and no remote service. There is no server CLI/configuration adapter for encrypted CA state, administrator passkey unwrapping/role rewrap, or remote transport identity. The enrollment routes and host listeners are enabled only by programmatic serve_with_remote; production source has no caller, and the proofs construct a memory-only test signer. Consequently /remote/invitations and /remote/join are absent from the shipping server, and a cold-start administrator cannot unlock a production CA. This blocks the advertised operator join and the D168 contract. The in-memory lock abstraction itself fails closed; this finding concerns the absent production integration, not a demonstrated secret leak. Test case: start configured release CLI, complete authenticated owner setup, and require the bounded remote invitation route plus cold-locked enrollment rejection followed by administrator passkey unlock. Static call-site evidence already establishes the absent registration; runtime test pending where practical.

Review target 86f559b; this is a P1 completion blocker for phase-one merge. Source remains unchanged.

Independent review R3 — P1 — Shipping server cannot enable remote enrollment or D168 CA unlock Locations: `crates/infraternal/src/main.rs:174`, `crates/infraternal-server/src/runtime.rs:182`, `crates/infraternal-server/src/ca_memory.rs:58`. Scenario: start the actual configured `infraternal server` binary. It always calls `serve`, which injects no enrollment source and no remote service. There is no server CLI/configuration adapter for encrypted CA state, administrator passkey unwrapping/role rewrap, or remote transport identity. The enrollment routes and host listeners are enabled only by programmatic `serve_with_remote`; production source has no caller, and the proofs construct a memory-only test signer. Consequently `/remote/invitations` and `/remote/join` are absent from the shipping server, and a cold-start administrator cannot unlock a production CA. This blocks the advertised operator join and the D168 contract. The in-memory lock abstraction itself fails closed; this finding concerns the absent production integration, not a demonstrated secret leak. Test case: start configured release CLI, complete authenticated owner setup, and require the bounded remote invitation route plus cold-locked enrollment rejection followed by administrator passkey unlock. Static call-site evidence already establishes the absent registration; runtime test pending where practical. Review target 86f559b; this is a P1 completion blocker for phase-one merge. Source remains unchanged.

kayg commented

2026-10-08 05:53:07 +00:00

Author

Owner

o1 proof finding: pinned SSH, aarch64 static upload+SHA256 verification and cleanup pass, but o1 cannot TCP-connect to infraternal-dev 10.69.69.125:4701 (rootless Python socket timeout at 3s while fixture listen was confirmed by ss). Two join runs fail 10s host-admission deadline; both cleanup checks report processes=0/data_absent=true/state_absent=true. No keys/state left on o1. Need owner network/ACL reachability for TCP4701 and TCP+UDP7443, or approval for a monitor01 scratch server (never production) per job. Continuing independent D168 startup work; no host terminal proof claimed.

kayg commented

2026-10-08 05:55:19 +00:00

Author

Owner

D168 startup additive proposal: normal CLI gets explicit --remote-listen plus public CA directory (XDG infraternal/ca by default). Load retained issuer.pem without signing material; reuse configured server TLS leaf/key, validate its hostname/serverAuth chain against retained issuer before exposing enrollment and mTLS listeners. Construct cold-locked MemoryCaSource; existing ledger-admitted hosts reconnect while enrollment/renewal stay locked. Never regenerate missing CA or infer administrator authority from owner. Existing opaque in-memory handoff remains the automatic-update interface. This is the public-trust startup slice; encrypted administrator envelopes, fresh passkey unlock and role rewrap remain separate required work. Behind-proxy enrollment with a different HTTPS issuer needs separate trust integration, not verification bypass.

kayg commented

2026-10-08 05:56:01 +00:00

Author

Owner

Independent review R1 — P1 — Durable revocation does not cancel live terminal authority

Locations: crates/infraternal-server/src/remote_authority.rs:95, crates/infraternal-server/src/remote_runtime.rs:35, crates/infraternal-server/src/embedded.rs:484, crates/infraternal-server/src/websocket.rs:1280.

Scenario: enroll a host, connect using mutual TLS and attach a terminal. The owner revokes the host. revoke writes only the SQLite tombstone. The existing host actor retains its admitted transport and attachments; neither it nor browser input forwarding subscribes to host revocation. Browser authentication changes are a separate signal. A revoked host can continue receiving terminal input and supplying output indefinitely. New browser opens/attachments do consult the host tombstone, which does not protect already attached sessions. D134 and remote contract require immediate live cancellation. The same retained actor also drops the admitted certificate fingerprint/expiry: expiry cannot revoke its authority or stop automatic reattachment. Regression prepared in review_runtime_tests.rs; execution pending baseline build. Expiry test explicitly simulates expiry in the public ledger, rather than waiting seven days.

Review target 86f559b. Code inspection confirms no live cancellation hook; a real TLS regression is queued behind the fuzz build.

Independent review R1 — P1 — Durable revocation does not cancel live terminal authority Locations: `crates/infraternal-server/src/remote_authority.rs:95`, `crates/infraternal-server/src/remote_runtime.rs:35`, `crates/infraternal-server/src/embedded.rs:484`, `crates/infraternal-server/src/websocket.rs:1280`. Scenario: enroll a host, connect using mutual TLS and attach a terminal. The owner revokes the host. `revoke` writes only the SQLite tombstone. The existing host actor retains its admitted transport and attachments; neither it nor browser input forwarding subscribes to host revocation. Browser authentication changes are a separate signal. A revoked host can continue receiving terminal input and supplying output indefinitely. New browser opens/attachments do consult the host tombstone, which does not protect already attached sessions. D134 and remote contract require immediate live cancellation. The same retained actor also drops the admitted certificate fingerprint/expiry: expiry cannot revoke its authority or stop automatic reattachment. Regression prepared in `review_runtime_tests.rs`; execution pending baseline build. Expiry test explicitly simulates expiry in the public ledger, rather than waiting seven days. Review target 86f559b. Code inspection confirms no live cancellation hook; a real TLS regression is queued behind the fuzz build.

kayg commented

2026-10-08 06:01:55 +00:00

Author

Owner

Reachability isolated from TLS: rootless dev listeners simultaneously bound 10.69.69.125:4701 and :7443; pinned o1 Python TCP probes report 4701 unreachable 3006ms and 7443 unreachable 3003ms. Listeners removed after 15s. Therefore changing CA/handshake deadlines cannot fix this path. o1 has zero test installations/processes; waiting for owner network path while preparing independent cold-public-trust startup slice.

kayg commented

2026-10-08 06:03:18 +00:00

Author

Owner

Independent review confirmation at 86f559b: real configured listener + SQLite + TCP/mTLS reproduces R1. After durable revocation, store.admit denies the same certificate but the existing host receives 12 bytes of terminal input (after-revoke). Simulated public-ledger expiry likewise denies admission but permits a new retained-actor attachment. R3 default production-router join request returns HTTP404. Three expected security/completion assertions fail, two existing review tests pass,3.66s. Evidence ~/.local/state/codex-jobs/infraternal/review-remote/{regressions.log,review_runtime_tests.rs,review_cli_route_tests.rs}; no reviewed-worktree edits.

Independent review confirmation at 86f559b: real configured listener + SQLite + TCP/mTLS reproduces R1. After durable revocation, store.admit denies the same certificate but the existing host receives 12 bytes of terminal input (after-revoke). Simulated public-ledger expiry likewise denies admission but permits a new retained-actor attachment. R3 default production-router join request returns HTTP404. Three expected security/completion assertions fail, two existing review tests pass,3.66s. Evidence ~/.local/state/codex-jobs/infraternal/review-remote/{regressions.log,review_runtime_tests.rs,review_cli_route_tests.rs}; no reviewed-worktree edits.

kayg commented

2026-10-08 06:04:54 +00:00

Author

Owner

Independent security checks at 86f559b: TCP/mTLS rejects missing client certificate and wrong clientAuth EKU; QUIC rejects foreign issuer and wrong clientAuth EKU (2 tests,4 cases,PASS,0.04s). CSR tests6/6 and real SQLite concurrent-redemption1/1 PASS. Scratch-only sensitivity mutations: bypassing DER preflight makes signed_cached_noncanonical_or_incomplete_shapes_are_refused FAIL(exit101,0.01s); removing consumed_at IS NULL makes concurrent_redemption_has_one_winner_and_one_certificate FAIL(exit101,0.08s). Both restored. ASan CSR fuzz smoke:1,316,173 executions/31s,no crash,seeded valid public Ed25519 CSR. Logs/source/patch retained in ~/.local/state/codex-jobs/infraternal/review-remote/. Writer-binding fuzz and final untouched fast gate next.

Independent security checks at 86f559b: TCP/mTLS rejects missing client certificate and wrong clientAuth EKU; QUIC rejects foreign issuer and wrong clientAuth EKU (2 tests,4 cases,PASS,0.04s). CSR tests6/6 and real SQLite concurrent-redemption1/1 PASS. Scratch-only sensitivity mutations: bypassing DER preflight makes signed_cached_noncanonical_or_incomplete_shapes_are_refused FAIL(exit101,0.01s); removing consumed_at IS NULL makes concurrent_redemption_has_one_winner_and_one_certificate FAIL(exit101,0.08s). Both restored. ASan CSR fuzz smoke:1,316,173 executions/31s,no crash,seeded valid public Ed25519 CSR. Logs/source/patch retained in ~/.local/state/codex-jobs/infraternal/review-remote/. Writer-binding fuzz and final untouched fast gate next.

kayg commented

2026-10-08 06:07:52 +00:00

Author

Owner

Completed pinned o1 opt-in harness/cleanup step at 7bb98ef4ab; real-host proof remains BLOCKED by direct TCP4701/7443 reachability. Key fingerprint and four rootless cleanup observations are in docs/verification/remote-agents/run8-o1-network.log; current preflight rejects before issuing an invitation. No o1 state/processes remain. Full exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exits0; full log docs/verification/remote-agents/run8-gate-host-harness.log. Static production binaries unchanged; no threshold change. Verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.03s]

Completed pinned o1 opt-in harness/cleanup step at 7bb98ef4abfc16147daff232ad202d3ab91be59a; real-host proof remains BLOCKED by direct TCP4701/7443 reachability. Key fingerprint and four rootless cleanup observations are in docs/verification/remote-agents/run8-o1-network.log; current preflight rejects before issuing an invitation. No o1 state/processes remain. Full exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exits0; full log docs/verification/remote-agents/run8-gate-host-harness.log. Static production binaries unchanged; no threshold change. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.03s]

kayg commented

2026-10-08 06:09:18 +00:00

Author

Owner

Cold-public-trust startup module targeted tests pass 3/3 in0.02s with real OpenSSL: correct chain/name/key loads public trust but signing stays locked across cold starts; missing issuer never regenerates; wrong issuer/key/name, unpinned reverse-proxy mode, symlink/shared/oversized/FIFO trust files fail closed. No CA private key written. Explicit issuer self-signature check covers trust-anchor verification, which OpenSSL leaf verification need not perform. Module source and tests will be separately gated commits; CLI activation follows. This does not yet implement administrator envelope/unlock/rotation or lifecycle.

kayg referenced this issue

2026-10-08 06:09:33 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg referenced this issue

2026-10-08 06:09:47 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg commented

2026-10-08 06:30:47 +00:00

Author

Owner

Completed public-trust startup source at 1b4e140e2e. Retained issuer.pem/private metadata and TLS key/name/serverAuth chain are validated; signing remains cold-locked, missing CA never regenerates. CLI activation and administrator envelopes/unlock remain pending. Layout row posted on #34. Exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exits0; x86/ARM unchanged18,982,128/15,934,232bytes, no PT_INTERP. Load reached33.13/26.06/17.83; no latency certification. Full log docs/verification/remote-agents/run8-gate-startup-source.log. Verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.34s]

Completed public-trust startup source at 1b4e140e2e7d42c6100d70fa5f8e2fda5b6773b5. Retained issuer.pem/private metadata and TLS key/name/serverAuth chain are validated; signing remains cold-locked, missing CA never regenerates. CLI activation and administrator envelopes/unlock remain pending. Layout row posted on #34. Exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exits0; x86/ARM unchanged18,982,128/15,934,232bytes, no PT_INTERP. Load reached33.13/26.06/17.83; no latency certification. Full log docs/verification/remote-agents/run8-gate-startup-source.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.34s]

kayg commented

2026-10-08 06:38:38 +00:00

Author

Owner

Independent defensive review finished at head 86f559b68a, base e19c4eb4f2.

Verdict: do not merge. Counts: 0 P0, 3 P1, 0 P2, 0 P3.

R1: revoked host received 12 bytes of terminal input over its existing real TCP/mTLS connection after the SQLite tombstone committed; retained actor also accepted attachment after simulated ledger expiry.
R2: no production half-life renewal/control exchange or certificate replacement path; reconnect after seven-day expiry keeps retrying the expired identity.
R3: normal server startup injects no enrollment/remote services; matching runtime-router test returns 404 for remote join; production D168 encrypted CA/passkey unlock adapter absent.
Each P1 was commented separately with paths/evidence. Three added review assertions failed as expected (3.66 s); negative mTLS matrix passed 4 cases. Existing CSR and token-race assertions passed normally and failed under isolated protection-removal mutations. ASan fuzz smoke: CSR 1,316,173 executions/31 s; binding 733,661/31 s; wire frame/stream/shim 255,674/11,278/53,589, 16 s each; no crash.

Untouched scripts/verify fast: exit 0, systemd CPUWeight=10000, TRACER_TEST_PORT=4748, infraternal-dev/8 CPUs; shared load recorded, no scale/performance certification. Verbatim gate output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4475.05ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.10ms]

 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [4.53s]

Static sizes x86_64 18,982,128 bytes / aarch64 15,934,232 bytes, no PT_INTERP; JS gzip 257,010/307,200 and Brotli 211,808/256,000 bytes.
Evidence: /home/kayg/.local/state/codex-jobs/infraternal/review-remote/findings.md, reproductions.patch, regressions.log, fast-final.log and companion logs. Reviewed worktree remains clean; no commits. Disposable checkout and all 15 GB job scratch/build output removed; no external hosts used. Issue left open.

Independent defensive review finished at head 86f559b68addff6cbec3436f1553080b4c7d2b3f, base e19c4eb4f2ecc16d82b7b03441df431d1b75da8b. Verdict: **do not merge**. Counts: 0 P0, 3 P1, 0 P2, 0 P3. - R1: revoked host received 12 bytes of terminal input over its existing real TCP/mTLS connection after the SQLite tombstone committed; retained actor also accepted attachment after simulated ledger expiry. - R2: no production half-life renewal/control exchange or certificate replacement path; reconnect after seven-day expiry keeps retrying the expired identity. - R3: normal server startup injects no enrollment/remote services; matching runtime-router test returns 404 for remote join; production D168 encrypted CA/passkey unlock adapter absent. Each P1 was commented separately with paths/evidence. Three added review assertions failed as expected (3.66 s); negative mTLS matrix passed 4 cases. Existing CSR and token-race assertions passed normally and failed under isolated protection-removal mutations. ASan fuzz smoke: CSR 1,316,173 executions/31 s; binding 733,661/31 s; wire frame/stream/shim 255,674/11,278/53,589, 16 s each; no crash. Untouched scripts/verify fast: exit 0, systemd CPUWeight=10000, TRACER_TEST_PORT=4748, infraternal-dev/8 CPUs; shared load recorded, no scale/performance certification. Verbatim gate output: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4475.05ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.10ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.53s] ``` Static sizes x86_64 18,982,128 bytes / aarch64 15,934,232 bytes, no PT_INTERP; JS gzip 257,010/307,200 and Brotli 211,808/256,000 bytes. Evidence: /home/kayg/.local/state/codex-jobs/infraternal/review-remote/findings.md, reproductions.patch, regressions.log, fast-final.log and companion logs. Reviewed worktree remains clean; no commits. Disposable checkout and all 15 GB job scratch/build output removed; no external hosts used. Issue left open.

kayg commented

2026-10-08 06:43:35 +00:00

Author

Owner

Completed normal CLI activation at 80899018be: explicit --remote-listen/--remote-ca-dir load validated public trust, start existing QUIC/TCP routing cold-locked, and survive service argument rendering. Optional activation is additive; no CA private key loading, owner-as-administrator shortcut or TLS bypass. Administrator envelopes/unlock and lifecycle remain pending. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exits0; full log docs/verification/remote-agents/run8-gate-cli-startup.log. Real normal-CLI cold-restart proof is next. Verbatim:

PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.88s]

Completed normal CLI activation at 80899018be6c236457f76851198474a944b74ab3: explicit --remote-listen/--remote-ca-dir load validated public trust, start existing QUIC/TCP routing cold-locked, and survive service argument rendering. Optional activation is additive; no CA private key loading, owner-as-administrator shortcut or TLS bypass. Administrator envelopes/unlock and lifecycle remain pending. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exits0; full log docs/verification/remote-agents/run8-gate-cli-startup.log. Real normal-CLI cold-restart proof is next. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.88s]

kayg commented

2026-10-08 06:52:49 +00:00

Author

Owner

Run 8 normal-CLI cold restart proof: retained public issuer plus server leaf/key only; CA private key never persisted. Static x86 CLI re-admitted an enrolled rootless host and reattached its pre-restart terminal in 206182 us; command round trip 5881 us, contiguous output 199 bytes, lost=0 duplicated=0. Load 15.71/18.87/24.37, infraternal-dev. Locked POST /remote/join returned 403, no certificate inserted, invitation remained redeemable. Opt-in real-process test: crates/infraternal-server/src/remote_cold_tests.rs; trust and CLI unit tests each 3/3 passed. Full requested fast gate running before the separate test commit. This proves cold public-trust startup only; administrator unwrap/persistence, live renewal and revocation remain incomplete.

kayg commented

2026-10-08 06:56:15 +00:00

Author

Owner

Additive contracts/remote.md clarification proposed for the implemented normal startup: explicit --remote-listen IP:port (QUIC UDP and TCP/TLS) and --remote-ca-dir (default XDG_DATA_HOME/infraternal/ca); retained issuer.pem, owner-private directory/files, bounded no-follow reads, validated server leaf chain/name/key. Current standalone HTTPS configuration uses that retained issuer for join pinning and remote mTLS, so behind-proxy/distinct public-HTTPS roots fail closed. Startup never generates a CA or accepts signing-key argv; cold signer refuses join/renewal while existing admitted hosts keep routing. Provisioning encrypted administrator envelopes, passkey unlock/notifications and automatic-update IPC remain separate unimplemented adapters, not satisfied by this partial startup integration.

kayg commented

2026-10-08 07:06:16 +00:00

Author

Owner

Completed cold-start test step at 408667b9c4: trust loader and CLI tests 3/3 each; actual static normal CLI cold restart reattached existing session in 343154 us, command RTT 6370 us, 348 contiguous bytes (this short test), load 8.79/9.11/16.14. Locked join refused without certificate or token consumption. Initial fixture socket-drain bind failure was corrected in the test only; deadlines unchanged. Full proof docs/verification/remote-agents/run8-normal-cli-cold-proof.log. Exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exit0; full raw log docs/verification/remote-agents/run8-gate-startup-tests.log. Verbatim:

PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.22s]

Completed cold-start test step at 408667b9c43da80742fca1cad44313cb1a332675: trust loader and CLI tests 3/3 each; actual static normal CLI cold restart reattached existing session in 343154 us, command RTT 6370 us, 348 contiguous bytes (this short test), load 8.79/9.11/16.14. Locked join refused without certificate or token consumption. Initial fixture socket-drain bind failure was corrected in the test only; deadlines unchanged. Full proof docs/verification/remote-agents/run8-normal-cli-cold-proof.log. Exact Nix fast under CPUWeight10000/TRACER_TEST_PORT4701 exit0; full raw log docs/verification/remote-agents/run8-gate-startup-tests.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.22s]

kayg commented

2026-10-08 07:10:46 +00:00

Author

Owner

Fresh run8 D167 optimized transport diagnostics (locked current release test build, CPUWeight10000, infraternal-dev8cores, no own build/browser overlap), RTT300 n25: QUIC mTLS admission p50/p99 455323/457055 us; combined client+server delta67.7KiB/pair, actually1000pairs67700KiB,82 CPU ticks for connections, load3.77/6.71/13.94. TCP758030/760230 us;69.964KiB/pair,1000pairs69964KiB,278 connection CPU ticks, load2.66/5.57/12.87. TCP initial runs exhausted inherited soft fdlimit1024; final unchanged diagnostic passes at8192 (1000pairs need >2000 descriptors). These exclude enrolled-host registry/whole-daemon memory and are not live-renewal costs or pinned acceptance. Raw logs HOME-cache run8/transport-{quic,tcp-fd8192}.log; will cite under docs/verification with docs commit. Renewal CPU/RSS/bytes still unmeasured because live renewal is unimplemented.

kayg referenced this issue

2026-10-08 07:11:56 +00:00

Measure QUIC stacks: quinn+rustls+ring vs OpenSSL native QUIC #88

kayg commented

2026-10-08 07:12:45 +00:00

Author

Owner

Required dev merge completed at ec40b6d (dev5e483ed, new D175 fonts). The first run8 browser invocation was stopped because the merge happened while it was running; that interrupted mixed-tree result is not acceptance evidence. Rebuilding exact full fast, then rerunning full browser suite on the merged tree, TRACER_TEST_PORT4701/CPUWeight10000. Earlier cold-start and transport measurements were at408667b, with unchanged infraternal-agent sources across the merge. Local rootless CLI idle proof at408667b:14628KiB RSS, zero scheduler activations/10.001s,2threads; one process with its separate shim excluded. Estimate at1000nodes14628000KiB across hosts, not1000daemon scale proof. Local join-to-terminal100758us, commandRTT6376us; raw run8/local-idle-proof.log. This is not o1 proof.

Required dev merge completed at ec40b6d (dev5e483ed, new D175 fonts). The first run8 browser invocation was stopped because the merge happened while it was running; that interrupted mixed-tree result is not acceptance evidence. Rebuilding exact full fast, then rerunning full browser suite on the merged tree, TRACER_TEST_PORT4701/CPUWeight10000. Earlier cold-start and transport measurements were at408667b, with unchanged infraternal-agent sources across the merge. Local rootless CLI idle proof at408667b:14628KiB RSS, zero scheduler activations/10.001s,2threads; one process with its separate shim excluded. Estimate at1000nodes14628000KiB across hosts, not1000daemon scale proof. Local join-to-terminal100758us, commandRTT6376us; raw run8/local-idle-proof.log. This is not o1 proof.

kayg commented

2026-10-08 07:17:34 +00:00

Author

Owner

Next lifecycle fix plan for review R1: first reproduce the supplied real TCP/mTLS retained-input and expiry/attachment assertions here. Keep durable SQLite host authority; add shared event-driven revocation guards and one certificate-expiry deadline per authenticated transport, with cancellation waking both directions. Recheck public ledger for attachment/action admission, rather than querying SQLite for every keystroke. No heartbeat/polling loop or protocol-layout change. Runtime/HTTP adapters must share the same store/notification scope; raw DB mutation is not an authorized revocation API. Measure added memory/latency, retain existing writer/session resume behavior. This does not yet implement the authenticated uninstall/removal exchange.

kayg commented

2026-10-08 07:43:07 +00:00

Author

Owner

Completed docs/evidence step at 7e480b8d52, after required dev merge ec40b6d (dev5e483ed). contracts/remote.md documents stable join API and partial normal startup; docs/verification/remote-agents-run8.md records all current acceptance limits and cited raw logs/screenshots. Full browser TRACER_TEST_PORT4701 red:51pass21skip7fail; five reproduced on matching dev (motion, two signin snapshots, reconnect962.2ms vs dev979ms over900ms, setup flow). Two ::1 refusals pass unchanged branch retry2/2 and dev; production screenshot gate1/1. No snapshots, budgets or skips changed. o1 still unreachable; all o1 test state removed. Normal administrator CA envelopes/unlock, live renewal/revocation/removal, lease and chaos remain incomplete. Exact requested Nix fast CPUWeight10000 exit0. Verbatim:

PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.60s]

Completed docs/evidence step at 7e480b8d527bd1b81bfa4ca4498e29b754b16e0f, after required dev merge ec40b6d (dev5e483ed). contracts/remote.md documents stable join API and partial normal startup; docs/verification/remote-agents-run8.md records all current acceptance limits and cited raw logs/screenshots. Full browser TRACER_TEST_PORT4701 red:51pass21skip7fail; five reproduced on matching dev (motion, two signin snapshots, reconnect962.2ms vs dev979ms over900ms, setup flow). Two ::1 refusals pass unchanged branch retry2/2 and dev; production screenshot gate1/1. No snapshots, budgets or skips changed. o1 still unreachable; all o1 test state removed. Normal administrator CA envelopes/unlock, live renewal/revocation/removal, lease and chaos remain incomplete. Exact requested Nix fast CPUWeight10000 exit0. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19005488 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15950856 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.60s]

kayg commented

2026-10-08 07:44:56 +00:00

Author

Owner

R1 failing test reproduced here before any fix, head7e480b8: real TCP/mTLS retained input after store.revoke commits, and new attachment after public-ledger certificate expiry both fail as expected (0passed2failed0ignored,0.08s,CPUWeight10000). Tests at crates/infraternal-server/src/remote_revocation_tests.rs (currently uncommitted); raw HOME cache run8/revocation-before.log. Fixing this owned lifecycle defect next. Current full browser remains red with five matching dev failures and two unchanged branch retries passing; docs/evidence step7e480b8 is fully fast-green.

kayg commented

2026-10-08 07:59:48 +00:00

Author

Owner

R1 core candidate now passes both pre-fix real TCP/mTLS regressions (2passed0failed,0.41s) and exact workspace Clippy. Current implementation bounds retained public certificate validity with a monotonic cap, subscribes before a final admission recheck, wakes both directions on committed shared-store revocation, and rechecks new Open/Attach operations (no SQLite query per keystroke). Full fast running before commit; QUIC/expiry and performance proof still required. Additive next adapter proposed: POST /remote/revocations JSON {host_id}; exact Origin and unlocked owner session; same atomic UPDATE rechecks current session/owner/host ownership, returns204 only after durable write and cancellation publication. Runtime and HTTP must use clones of one EnrollmentStore; CA lock must not block revocation. Join API unchanged. This still does not implement authenticated removal or operator uninstall.

kayg commented

2026-10-08 08:44:44 +00:00

Author

Owner

Completed retained-authority core at f170adb39c: R1 real TCP/mTLS regressions failed first then2/2pass; expiry wait passes. Shared-store watch + monotonic certificate cap cancel both directions; ledger reads for Open/Attach only. Guard component at1000:636KiB RSS growth,37.4ns permit checks vs0.5ns empty,90us new-admission query average n100 (load4.06/4.75/6.99). Local static real daemon/production browser:3 writers independently acknowledged, idle0/10s, RSS15020KiB; no own build overlap, shared load11.41. Raw cited logs under docs/verification/remote-agents/run8-guard*.log and run8-revocation*.log. Runtime operator API still requires shared-store wiring; QUIC-specific cancellation, renewal/removal/uninstall and full phase1 remain incomplete. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exit0; docs/verification/remote-agents/run8-gate-revocation-core.log. Verbatim:

PT_INTERP: absent; size: 19029200 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15969416 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.21s]

Completed retained-authority core at f170adb39c79e8084b379fd9c665c8f702bc797a: R1 real TCP/mTLS regressions failed first then2/2pass; expiry wait passes. Shared-store watch + monotonic certificate cap cancel both directions; ledger reads for Open/Attach only. Guard component at1000:636KiB RSS growth,37.4ns permit checks vs0.5ns empty,90us new-admission query average n100 (load4.06/4.75/6.99). Local static real daemon/production browser:3 writers independently acknowledged, idle0/10s, RSS15020KiB; no own build overlap, shared load11.41. Raw cited logs under docs/verification/remote-agents/run8-guard*.log and run8-revocation*.log. Runtime operator API still requires shared-store wiring; QUIC-specific cancellation, renewal/removal/uninstall and full phase1 remain incomplete. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exit0; docs/verification/remote-agents/run8-gate-revocation-core.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19029200 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15969416 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.21s]

kayg commented

2026-10-08 09:02:26 +00:00

Author

Owner

Revocation cancellation defect reproduced before fix: abandoning the awaiting caller after the real SQLite worker commits leaves the current transport guard live (0 passed, 1 failed, 0.09s; run8/revocation-cancellation-before.log, remote_revocation_http_tests.rs). The HTTP five-second deadline makes this reachable. Fix: explicit transaction and a process-owned commit/publication finalizer after transaction-time permission succeeds; cancelling earlier rolls back, cancelling during commit cannot drop publication. No polling or per-keystroke work.

kayg commented

2026-10-08 09:14:37 +00:00

Author

Owner

Completed runtime revocation API source at eb29a72f57: POST /remote/revocations {host_id}, exact Origin/live unlocked owner/host ownership, shared listener scope, CA-lock-independent204 only after commit/publication. Real SQLite cancellation defect failed first0/1 then fixed HTTP cases4/4; regressions follow in separate test commit. x86+34016B and ARM+28768B versus coref170adb; no agent changes or added per-host retained fields. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exit0, raw docs/verification/remote-agents/run8-gate-revocation-api-source.log. Verbatim:

PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.24s]

Completed runtime revocation API source at eb29a72f572d23d8d44b15a2804a9e203843660f: POST /remote/revocations {host_id}, exact Origin/live unlocked owner/host ownership, shared listener scope, CA-lock-independent204 only after commit/publication. Real SQLite cancellation defect failed first0/1 then fixed HTTP cases4/4; regressions follow in separate test commit. x86+34016B and ARM+28768B versus coref170adb; no agent changes or added per-host retained fields. Exact Nix fast CPUWeight10000/TRACER_TEST_PORT4701 exit0, raw docs/verification/remote-agents/run8-gate-revocation-api-source.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.24s]

kayg commented

2026-10-08 09:24:20 +00:00

Author

Owner

New reachability finding: NetBird SSH supports -R forwarding. A rootless pinned-SSH probe successfully echoed bytes from o1 loopback4701 and7443 through forwards to dev10.69.69.125:4701/7443 (both true, status0); no installation created. This can provide a real o1 enrollment/PTY TCP-relay diagnostic without changing ACLs or monitor01. Proposed opt-in test relay only: trusted fixture supplies localhost join/transport coordinates via private stdin; certificate SAN/CA pin and host-generated key verification stay enforced. It does not establish direct UDP/QUIC or unrelayed network acceptance; those remain blocked.

kayg commented

2026-10-08 09:41:50 +00:00

Author

Owner

Completed separate revocation regression step at b23cecbdc5258340fd9c4fc3908a4f56462328d6:4 HTTP cases pass (including real SQLite caller abandonment failing first), real idle QUIC cut, retained TCP input denial and expiry. Actual static normalCLI cold restart241607us, command2682us,340 contiguous bytes; locked signing; HTTPS revocation1408us then new-terminal refusal1057us; zero extra Ack over300ms,2 shims stayed alive then fixture removed. Load1.63/1.75/2.22. Raw cited run8-revocation-*.log. An initial CLI assertion wrongly expected browser Close: existing attachments are deliberately retained for recovery, so the final test fences actual refusal and probes unaccepted input instead; production thresholds unchanged. Two owned test Clippy issues fixed; final exact Nix fast exit0, raw run8-gate-revocation-api-tests.log. Verbatim:

PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.76s]

Completed separate revocation regression step at b23cecbdc5258340fd9c4fc3908a4f56462328d6:4 HTTP cases pass (including real SQLite caller abandonment failing first), real idle QUIC cut, retained TCP input denial and expiry. Actual static normalCLI cold restart241607us, command2682us,340 contiguous bytes; locked signing; HTTPS revocation1408us then new-terminal refusal1057us; zero extra Ack over300ms,2 shims stayed alive then fixture removed. Load1.63/1.75/2.22. Raw cited run8-revocation-*.log. An initial CLI assertion wrongly expected browser Close: existing attachments are deliberately retained for recovery, so the final test fences actual refusal and probes unaccepted input instead; production thresholds unchanged. Two owned test Clippy issues fixed; final exact Nix fast exit0, raw run8-gate-revocation-api-tests.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.76s]

kayg commented

2026-10-08 09:46:32 +00:00

Author

Owner

Owned host-fixture defect found before installing the relayed proof: inherited o1 runtime path produces a113-byte shim socket name, beyond Linux sun_path108 including NUL. Real nix UnixAddr admission regression fails first0/1 (0.00s), raw HOME-cache run8/o1-socket-before.log, remote_host_tests.rs. Shorten only the test namespace prefix, retain all128 UUID bits and the XDG runtime directory; expected socket98bytes. No product path or threshold change.

kayg commented

2026-10-08 10:00:50 +00:00

Author

Owner

Relay root cause isolated: NetBird SSH with two -R forwards routes BOTH4701 and7443 to the FIRST backend4701. Distinct backend-label probe repeated4701→4701,7443→4701 twice, status0. Thus o1 redeemed/stored its certificate but its subsequent mTLS connection hit the HTTPS service; admission correctly refused. Two o1 attempts each cleaned processes0/data absent/state absent. Use one pinned SSH connection per forwarded port; no NetBird settings, certificate bypass, threshold or production transport change.

kayg commented

2026-10-08 10:14:09 +00:00

Author

Owner

Real o1 rootless TCP-relay proof now passes (separate pinned SSH forwards, no TLS bypass): aarch64 musl SHA256ae23f392d7638686a9adc9ea4cbded1b457e5a9a12d059ac0803ce1b3d566663, uid1002. Join-to-terminal3228889us;25 command RTT p50/p99195663/199935us;25 actual single-byte keystroke echoes193264/196030us with authoritative Acks;5401 contiguous output bytes,0 lost/duplicated in this short test. Real daemon idle0scheduler activations/10.000s,RSS10824KiB,1thread (one process; estimate1000nodes10824000KiB across hosts, not fleet proof). o1load0.08/0.15/0.17; devload5.40/3.14/2.05. All daemon/shim/forward processes0 and data/state absent after cleanup. Raw HOME-cache run8/o1-relay-keystroke-idle.log; harness still awaiting fast gate/commit and production-browser proof. Direct UDP/QUIC acceptance and chaos remain unproved.

kayg commented

2026-10-08 10:34:12 +00:00

Author

Owner

Completed o1 TCP-relay diagnostic step at fb1b4ed994, real aarch64 uid1002, strict authorised pin. Fresh production-browser proof:join3230501us;25 network keystroke echoes193924/197947us p50/p99;desktop/phone glyph p99215.50/208.70ms;3 durable writers independentlyAcked;idle0/10s,RSS10828KiB1thread;actual1daemon,estimate1000nodes10828000KiB across hosts,notfleet proof. Shared load dev0.81/1.58/1.72,o1 0.27/0.22/0.19. Source113-byte socket regression failed first,now98bytes. Separate SSH forwards overcome measured two-R wrong-backend bug; no cert bypass. Cleanup processes0,data/state absent after every attempt. Cited raw logs and screenshots under docs/verification/remote-agents/run8-o1-*. Direct UDP/QUIC/chaos and remaining lifecycle still unproved. Exact requested Nix fast exit0,raw run8-gate-o1-relay.log. Verbatim:

PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.77s]

Completed o1 TCP-relay diagnostic step at fb1b4ed994f5958b09df80b8aec10ef10752f181, real aarch64 uid1002, strict authorised pin. Fresh production-browser proof:join3230501us;25 network keystroke echoes193924/197947us p50/p99;desktop/phone glyph p99215.50/208.70ms;3 durable writers independentlyAcked;idle0/10s,RSS10828KiB1thread;actual1daemon,estimate1000nodes10828000KiB across hosts,notfleet proof. Shared load dev0.81/1.58/1.72,o1 0.27/0.22/0.19. Source113-byte socket regression failed first,now98bytes. Separate SSH forwards overcome measured two-R wrong-backend bug; no cert bypass. Cleanup processes0,data/state absent after every attempt. Cited raw logs and screenshots under docs/verification/remote-agents/run8-o1-*. Direct UDP/QUIC/chaos and remaining lifecycle still unproved. Exact requested Nix fast exit0,raw run8-gate-o1-relay.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.77s]

kayg commented

2026-10-08 10:42:45 +00:00

Author

Owner

Completed dev integration: 40737a8db7 merges dev f63307e. Full requested Nix fast gate exit 0, CPUWeight=10000, port4701; load at late gate 1.23/1.33/1.62 (8 cores). Raw output docs/verification/remote-agents/run8-gate-merged-f633.log. No threshold/baseline changes. Static bytes x86=19063216, ARM=15998184; no PT_INTERP. New browser evidence must use this merged production renderer. Verbatim gate:

PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.12s]

Completed dev integration: 40737a8db7817db09cefc4af2281458f31bb30cc merges dev f63307e. Full requested Nix fast gate exit 0, CPUWeight=10000, port4701; load at late gate 1.23/1.33/1.62 (8 cores). Raw output docs/verification/remote-agents/run8-gate-merged-f633.log. No threshold/baseline changes. Static bytes x86=19063216, ARM=15998184; no PT_INTERP. New browser evidence must use this merged production renderer. Verbatim gate: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.12s]

kayg commented

2026-10-08 10:44:23 +00:00

Author

Owner

Next lifecycle finding: RemoteHosts retains the revoked host actor in its 10,000-entry registry (crates/infraternal-server/src/remote_runtime.rs: Host/RemoteHosts::admit). Streaming authority is denied, but the retained actor keeps attachments and its cancellation registration, and repeated tombstoned hosts can exhaust the cap. Proposed additive cleanup: retire only the matching registry generation on guard revocation/expiry, using the existing event and one expiry deadline; no heartbeat, no shim termination, no removal notice inferred from TLS errors. Replacements must cancel the previous cleanup waiter to avoid deleting a fresh admitted connection. Add failed-first real TCP regression and measure actual retained actor/guard memory at 1,000 hosts. Direct connectivity and live renewal/removal remain incomplete.

kayg commented

2026-10-08 10:59:00 +00:00

Author

Owner

Fresh full production browser suite on merged UI dev f63307e: exit1,59passed22skipped7failed (15.7min), CPUWeight10000/port4701; no own build/host performance overlap. Rust regression source was added during the suite; production UI/build/mock files remained byte-identical to f63307e throughout. All new backspace cases except layout-change pass; 50MB prediction off/on medians2.67/2.83MB/s (+5.81%, pass); predicted glyph p9913.5ms passes17ms, prediction CPU p995.5ms fails2ms; setup render p991853.6ms fails1000ms. Load at completion2.88/3.05/2.59 (8 cores). No threshold or snapshot changes. Running failing cases against isolated dev f63307e next; old dev5e483ed comparisons do not cover this tree.

7 failed
test/motion-audit.spec.ts:39:1 › measure deployed motion at 4x CPU and capture production screens
test/palette-navigation.spec.ts:166:1 › palette keyboard navigation stays visible and accessible on desktop and mobile
test/predictive-backspace.spec.ts:336:1 › typing through a layout change keeps predicting without mispredictions at DPR 1
test/recovery-ui-hold.spec.ts:7:3 › production mobile sign-in matches dev without recovery entry points
test/recovery-ui-hold.spec.ts:7:3 › production desktop sign-in matches dev without recovery entry points
test/terminal.spec.ts:5:1 › first run, passkey login, terminal resume, and the latency probe ───
test/terminal.spec.ts:630:1 › access screens render within the local first-paint budget ────────
22 skipped
59 passed (15.7m)

Fresh full production browser suite on merged UI dev f63307e: exit1,59passed22skipped7failed (15.7min), CPUWeight10000/port4701; no own build/host performance overlap. Rust regression source was added during the suite; production UI/build/mock files remained byte-identical to f63307e throughout. All new backspace cases except layout-change pass; 50MB prediction off/on medians2.67/2.83MB/s (+5.81%, pass); predicted glyph p9913.5ms passes17ms, prediction CPU p995.5ms fails2ms; setup render p991853.6ms fails1000ms. Load at completion2.88/3.05/2.59 (8 cores). No threshold or snapshot changes. Running failing cases against isolated dev f63307e next; old dev5e483ed comparisons do not cover this tree. 7 failed test/motion-audit.spec.ts:39:1 › measure deployed motion at 4x CPU and capture production screens test/palette-navigation.spec.ts:166:1 › palette keyboard navigation stays visible and accessible on desktop and mobile test/predictive-backspace.spec.ts:336:1 › typing through a layout change keeps predicting without mispredictions at DPR 1 test/recovery-ui-hold.spec.ts:7:3 › production mobile sign-in matches dev without recovery entry points test/recovery-ui-hold.spec.ts:7:3 › production desktop sign-in matches dev without recovery entry points test/terminal.spec.ts:5:1 › first run, passkey login, terminal resume, and the latency probe ─── test/terminal.spec.ts:630:1 › access screens render within the local first-paint budget ──────── 22 skipped 59 passed (15.7m)

kayg commented

2026-10-08 10:59:42 +00:00

Author

Owner

Failed-first registry regression confirms the lifecycle leak on 40737a8: real TCP/mTLS host revoked through EnrollmentStore, yet the retained RemoteHosts map still has one entry after 300ms. 0passed1failed in0.34s under CPUWeight10000. Evidence: run8/retirement-before.log (to retain under docs/verification with the fix). The fix will release actor/attachment bookkeeping only, preserve shims and guard against stale expiry removing a newer transport generation. Preparing the optimized 1,000-actual-TLS-host registry baseline before changing production code.

Failed-first registry regression confirms the lifecycle leak on 40737a8: real TCP/mTLS host revoked through EnrollmentStore, yet the retained RemoteHosts map still has one entry after 300ms. 0passed1failed in0.34s under CPUWeight10000. Evidence: run8/retirement-before.log (to retain under docs/verification with the fix). The fix will release actor/attachment bookkeeping only, preserve shims and guard against stale expiry removing a newer transport generation. Preparing the optimized 1,000-actual-TLS-host registry baseline before changing production code.

kayg commented

2026-10-08 11:09:56 +00:00

Author

Owner

Browser comparison completed on isolated dev f63307e:5failed2passed,4.7min, identical production UI/build/mock sources and CPUWeight10000/port4701. Motion190vs169, both sign-in snapshots, reconnect (branchp991060.8ms/dev1010.9ms >900ms), and access screens reproduce. Setup render branch1853.6ms/dev1906.2ms >1000ms; final access assertion is missing setup control. Dev predictionCPU p990.9ms passes (branch fullsuite5.5ms failed); predicted glyph13.5ms passes on branch. Branch unchanged retry:layout-change passes (prior socket hangup); palette handler timing still fails0.13ms threshold. Fullsuite remains red; palette/predictionCPU variance not resolved, and no threshold/skip/snapshot changed. Load comparison completion2.49/3.35/3.09, retry2.75/3.32/3.09. Evidence will be cited under docs/verification; fresh core production screenshots next.

kayg commented

2026-10-08 11:18:41 +00:00

Author

Owner

Registry cleanup comparison (optimized, actual 1,000 TCP/mTLS hosts, no own build/browser overlap, FD8192, infraternal-dev8cores): baseline delta128308KiB/1000 (128.308KiB/host), fixed128836KiB/1000 (128.836KiB/host), +528KiB total/+0.528KiB per host. Credentials/listener/ledger allocated before baseline; PTY/shim/full-daemon memory excluded. Handshake+Hello local p50/p99 baseline2665/4233us (load4.23/3.77/2.99), fixed2232/4065us (load2.94/3.41/3.22); diagnostic, not pinned acceptance. Baseline retained1000 entries after all revocations; fixed0, all1,000 durable revocations+cleanup154318us. Both active real-TLS regressions pass, including stale expiry versus a freshly renewed/reconnected certificate. No per-keystroke code changed; new cleanup task waits on existing revocation event/one certificate deadline. Full fast source gate next; tests/docs separate commits. Raw registry-baseline.log/registry-after.log to be cited under docs/verification.

kayg commented

2026-10-08 11:24:10 +00:00

Author

Owner

Additive live-renewal protocol proposal for the next step [133][168]: have the server schedule the authenticated host certificate at half-life and use existing control-stream Call/Result actions (server-assigned call ids, never QUIC stream ids). A transport.csr call asks the infraternal agent to prove its retained local key; signing uses RemoteEnrollment::renew with the exact admitted predecessor. A transport.certificate call delivers the committed public DER; the infraternal agent verifies issuer/purpose/same key/host, fsyncs and atomically publishes it, then acknowledges. Only that acknowledgement refreshes the retained server guard expiry/fingerprint; existing terminals and writer ids remain intact. Keep one bounded renewal job/control slot, independent of terminal opening and bulk delivery, and use an additive Hello capability so old peers do not receive unknown actions. No heartbeat/healthy-idle polling or new crypto engine. Locked CA leaves terminal authority intact and blocks signing only; retry/notification wiring must preserve D168. Measure real 50M output CPU/RSS/bytes and unchanged offsets. Join API shape for #87 remains unchanged. This proposal is not implemented or renewal acceptance.

kayg commented

2026-10-08 11:31:11 +00:00

Author

Owner

Completed additive lifecycle contract checkpoint dcad48c9c3: contracts/remote.md now documents owner revocation, current-session transaction checks, cancellation-safe publication and generation-specific registry retirement before the runtime change. Join API unchanged for #87. Full requested Nix fast exit0; committed source/test inventory, CPUWeight10000/port4701, completion load1.72/2.00/2.49. Raw docs/verification/remote-agents/run8-gate-lifecycle-contract.log. Verbatim gate:

PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.90s]

Completed additive lifecycle contract checkpoint dcad48c9c30a5867281980f4b13a808768ce5b02: contracts/remote.md now documents owner revocation, current-session transaction checks, cancellation-safe publication and generation-specific registry retirement before the runtime change. Join API unchanged for #87. Full requested Nix fast exit0; committed source/test inventory, CPUWeight10000/port4701, completion load1.72/2.00/2.49. Raw docs/verification/remote-agents/run8-gate-lifecycle-contract.log. Verbatim gate: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19063216 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 15998184 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.90s]

kayg commented

2026-10-08 11:42:59 +00:00

Author

Owner

Completed registry runtime cleanup e2053f51397fcb3f575a5f9a94949733dc5ea040 after contract dcad48c. Event/deadline waiter releases revoked/expired host actor slots; fresh admitted generation is protected, ordinary reconnect state/shims unchanged. Actual1,000-host delta+528KiB, allrevocations+cleanup154318us,0entries remain (baseline1000). Full requested Nix fast exit0 on committed test inventory, CPUWeight10000/port4701; completion load2.01/2.35/2.42. Cited proof under docs/verification/remote-agents/run8-gate-retirement-source.log and registry baseline/after logs. Tests next, separately gated. Verbatim:

PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.50s]

Completed registry runtime cleanup e2053f51397fcb3f575a5f9a94949733dc5ea040 after contract dcad48c. Event/deadline waiter releases revoked/expired host actor slots; fresh admitted generation is protected, ordinary reconnect state/shims unchanged. Actual1,000-host delta+528KiB, allrevocations+cleanup154318us,0entries remain (baseline1000). Full requested Nix fast exit0 on committed test inventory, CPUWeight10000/port4701; completion load2.01/2.35/2.42. Cited proof under docs/verification/remote-agents/run8-gate-retirement-source.log and registry baseline/after logs. Tests next, separately gated. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.50s]

kayg commented

2026-10-08 11:43:50 +00:00

Author

Owner

Corrected runtime commit metadata: fa78142bf1 replaces e2053f5, with identical source and gate proof. I transcribed the ARM static size incorrectly in the body; the actual log is16015544 bytes (not16014008). The previous issue gate quotation already had the correct value. x86 remains19077936; both pass their unchanged allowances. Dedicated tests are restored and their full fast gate is running.

Corrected runtime commit metadata: fa78142bf17060ff3d8ea487c9abc33aad2dff29 replaces e2053f5, with identical source and gate proof. I transcribed the ARM static size incorrectly in the body; the actual log is16015544 bytes (not16014008). The previous issue gate quotation already had the correct value. x86 remains19077936; both pass their unchanged allowances. Dedicated tests are restored and their full fast gate is running.

kayg commented

2026-10-08 11:50:00 +00:00

Author

Owner

Completed dedicated retirement tests eec1621a91: real mTLS revocation releases capped slot/retained actor, and expired old generation cannot remove a signed same-key TLS replacement. Opt-in optimized diagnostic retains1,000 actual TLS hosts/actors and reports memory/handshakes/cleanup; no mock crypto or changed deadlines. Full requested Nix fast exit0, CPUWeight10000/port4701, completion load3.56/2.26/2.24. Raw docs/verification/remote-agents/run8-gate-retirement-tests.log. Evidence report/current-production screenshots next. Verbatim:

PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.56s]

Completed dedicated retirement tests eec1621a91f5a708badcd2d4a866edee6a86ce75: real mTLS revocation releases capped slot/retained actor, and expired old generation cannot remove a signed same-key TLS replacement. Opt-in optimized diagnostic retains1,000 actual TLS hosts/actors and reports memory/handshakes/cleanup; no mock crypto or changed deadlines. Full requested Nix fast exit0, CPUWeight10000/port4701, completion load3.56/2.26/2.24. Raw docs/verification/remote-agents/run8-gate-retirement-tests.log. Evidence report/current-production screenshots next. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.56s]

kayg commented

2026-10-08 12:15:10 +00:00

Author

Owner

Run8 gated evidence checkpoint: ba77d9d083. Atomic contract dcad48c, registry runtime fa78142, tests eec1621, report ba77d9d; dev f63307e merged in40737a8. Tracked changes committed; no push/deploy/merge into dev. Report docs/verification/remote-agents-run8.md links exact logs and current production screenshots.

Real o1 strict-pinned rootless TCP relay:join3230501us, single-byteecho25 samples p50/p99193924/197947us,5401contiguous bytes,0idle activations/10s,RSS10828KiB (x1000=10828000KiB estimate across hosts); three durable writers. All installations/daemon/shim/forward processes removed, data/state absent. Direct o1→dev4701/7443 still times out; relay is diagnostic, no direct QUIC/o2 claim.

At1,000 actual TLS hosts/actors, cleanup adds528KiB; all1,000 revocations+cleanup154318us,0registry entries remain. Fresh fixed300ms RTT QUIC p50/p99454762/456677us,67.668KiB/pair (actual1000delta67668KiB),85CPU ticks; TCP757112/758451us,69.964KiB/pair (69964KiB),181ticks. Component totals exclude full-daemon/shim memory; loads/sample counts in report.

Full production browser remains red59pass22skip7fail; matching dev reproduces5; layout passes retry, palette/predictionCPU variance unresolved. Current core screenshot checks3pass. No threshold/skip/baseline changes. Phase1 incomplete: production administrator CA envelopes/passkey unlock/notifications/updateIPC and issuer overlap; automatic half-life live renewal with real50M CPU/RSS/bytes; authenticated next-contact removal/operator uninstall; enforced loss lease; direct o1/o2 chaos/full byte oracle and pinned/fleet/device review. Server-driven existing Call/Result renewal proposal recorded above, not implemented. Inherited unregistered remote_lease.rs is not enforcement; .scratch/evidence/target excluded. No issue closure.

Exact requested Nix fast exit0 at checkpoint, CPUWeight10000/port4701, load5.49/2.86/2.25; full output docs/verification/remote-agents/run8-gate-evidence.log. Verbatim:

PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376)

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.91s]

Run8 gated evidence checkpoint: ba77d9d083237a3e496b55b7f51c0136d2dc563c. Atomic contract dcad48c, registry runtime fa78142, tests eec1621, report ba77d9d; dev f63307e merged in40737a8. Tracked changes committed; no push/deploy/merge into dev. Report docs/verification/remote-agents-run8.md links exact logs and current production screenshots. Real o1 strict-pinned rootless TCP relay:join3230501us, single-byteecho25 samples p50/p99193924/197947us,5401contiguous bytes,0idle activations/10s,RSS10828KiB (x1000=10828000KiB estimate across hosts); three durable writers. All installations/daemon/shim/forward processes removed, data/state absent. Direct o1→dev4701/7443 still times out; relay is diagnostic, no direct QUIC/o2 claim. At1,000 actual TLS hosts/actors, cleanup adds528KiB; all1,000 revocations+cleanup154318us,0registry entries remain. Fresh fixed300ms RTT QUIC p50/p99454762/456677us,67.668KiB/pair (actual1000delta67668KiB),85CPU ticks; TCP757112/758451us,69.964KiB/pair (69964KiB),181ticks. Component totals exclude full-daemon/shim memory; loads/sample counts in report. Full production browser remains red59pass22skip7fail; matching dev reproduces5; layout passes retry, palette/predictionCPU variance unresolved. Current core screenshot checks3pass. No threshold/skip/baseline changes. Phase1 incomplete: production administrator CA envelopes/passkey unlock/notifications/updateIPC and issuer overlap; automatic half-life live renewal with real50M CPU/RSS/bytes; authenticated next-contact removal/operator uninstall; enforced loss lease; direct o1/o2 chaos/full byte oracle and pinned/fleet/device review. Server-driven existing Call/Result renewal proposal recorded above, not implemented. Inherited unregistered remote_lease.rs is not enforcement; .scratch/evidence/target excluded. No issue closure. Exact requested Nix fast exit0 at checkpoint, CPUWeight10000/port4701, load5.49/2.86/2.25; full output docs/verification/remote-agents/run8-gate-evidence.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19077936 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16015544 bytes (baseline 15934232 + allowance 262144 = max 16196376) 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.91s]

kayg commented

2026-10-08 12:26:17 +00:00

Author

Owner

Run9 started: sole writer remote-agents, original base fca6e093d8, resumed ba77d9d083. Read review-findings-for-run9 and reproduction sources. Run8 already includes event/expiry guards and explicit CLI activation; replaying exact R1 assertions in-tree before renewal and production D168 unlock. Preserving untracked lease WIP and excluding scratch/evidence/target. No perf VM, push, deployment or merge.

Run9 started: sole writer remote-agents, original base fca6e093d8d07524e5f7014d0e9d730781f24239, resumed ba77d9d083237a3e496b55b7f51c0136d2dc563c. Read review-findings-for-run9 and reproduction sources. Run8 already includes event/expiry guards and explicit CLI activation; replaying exact R1 assertions in-tree before renewal and production D168 unlock. Preserving untracked lease WIP and excluding scratch/evidence/target. No perf VM, push, deployment or merge.

kayg commented

2026-10-08 12:37:06 +00:00

Author

Owner

Run9 R1 replay committed at a1e8b0c534. Exact supplied real TLS assertions both PASS on run8 guards; no production change. Original RED evidence is review-remote/regressions.log at86f559b. Current test sources remote_review_tests.rs; no assertions weakened (one collapsible-if lint corrected). Requested CPUWeight10000/TRACER_TEST_PORT4701 Nix fast exit0; load at finish3.14/5.87/5.12,8cores. Static x8619077936/ARM16015544 bytes unchanged. Raw worktree .scratch/run9/r1-fast-fixed.log. Verbatim:

stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2175.75ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [6.39ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.19s]

Run9 R1 replay committed at a1e8b0c534238e4ce8da060e4b0c969bdcd0a251. Exact supplied real TLS assertions both PASS on run8 guards; no production change. Original RED evidence is review-remote/regressions.log at86f559b. Current test sources remote_review_tests.rs; no assertions weakened (one collapsible-if lint corrected). Requested CPUWeight10000/TRACER_TEST_PORT4701 Nix fast exit0; load at finish3.14/5.87/5.12,8cores. Static x8619077936/ARM16015544 bytes unchanged. Raw worktree .scratch/run9/r1-fast-fixed.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2175.75ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [6.39ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.19s]

kayg commented

2026-10-08 12:37:38 +00:00

Author

Owner

Run9 additive renewal detail before code: Hello LIVE_RENEWAL bit2; server-assigned nonzero control Call ids reuse actor allocator. transport.csr accepts {}; Result {csr_der:[u8]} bounded4096 DER/32768 JSON. transport.certificate accepts {certificate_der:[u8]} bounded8192 DER/32768 JSON; success Result {} only after pinned client-purpose/same-host/same-key/seven-day/increased-expiry validation and fsync+atomic replacement. One exchange/host, eight global signer slots, five-second control-call deadlines; crypto/publication off reactor. Server refreshes shared fingerprint/monotonic expiry only after Ack, preserving current streams/writers. Half-life timer and hourly bounded retry while CA unavailable, no healthy-idle polling. Expired local identities stop retrying. Join API unchanged for#87.

kayg commented

2026-10-08 12:43:12 +00:00

Author

Owner

Run9 additive live-renewal contract committed 02f37b2146; existing join API unchanged. Requested scoped Nix fast exit0, all Rust rowsPASS/static sizesunchanged; currentload2.36/3.04/4.02. Runtime still unimplemented. Raw .scratch/run9/renewal-contract-fast.log. Verbatim:

stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2613.85ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [7.74ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.63s]

Run9 additive live-renewal contract committed 02f37b2146559f515564457bfae76e217dcf809e; existing join API unchanged. Requested scoped Nix fast exit0, all Rust rowsPASS/static sizesunchanged; currentload2.36/3.04/4.02. Runtime still unimplemented. Raw .scratch/run9/renewal-contract-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2613.85ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [7.74ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.63s]

kayg commented

2026-10-08 12:45:02 +00:00

Author

Owner

Run9 R2 failing-first evidence: expired_local_identity_stops_instead_of_retrying_forever FAIL(0/1,0.21s): supervisor times out while retrying expired leaf. half_life_requests_proof_on_live_authenticated_control FAIL(0/1,2.15s): configured production router with unlocked memory CA, real ledger/TCP mTLS and half-life leaf emits no CSR Call. Raw .scratch/run9/{expired-red,live-red}.log; assertion sources retained for in-tree tests. No thresholds changed. Implementing bounded host proof/publication module first; then dispatcher/CLI and server scheduler.

kayg referenced this issue

2026-10-08 13:02:19 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 13:07:09 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 13:07:19 +00:00

Author

Owner

Run9 host renewal boundary committed 56e719fcf5. Pinned client purpose/same host/key/seven-day/increasing-expiry checks and publication-before-Ack API; not yet connected to daemon/CLI. Signed proof/publication tests1/1PASS0.01s; tests separate. Full requested scoped fast exit0; static19077936/16015544unchanged. Earlier raw renewal-module-fast-final.log had one AddrInUse UDP/TCP ephemeral collision; isolated unchanged revocation testPASS0.36s, full repeatPASS. Completionload28.87/16.17/9.68; no performance certification. Raw .scratch/run9/renewal-module-fast-retry.log. Verbatim:

stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3596.21ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.05ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.63s]

Run9 host renewal boundary committed 56e719fcf5c3cdfa72e225992a6853393bfe8bf7. Pinned client purpose/same host/key/seven-day/increasing-expiry checks and publication-before-Ack API; not yet connected to daemon/CLI. Signed proof/publication tests1/1PASS0.01s; tests separate. Full requested scoped fast exit0; static19077936/16015544unchanged. Earlier raw renewal-module-fast-final.log had one AddrInUse UDP/TCP ephemeral collision; isolated unchanged revocation testPASS0.36s, full repeatPASS. Completionload28.87/16.17/9.68; no performance certification. Raw .scratch/run9/renewal-module-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3596.21ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.05ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.63s]

kayg commented

2026-10-08 13:13:54 +00:00

Author

Owner

Run9 dispatch checks: expired identity regression now GREEN; remote_client suite9pass/1ignored0.66s (prior expired testRED0.21s). Bounded publication work is dispatched off the reactor; common terminal/priority queues remain reused. Full agent dispatcher source gate running. Scheduler detail: MemoryCaSource lock events will wake deferred renewal immediately on administrator unlock; bounded 5–64s jittered retries for busy/transient failures avoid stranding synchronized1,000-host half-lives behind eight slots; locked-source retry remains hourly. No heartbeat/idle polling.

kayg commented

2026-10-08 13:26:27 +00:00

Author

Owner

Renewal dispatcher validation: first full fast gate hit unchanged embedded idle RSS ceiling (no threshold changes). Same CPUWeight=10000 isolated 24-restart fixture passes: 14,772 KiB, zero scheduled slices over 2.201s, exact 4,710,396-byte input/output replay. Fresh-start n=25 comparison against 56e719f: previous RSS min/median/max 14,348/14,616/14,808 KiB; current 14,548/14,660/15,068 KiB (median +44 KiB; ceiling 15,360). infraternal-dev x86_64, 8 cores, load 28.52–28.96. Evidence .scratch/run9/rss-compare/results.log and dispatch-rss-retry.log. Full unchanged scoped gate retry running.

Renewal dispatcher validation: first full fast gate hit unchanged embedded idle RSS ceiling (no threshold changes). Same CPUWeight=10000 isolated 24-restart fixture passes: 14,772 KiB, zero scheduled slices over 2.201s, exact 4,710,396-byte input/output replay. Fresh-start n=25 comparison against 56e719f: previous RSS min/median/max 14,348/14,616/14,808 KiB; current 14,548/14,660/15,068 KiB (median +44 KiB; ceiling 15,360). infraternal-dev x86_64, 8 cores, load 28.52–28.96. Evidence .scratch/run9/rss-compare/results.log and dispatch-rss-retry.log. Full unchanged scoped gate retry running.

kayg referenced this issue

2026-10-08 13:28:28 +00:00

Plan: make the canvas real, in parallel lanes, with add-host #109

kayg referenced this issue

2026-10-08 13:49:22 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 13:58:53 +00:00

Author

Owner

Completed the optional bounded host renewal dispatcher (D133/D168): one off-reactor proof/publication job, existing priority control replies, inherited path unchanged. This source slice alone does not activate live renewal; outgoing supervisor/CLI/server adapters follow.
Head 3742f5450e. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-daemon-only-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19124976 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16060536 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3941.69ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.53ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.99s]

Completed the optional bounded host renewal dispatcher (D133/D168): one off-reactor proof/publication job, existing priority control replies, inherited path unchanged. This source slice alone does not activate live renewal; outgoing supervisor/CLI/server adapters follow. Head 3742f5450e72d493daf8e2b98c5c9f5f89fe9d27. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-daemon-only-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19124976 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16060536 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3941.69ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.53ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.99s]

kayg commented

2026-10-08 14:00:46 +00:00

Author

Owner

Additional R1 finding reproduced at 3742f54 with a test-only post-COMMIT fence: committed_tombstone_cannot_forward_input_before_finalizer_returns fails 0 passed/1 failed in0.10s; input reached the real mTLS host after SQLite tombstone visibility while cancellation publication awaited finalizer scheduling. Existing review assertions await revoke return and do not cover this interval. Evidence .scratch/run9/revocation-window-red.log; remote_review_tests.rs:217. Fixing by authorized cancellation plus per-host admitted-write drain BEFORE COMMIT, retaining the cancellation registration through COMMIT to prevent new false registrations. Unauthorized/revoked-session checks remain before cancellation; storage failure remains conservative fail closed. No DB lookup per keystroke, protocol or join API change. Will measure the frame-write fence overhead.

Additional R1 finding reproduced at 3742f54 with a test-only post-COMMIT fence: committed_tombstone_cannot_forward_input_before_finalizer_returns fails 0 passed/1 failed in0.10s; input reached the real mTLS host after SQLite tombstone visibility while cancellation publication awaited finalizer scheduling. Existing review assertions await revoke return and do not cover this interval. Evidence .scratch/run9/revocation-window-red.log; remote_review_tests.rs:217. Fixing by authorized cancellation plus per-host admitted-write drain BEFORE COMMIT, retaining the cancellation registration through COMMIT to prevent new false registrations. Unauthorized/revoked-session checks remain before cancellation; storage failure remains conservative fail closed. No DB lookup per keystroke, protocol or join API change. Will measure the frame-write fence overhead.

kayg referenced this issue

2026-10-08 14:07:52 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 14:10:55 +00:00

Author

Owner

R1 fence fixed locally: imported review regressions plus the post-COMMIT reproducer pass3/3 in0.47s; clippy passes. Release mechanism diagnostic (11 rounds x1,000,000 iterations, infraternal-dev8cores, load23.37/21.68/24.31): existing permits check median32ns; added write_permit method median127ns/p99159ns. Added per-host struct allocation72B x1,000=72,000B (allocator/whole-transport RSS excluded; not fleet acceptance). Evidence .scratch/run9/revocation-window-green.log and revocation-fence-cost.log. Authorized cancellation drains read permits before COMMIT; the retained registration prevents fresh false signals before tombstone visibility. Source-only full fast gate running; tests/diagnostic saved for their own gated commit.

kayg commented

2026-10-08 14:26:47 +00:00

Author

Owner

Completed R1 COMMIT boundary correction (D134): cancel after authorization, drain admitted frame writes before durable tombstone, retain cancellation through COMMIT. Exact source-only gate green. New regression failed first0/1 then passes; retained test/diagnostic commit follows. Added permit method127ns median/159ns p99; struct72B/host x1000=72000B excluding allocator and transport RSS.
Head 0406b50814. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/revocation-fence-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19128880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16065976 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3191.58ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [15.52ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.25s]

Completed R1 COMMIT boundary correction (D134): cancel after authorization, drain admitted frame writes before durable tombstone, retain cancellation through COMMIT. Exact source-only gate green. New regression failed first0/1 then passes; retained test/diagnostic commit follows. Added permit method127ns median/159ns p99; struct72B/host x1000=72000B excluding allocator and transport RSS. Head 0406b50814af921e2c8c60dd7828ee1b7441c227. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/revocation-fence-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19128880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16065976 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3191.58ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [15.52ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.25s]

kayg referenced this issue

2026-10-08 14:34:51 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 14:41:36 +00:00

Author

Owner

o2 trust preflight: no existing known_hosts entry for10.69.69.52 or o2. ssh-keyscan over NetBird address returned candidate Ed25519 SHA256:9Fi5y1utJWHP7h16sFYeaH5mxFTIwgBfvGV5hAkSnL8; public candidate .scratch/run9/o2-known-hosts.candidate, not used for a login. Requested kayg authorization to pin this key for rootless tests because the job forbids silently trusting unknown keys; prior TOFU authorization covered o1 only. No o2 login, installation or process. Backend R1/R2/R3 work continues independently.

kayg referenced this issue

2026-10-08 14:49:44 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 14:55:40 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 15:05:00 +00:00

Author

Owner

R1 test-slice gate: first retry fixed only diagnostic const declaration placement (clippy); next full gate runtime failure was unchanged scripts/verify-agent-snapshot.py:48 (tiny-credit catch-up). No threshold/assertion changes. Same CPUWeight10000 isolated currentPASS17.87s and dev ac03b19PASS21.44s; paired repeats with recorded per-run loads also bothPASS (raw .scratch/run9/credit-comparison.log). Probe diff against ac03b19 and current dev is empty. Failure does not reproduce in isolated runs; not claiming a baseline defect or changing this probe. Full unchanged test-slice gate retry next; all other Rust rows/static builds passed.

R1 test-slice gate: first retry fixed only diagnostic const declaration placement (clippy); next full gate runtime failure was unchanged scripts/verify-agent-snapshot.py:48 (tiny-credit catch-up). No threshold/assertion changes. Same CPUWeight10000 isolated currentPASS17.87s and dev ac03b19PASS21.44s; paired repeats with recorded per-run loads also bothPASS (raw .scratch/run9/credit-comparison.log). Probe diff against ac03b19 and current dev is empty. Failure does not reproduce in isolated runs; not claiming a baseline defect or changing this probe. Full unchanged test-slice gate retry next; all other Rust rows/static builds passed.

kayg commented

2026-10-08 15:11:43 +00:00

Author

Owner

R1 regression slice: retained exact review tests plus deterministic post-COMMIT input refusal. Three real TLS tests PASS0.47s; diagnostic added write-permit method median127ns/p99159ns (11x1M), guard72B x1000=72000B excludes allocator/transport. Unchanged full gate green after tiny-credit isolated current/dev comparison.
Head 702ea62ba3. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/revocation-fence-tests-fast-final.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19128880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16065976 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3064.34ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.24ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.10s]

R1 regression slice: retained exact review tests plus deterministic post-COMMIT input refusal. Three real TLS tests PASS0.47s; diagnostic added write-permit method median127ns/p99159ns (11x1M), guard72B x1000=72000B excludes allocator/transport. Unchanged full gate green after tiny-credit isolated current/dev comparison. Head 702ea62ba3d2c2840fa118fd7d10c17b6256bcdb. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/revocation-fence-tests-fast-final.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19128880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16065976 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3064.34ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.24ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.10s]

kayg commented

2026-10-08 15:26:03 +00:00

Author

Owner

R2 supervisor module: reconnects snapshot the acknowledged replacement; expired credentials fail before network work. Pre-fix regression failed at200ms; test retained next. QUIC/TCP share optional durable publication adapter. Full unchanged fast gate green.
Head a8f6e32d99. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-client-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19129680 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16066488 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3510.50ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.11ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.58s]

R2 supervisor module: reconnects snapshot the acknowledged replacement; expired credentials fail before network work. Pre-fix regression failed at200ms; test retained next. QUIC/TCP share optional durable publication adapter. Full unchanged fast gate green. Head a8f6e32d998985db4cd7a64913f05b66ae4f924d. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-client-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19129680 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16066488 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3510.50ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.11ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.58s]

kayg commented

2026-10-08 15:37:05 +00:00

Author

Owner

R2 expiry test slice: unchanged embedded-daemon RSS gate failed (scripts/verify-agent.py:34, <15360KiB); no limit/assertion edits. CPUWeight10000 exact workspace-feature isolated runs both PASS: current idle14932KiB/0slices2.205s; dev ac03b19 idle12160KiB/0slices2.201s; both preserve4710396bytes across24stops. Probe/test source diff empty. This shows inherited remote-phase debug RSS growth, not a baseline failure; single samples are not fleet acceptance. Current package-only rerun14900KiB/0slices2.207s. Logs .scratch/run9/rss-{current,dev}-scoped-workspace.log; hostload ranged8.64..36.98 on8cores while baseline rebuilt. Full unchanged gate retry underway; shipping idleRSS and1000-host memory still require final measurements.

R2 expiry test slice: unchanged embedded-daemon RSS gate failed (scripts/verify-agent.py:34, <15360KiB); no limit/assertion edits. CPUWeight10000 exact workspace-feature isolated runs both PASS: current idle14932KiB/0slices2.205s; dev ac03b19 idle12160KiB/0slices2.201s; both preserve4710396bytes across24stops. Probe/test source diff empty. This shows inherited remote-phase debug RSS growth, not a baseline failure; single samples are not fleet acceptance. Current package-only rerun14900KiB/0slices2.207s. Logs .scratch/run9/rss-{current,dev}-scoped-workspace.log; hostload ranged8.64..36.98 on8cores while baseline rebuilt. Full unchanged gate retry underway; shipping idleRSS and1000-host memory still require final measurements.

kayg commented

2026-10-08 15:38:10 +00:00

Author

Owner

R2 expiry regression retained: real expired X509 causes PermissionDenied before dial within200ms; failed before supervisor fix. Full unchanged fast gate green after documented current/dev RSS comparison; no limit changes.
Head 5f913b1b9e. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-expired-tests-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19129680 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16066488 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4046.73ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.38ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.19s]

R2 expiry regression retained: real expired X509 causes PermissionDenied before dial within200ms; failed before supervisor fix. Full unchanged fast gate green after documented current/dev RSS comparison; no limit changes. Head 5f913b1b9e4aa34ba4f9bf92bbc88a1db531568a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-expired-tests-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19129680 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16066488 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4046.73ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.38ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.19s]

kayg commented

2026-10-08 15:43:32 +00:00

Author

Owner

Measurement wording correction: the R1 72B/host x1000=72000B is added write-fence bookkeeping (Revocation delta + RwLock/Arc counters), exactly labelled added_struct_bytes in remote_review_tests.rs:261 and revocation-fence-cost.log. My earlier shorthand “guard72B” must not be read as the complete AuthorityGuard or total host allocation. Allocator and transport RSS remain excluded; whole-server1000-host acceptance is still pending.

kayg commented

2026-10-08 15:54:49 +00:00

Author

Owner

R2 server control adapter: one bounded capability-gated control call per host shares existing call ids/results; timed-out queued requests skipped, unsupported peers distinct, JSON bounded before copying. No terminal transport replacement. Full unchanged fast gate green.
Head 8b2fbee7d9. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-actor-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19133168 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16070984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4110.13ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [16.01ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.16s]

R2 server control adapter: one bounded capability-gated control call per host shares existing call ids/results; timed-out queued requests skipped, unsupported peers distinct, JSON bounded before copying. No terminal transport replacement. Full unchanged fast gate green. Head 8b2fbee7d947d2ded3e39dcda631542517d2b72b. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-actor-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19133168 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16070984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4110.13ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [16.01ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.16s]

kayg commented

2026-10-08 16:01:01 +00:00

Author

Owner

R3 additive contract proposal before implementation: explicit current administrator membership (initial owner seeded as administrator, not an owner predicate for unlock); one encrypted Ed25519 seed copy per membership epoch in XDG_DATA_HOME/infraternal/ca/envelopes, outside SQLite; fresh purpose/session-bound passkey proof and role/epoch recheck before MemoryCaSource install. Reuse existing HKDF/AES-256-GCM primitives and OpenSSL provider; browser derives a separate CA wrapping key from its account DEK (DEK/PRF never sent), sends only that scoped key through authenticated HTTPS, and clears it afterwards. Wrapped copies bind issuer fingerprint, user id and role epoch; grant/revoke updates membership and recipient copies together at a serialized policy boundary. Cold startup never loads plaintext private key; public verification continues. Existing join JSON stays unchanged; default unconfigured enrollment route explicitly unavailable rather than404. D168 in-memory handoff remains; update integration stays deferred as requested. Initial encrypted-copy provisioning and administrator notifications must be covered by shipping-path tests before R3 is called complete.

kayg commented

2026-10-08 16:12:03 +00:00

Author

Owner

R2 CA source notification slice: optional trait subscription forwards existing cold-lock/unlock watch; no polling or implicit key loading. Cold lock/handoff tests and full unchanged fast gate green.
Head a204a415ce. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-ca-events-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19133296 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16071128 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3206.17ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.92ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.26s]

R2 CA source notification slice: optional trait subscription forwards existing cold-lock/unlock watch; no polling or implicit key loading. Cold lock/handoff tests and full unchanged fast gate green. Head a204a415cea9e082013549a4a182597a497a7101. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-ca-events-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19133296 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16071128 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3206.17ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.92ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.26s]

kayg commented

2026-10-08 16:24:11 +00:00

Author

Owner

R2 enrollment signer module: CSR bound before clone; parse/sign in blocking worker, preserving atomic post-signing predecessor/key/revocation recheck. Scheduler will cap eight exchanges. Full unchanged fast gate green; end-to-end renewal measurements pending wiring.
Head db3c872077. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-signing-worker-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19133296 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16071128 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2721.77ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.22ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.76s]

R2 enrollment signer module: CSR bound before clone; parse/sign in blocking worker, preserving atomic post-signing predecessor/key/revocation recheck. Scheduler will cap eight exchanges. Full unchanged fast gate green; end-to-end renewal measurements pending wiring. Head db3c8720774af885f570e391aef4899ce7722a7a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-signing-worker-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19133296 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16071128 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2721.77ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.22ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.76s]

kayg commented

2026-10-08 16:29:16 +00:00

Author

Owner

R2 live scheduler proof before source commit:4 real-engine tests PASS0.65s (.scratch/run9/renewal-scheduler-live-tests2.log). Previously failing half-life test now receives CSR on existing TLS control; cold-locked fixture emits no signing call, unlock wakes it; durable publication alone leaves admitted fingerprint unchanged, strict Ack extends it; terminal Output offsets0->6 and writer stream2/Inputseq0 survive on same connection. Uses memory-only signer and production router/ledger; this is TCP integration, not yet QUIC/CLI fsync/50MiB cost proof. Source-only full gate next, then retain tests separately.

kayg referenced this issue

2026-10-08 16:36:54 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 16:44:57 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 16:45:00 +00:00

Author

Owner

R2 live scheduler module: half-life, unlock-event wakeup, eight exchanges, staggered retries, legacy expiry without polling; shared admission advances only after strict host publication Ack and preserves revocation/mode/uid. Four real-engine TLS tests PASS0.65s before source gate; retained next. Full unchanged fast gate green. CLI fsync/QUIC/50MiB/perf proof pending.
Head dda5db0e0f. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-scheduler-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19177232 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16109792 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3419.07ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.03ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.45s]

R2 live scheduler module: half-life, unlock-event wakeup, eight exchanges, staggered retries, legacy expiry without polling; shared admission advances only after strict host publication Ack and preserves revocation/mode/uid. Four real-engine TLS tests PASS0.65s before source gate; retained next. Full unchanged fast gate green. CLI fsync/QUIC/50MiB/perf proof pending. Head dda5db0e0f15269049a2185da4624459a5991623. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-scheduler-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19177232 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16109792 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3419.07ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.03ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.45s]

kayg commented

2026-10-08 17:05:51 +00:00

Author

Owner

R2 live test-slice gate: unchanged Snapshot probe scripts/verify-agent-snapshot.py:48 failed after catch-up0 under concurrent load; no assertion/limit changes. Required CPUWeight10000 exactworkspace-feature isolated comparison:currentPASS13.16s, devac03b19PASS12.79s, bothfour12MiBfloods/threefundedSnapshotpauses andsamecursors12583542/25166719/37749896/50333067. Probe diffempty. Startload13.56/20.50/20.52, finish8.52/17.94/19.64 on8cores. Logs .scratch/run9/live-credit-{current,dev}.log. Failure unreproduced in isolation; not claimingbaselinefails. Full unchanged gate retry underway; bothstaticbuilds passed.

kayg commented

2026-10-08 17:22:04 +00:00

Author

Owner

Finding while gating R2 tests: existing revoked_host_releases_its_registry_entry_and_retained_actor failed before retirement at remote_revocation_tests.rs:56, AddrInUse from RemoteListeners::start. UDPport0 selection can pick a number already occupied in separate TCPspace. No threshold changes. Source now reserves TCPfirst and bounds ephemeral UDPcollision retries16; explicit ports neverrelocate. Two real socket regressions PASS0.01s (forced UDPcollision releasesfailedTCP; occupiedexplicitportrefused), .scratch/run9/listener-pair-tests.log. Bugfix source and tests separate gated slices before resuming live-test commit.

kayg commented

2026-10-08 17:38:48 +00:00

Author

Owner

Listener source gate retries: unchanged Snapshot credit assertion scripts/verify-agent-snapshot.py:48 failed after two funded12MiB catches. Exact CPUWeight10000 workspace isolated current PASS17.82s vs dev ac03b19 PASS14.62s (all4 floods, offsets identical12583542/25166719/37749896/50333067). Next full gate hit unchanged debug embedded RSS15MiB assertion; serial fullgate passed that and Snapshot, then unchanged VT reconnect notice/repaint cursor assertion. Exact serial scoped reconnect current PASS18.56s vs same dev PASS19.64s. Host8cores; /proc/loadavg13.40/16.50/21.52 after comparison. Logs .scratch/run9/listener-credit-{current,dev}.log and listener-reconnect-{current,dev}.log; no probe/threshold changed; full gate retry pending before source commit.

Listener source gate retries: unchanged Snapshot credit assertion scripts/verify-agent-snapshot.py:48 failed after two funded12MiB catches. Exact CPUWeight10000 workspace isolated current PASS17.82s vs dev ac03b19 PASS14.62s (all4 floods, offsets identical12583542/25166719/37749896/50333067). Next full gate hit unchanged debug embedded RSS15MiB assertion; serial fullgate passed that and Snapshot, then unchanged VT reconnect notice/repaint cursor assertion. Exact serial scoped reconnect current PASS18.56s vs same dev PASS19.64s. Host8cores; /proc/loadavg13.40/16.50/21.52 after comparison. Logs .scratch/run9/listener-credit-{current,dev}.log and listener-reconnect-{current,dev}.log; no probe/threshold changed; full gate retry pending before source commit.

kayg commented

2026-10-08 17:47:01 +00:00

Author

Owner

Completed ephemeral listener source fix: TCP-first reservation, at most16 UDP collisions for port0; configured ports never move. Serial Rust tests; no limits changed.
Head 6f77a8f367. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/listener-pair-source-fast-final.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19178800 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16110848 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4033.21ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.66ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.07s]

Completed ephemeral listener source fix: TCP-first reservation, at most16 UDP collisions for port0; configured ports never move. Serial Rust tests; no limits changed. Head 6f77a8f367195ad81a645d4217387c19a5248370. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/listener-pair-source-fast-final.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19178800 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16110848 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4033.21ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.66ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.07s]

kayg commented

2026-10-08 17:54:03 +00:00

Author

Owner

Listener-test finding: source commit6f77a8f already green. The new explicit-port fixture chose a UDP-only reservation and its final TCP-bind assertion failed AddrInUse (remote_runtime_tests.rs:323), reproducing the separate-pool mistake in the test itself. Test now keeps its own TCP reservation alive throughout explicit-port refusal and asserts no reservation callback/port relocation; the other test still forces actual UDP collision/retry/TCP release. No production change, threshold or size adjustment. Full test gate retry log .scratch/run9/listener-pair-tests-fast-fixed.log.

kayg commented

2026-10-08 18:04:58 +00:00

Author

Owner

Listener-test gate: all tests and static rows passed after fixture correction, but rustfmt requested wrapping one assertion (now corrected). Formatted retry then failed unchanged embedded terminal-open under load36.33/28.72/25.10 on8cores; idle14992KiB/zero scheduled slices. Exact CPUWeight10000 workspace comparison: current PASS39.76s/14984KiB vs dev ac03b19 PASS39.75s/11852KiB; both4710396 bytes across24 abrupt restarts, zero idle slices. Logs .scratch/run9/listener-open-{current,dev}.log. Full unchanged retry .scratch/run9/listener-pair-tests-fast-retry2.log pending before test commit; no threshold changes.

Listener-test gate: all tests and static rows passed after fixture correction, but rustfmt requested wrapping one assertion (now corrected). Formatted retry then failed unchanged embedded terminal-open under load36.33/28.72/25.10 on8cores; idle14992KiB/zero scheduled slices. Exact CPUWeight10000 workspace comparison: current PASS39.76s/14984KiB vs dev ac03b19 PASS39.75s/11852KiB; both4710396 bytes across24 abrupt restarts, zero idle slices. Logs .scratch/run9/listener-open-{current,dev}.log. Full unchanged retry .scratch/run9/listener-pair-tests-fast-retry2.log pending before test commit; no threshold changes.

kayg commented

2026-10-08 18:12:41 +00:00

Author

Owner

Completed real socket regressions: forced UDP retry/TCP release and explicit-port refusal with retained fixture ownership. Fast green; no threshold changes.
Head 8054e6358f. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/listener-pair-tests-fast-retry2.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19178800 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16110848 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3995.05ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.60ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.04s]

Completed real socket regressions: forced UDP retry/TCP release and explicit-port refusal with retained fixture ownership. Fast green; no threshold changes. Head 8054e6358fefad87c731725556466cf80eccc1df. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/listener-pair-tests-fast-retry2.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19178800 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16110848 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3995.05ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.60ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.04s]

kayg commented

2026-10-08 18:17:38 +00:00

Author

Owner

R2 shipping CLI failing-first proof: separate rootless static release process connects, browser opens real shim session, idle settles, kernel socket ownership confirms QUIC. Fixture CA unlock at half-life then no renewed admission/durable Ack within5s: test FAIL16.71s at replacement waiter, .scratch/run9/cli-renewal-red2.log. Current CLI calls remote_client::run without a CertificatePublisher/capability, so server cannot renew it. CPU helper uses POSIX process clock through libc (Python thread clock helper rejected). Implementing private atomic/fsynced certificate-only replacement and run_with_publisher; fixture unlock is explicitly memory-only test policy, not the missing R3 production administrator adapter.

kayg commented

2026-10-08 18:33:13 +00:00

Author

Owner

Completed shipping CLI renewal publisher source: private certificate-only atomic/fsynced replacement, existing key and enrollment metadata retained. Real release CLI failing-first reproduction and publication preview recorded; positive live proof and R3 administrator adapter still pending.
Head 1f6e39b8cb. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/cli-publisher-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19186896 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16118176 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4202.82ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.68ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.26s]

Completed shipping CLI renewal publisher source: private certificate-only atomic/fsynced replacement, existing key and enrollment metadata retained. Real release CLI failing-first reproduction and publication preview recorded; positive live proof and R3 administrator adapter still pending. Head 1f6e39b8cb11c3af39b0173e6b2c69f059fa9dc9. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/cli-publisher-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19186896 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16118176 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4202.82ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.68ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.26s]

kayg commented

2026-10-08 18:37:19 +00:00

Author

Owner

R2 positive release CLI proof on1f6e39b: rootless QUIC confirmed by child-owned kernel UDP socket; exact network socket unchanged across renewal. Durable certificate SHA256 equals admitted replacement; host key/hostID unchanged; before/after idle canaries PASS. Single local sample agentCPU2983721ns, unlock-to-admitted-Ack34365us, RSS11560->11744KiB (+184KiB; hypothetical1000-agent aggregate +184000KiB, not server-host registry RSS). Machine infraternal-dev/8cores/load29.57/29.25/25.31; no own build overlapped measurement. Log .scratch/run9/cli-renewal-quic-green.log, PASS22.80s. Fixture CA unlock is memory-only test policy; TCP/flood/bytes, R3 real administrator unlock and1000-host runtime evidence still pending.

kayg commented

2026-10-08 18:39:23 +00:00

Author

Owner

Correction to positive QUIC proof comment: the reused idle_canary is opt-in and INFRATERNAL_REMOTE_IDLE_CANARY was absent, so the before/after calls returned without measuring. CPU/RSS/socket/durable-identity results remain actual; no idle evidence was collected in those initial runs. Test now requires the canary flag and reruns both transports with10s process-event sampling; also recording settled RSS after blocking-worker retirement separately from immediate renewal RSS. TCP initial run passedCPU2078179ns/Ack50769us/RSS11844->13964KiB; no steady-RSS claim from that transient window.

kayg referenced this issue

2026-10-08 18:39:46 +00:00

Relay mode (TURN in the binary) and the WebRTC direct path, side by side (D128, D131, D132, D185) #103

kayg commented

2026-10-08 18:42:09 +00:00

Author

Owner

R2 corrected QUIC idle proof: required canary enabled; actual zero scheduler activations over10.004s before and10.001s after renewal, threads1. AgentCPU1880617ns, Ack53886us, RSS11692->11840KiB (+148KiB immediate AND settled after11s worker retirement; aggregate1000agents +148000KiB, not server registry measurement). Release1f6e39b hostkey/durableleaf/ownedUDPsocket retained. Local one sample; infraternal-dev8cores/load26.82/21.48/22.48. .scratch/run9/cli-renewal-quic-idle.log PASS43.68s; no own compilation overlapped measurement. TCP canary/flood/bytes/1000runtime-host evidence next.

kayg commented

2026-10-08 18:52:29 +00:00

Author

Owner

R2 corrected TCP idle proof: required event canary records zero activations10.003s before/10.001s after, threads1. AgentCPU1765972ns/Ack32181us/RSS11856->11928KiB (+72KiB immediate and settled after11s retirement; 1000-agent aggregate +72000KiB, not server registry RSS). Actual child-owned TCP socket unchanged, renewed diskleaf matches admission, hostkey retained. 1f6e39b release/static, single local sample infraternal-dev8cores/load38.11/27.19/24.42; no own build overlap. Log .scratch/run9/cli-renewal-tcp-idle.log PASS45.16s. Initial2120KiB RSS spike did not recur in this corrected sampling; no distribution claim. Combined renewal tests preflight clippy PASS; 50MiB continuity proof running.

R2 corrected TCP idle proof: required event canary records zero activations10.003s before/10.001s after, threads1. AgentCPU1765972ns/Ack32181us/RSS11856->11928KiB (+72KiB immediate and settled after11s retirement; 1000-agent aggregate +72000KiB, not server registry RSS). Actual child-owned TCP socket unchanged, renewed diskleaf matches admission, hostkey retained. 1f6e39b release/static, single local sample infraternal-dev8cores/load38.11/27.19/24.42; no own build overlap. Log .scratch/run9/cli-renewal-tcp-idle.log PASS45.16s. Initial2120KiB RSS spike did not recur in this corrected sampling; no distribution claim. Combined renewal tests preflight clippy PASS; 50MiB continuity proof running.

kayg commented

2026-10-08 19:12:50 +00:00

Author

Owner

Finding from R2 50MiB proof: real CLI/browser QUIC terminal closes1013/1011 (latest114897 bytes delivered), not a successful continuity proof; logs .scratch/run9/cli-renewal-flood-quic{2,-diagnostic}.log, machine8cores/load26-51. Targeted real QUIC+Unix paused-shim regression confirms native dispatch retires a live stream when32 legitimate Credit frames fill its8-slot command queue: FAIL0.03s, .scratch/run9/native-credit-red2.log. Native stream has its own dispatcher, unlike TCP shared host dispatch. Proposed correction: preserve8-slot bound and await that private queue so QUIC flow control applies, while shared host dispatch stays nonblocking. No engine/dependency/budget change. Source and regression separate gated commits; then rerun unchanged byte-integrity flood.

kayg commented

2026-10-08 19:30:32 +00:00

Author

Owner

Native credit fix preview PASS0.13s after FAIL0.03s; only private native dispatcher awaits bounded8-slot capacity. Source fast first retry hit unchanged debug RSS limit. Required scoped exactworkspace comparison current PASS47.14s/14796KiB vs devac03b19 PASS46.08s/11740KiB, both4710396 bytes/24 restarts/zero idle slices; logs .scratch/run9/native-credit-rss-{current,dev}.log. Separate idle smaps: current14932KiB vsdev11896KiB; executableRX6208vs4096KiB andRO6128vs5004KiB; heap72vs84KiB. Most inherited remote-phase debug RSS delta is executable mappings, not retained heap; no improvement/distribution claim. .scratch/run9/idle-maps.log. Full unchanged gate retry pending; static19188880/16120224 within existing limits.

kayg commented

2026-10-08 19:41:34 +00:00

Author

Owner

R2 50MiB QUIC continuity proof now PASS23.35s with private native8-slot backpressure fix (source not yet committed; full gate retry required). Exact52428800 y/newline bytes, all out-seqs contiguous, lost0/duplicates0/Snapshots0, same ownedUDPsocket, renewal acknowledged during flood, same browser writer. Transfer22421997us, agentRSS11924KiB; infraternal-dev8cores/load41.61/39.46/34.69, no own build during measurement. .scratch/run9/cli-renewal-flood-quic-after-credit.log. Earlier native credit regression FAIL0.03s->PASS0.13s; shared TCP path unchanged. TCP fallback flood next; green full source and separate test gates still pending.

kayg commented

2026-10-08 19:44:24 +00:00

Author

Owner

R2 TCP fallback50MiB proof remains red: code1 attachment closure after7128139 bytes, .scratch/run9/cli-renewal-flood-tcp.log FAIL1.24s. Shared dispatcher8-slot command queue can still reject bursts of legitimate Credit; unlike private QUIC it must not await per-session capacity. Need bounded nonblocking credit accumulation while preserving Input/Resize order and shared control isolation. QUIC proof remains PASS all52428800 bytes after its private backpressure correction. No threshold/buffer increases; native source green gate and separate tests pending before TCP module fix.

kayg referenced this issue

2026-10-08 19:55:24 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 20:03:57 +00:00

Author

Owner

Native QUIC Credit backpressure committed. Failing-first native-credit-red2.log closed in 0.03s; corrected source passes the regression in 0.13s and actual CLI renewal flood delivers 52,428,800 bytes, zero lost/duplicated bytes, unchanged UDP socket (23.35s; fixture server is debug). Unchanged Snapshot regression passes under CPUWeight10000 on both current (32.09s) and dev (39.66s); no threshold changes.
Head c7312bec6b. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/native-credit-source-fast-final.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4282.58ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.49ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.33s]

Native QUIC Credit backpressure committed. Failing-first native-credit-red2.log closed in 0.03s; corrected source passes the regression in 0.13s and actual CLI renewal flood delivers 52,428,800 bytes, zero lost/duplicated bytes, unchanged UDP socket (23.35s; fixture server is debug). Unchanged Snapshot regression passes under CPUWeight10000 on both current (32.09s) and dev (39.66s); no threshold changes. Head c7312bec6b448c148e455a5c3e28f6d98f27f7ec. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/native-credit-source-fast-final.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4282.58ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.49ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.33s]

kayg commented

2026-10-08 20:14:22 +00:00

Author

Owner

Native credit regression committed: real QUIC/Unix paused-handshake test passes in the complete workspace gate; failing-first evidence native-credit-red2.log. No thresholds changed.
Head 5f7b70128f. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/native-credit-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2972.64ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.94ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.00s]

Native credit regression committed: real QUIC/Unix paused-handshake test passes in the complete workspace gate; failing-first evidence native-credit-red2.log. No thresholds changed. Head 5f7b70128fe26a3e646198f8a27a14d789efc4dc. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/native-credit-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2972.64ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.94ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.00s]

kayg commented

2026-10-08 20:23:45 +00:00

Author

Owner

R2 live-control proof preview: both actual mTLS publication-Ack tests pass0.85s (cold-locked waits until unlock; successful durable Ack advances admitted identity; failed publication retains predecessor; terminal input/output stays usable). Successful four-frame exchange1779 TCP mux application bytes /1775 raw QUIC-frame bytes; failed publication1771/1767. These counts exclude TLS/QUIC/IP encryption and packet headers, not packet capture. Tests remain uncommitted pending full slice gate. .scratch/run9/renewal-ack-preview.log. TCP Credit helper accounting4/4PASS0.11s; actual50MiB static proof next.

kayg commented

2026-10-08 20:27:53 +00:00

Author

Owner

TCP Credit accumulator preview now passes actual rootless static CLI renewal50MiB proof:52428800bytes/lost0/duplicates0/Snapshots0/sameownedTCPsocket, renewalAckduringflood.98.79stest /98193507us transfer, agentRSS12100KiB; infraternal-dev8cores/load33.68/28.76/27.51, fixture server debug. Beforefix code1close at7128139bytes1.24s; afterfix allbytes delivered, but98s transfer is slow and is not an acceptable throughput claim. Investigating throughput before source completion gate; thresholds unchanged. .scratch/run9/cli-renewal-flood-tcp-after-credit.log.

kayg commented

2026-10-08 20:30:47 +00:00

Author

Owner

TCP bounded credit source gate running (uncommitted). Updated CLI also passes QUIC50MiB exact52428800 bytes/lost0/duplicates0/noSnapshot/renewalAckduringflood/unchangedUDPsocket:27992962us transfer, agentRSS12096KiB, test28.90s, machine8cores/load19.39/25.24/26.38. Prior native-onlyQUIC sample22421997us atload41.61; different loaded samples do not establish no regression. TCP complete transfer98193507us; predecessor failed7.1MiB, so cannot supply a valid complete TCP baseline. Microbenchmark comparing healthy existing FIFO coordination versus accumulated credit prepared for test slice. Logs .scratch/run9/cli-renewal-flood-{tcp-after-credit,quic-after-shared-credit}.log.

kayg commented

2026-10-08 20:35:52 +00:00

Author

Owner

TCP credit source fast first run hits unchanged daemon debugRSS15MiB assertion before any attachment (newperterminalcreditchannel not allocated yet); no threshold changes. Required CPUWeight10000 exacttestcomparison bothPASS: current43.22s/14720KiB vs devac03b19archive40.02s/12060KiB, both4710396payloadbytes24abruptrestarts/0idle slices. Logs shared-credit-rss-{current,dev}.log, load11.54/17.06/22.36 duringcomparison. Sourcefast staticx86passes19200016bytes (+11136vsnativecredit); ARMbuilding, then fullretryrequired.

kayg commented

2026-10-08 20:42:05 +00:00

Author

Owner

Finding: source retryRSS passed, but unchanged verify-agent-isolation.py waits for Close after9Credit frames (shared-credit-source-fast-retry.log), contradicting legitimate Credit coalescing. This is ours, not a load flake. Adjust the overload regression to9 ordered Input commands while the same real shim State handshake is held: preserve8-slot FIFO, control/sibling isolation and existing1s deadline. Proposal: Credit is fungible boundedu64 allowance, not FIFO workload; ordered Input/Resize remain8 slots. Commit test adjustment first against predecessor source with fullgate, then restore accumulator and gate its own source commit. New helper regression separately covers32Credits plus8Inputs/exactgrant/overflow/cancellation. No threshold increases.

kayg referenced this issue

2026-10-08 20:43:49 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 20:52:32 +00:00

Relay mode (TURN in the binary) and the WebRTC direct path, side by side (D128, D131, D132, D185) #103

kayg commented

2026-10-08 20:58:52 +00:00

Author

Owner

Ordered Input overload isolation regression committed before the TCP source fix. Real held-shim preview294.308ms, unchanged8-slot bound and1sdeadline, Close/siblingOutput/Pong all before barrier release. Fast retry completely green; initial unchanged preattachmentRSS assertion is recorded with scoped comparisons and workspace mapping evidence. No thresholds changed.
Head 2f6ed99cb3. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ordered-input-isolation-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3092.82ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.66ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.12s]

Ordered Input overload isolation regression committed before the TCP source fix. Real held-shim preview294.308ms, unchanged8-slot bound and1sdeadline, Close/siblingOutput/Pong all before barrier release. Fast retry completely green; initial unchanged preattachmentRSS assertion is recorded with scoped comparisons and workspace mapping evidence. No thresholds changed. Head 2f6ed99cb37b82bf5f6a316458f4fb187f1cf462. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ordered-input-isolation-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3092.82ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.66ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.12s]

kayg referenced this issue

2026-10-08 21:07:32 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 21:10:21 +00:00

Author

Owner

Debug idleRSS distribution (sourceaccumulatoruncommitted, no active terminal):20 paired startups currentmin15072/p5015348/max15548KiB,8/20>=15360budget; devac03archive11716/11836/12032,0/20fail. Load22.47/31.21/28.92->21.53/30.14/28.64; CPUWeight10000. Mapping evidence mainly executable/read-only pages, heap72vs84KiB. Current/debug aggregate1000daemons median15348000KiB vs11836000, NOTrelease or connected-host serverregistry. .scratch/run9/idle-rss-distribution.log. Fullgate retrycurrentlypasses restart/queue/isolation; a singlegreenrun willnotresolve this distribution. Preservethreshold; working-set measurement/optimization remains needed alongside final D167release/server-scale metrics.

kayg commented

2026-10-08 21:17:59 +00:00

Author

Owner

Source fast retry RSS/restart/queue/isolation pass; unchanged review3_backend_reply_has_a_deadline fails elapsed1.996517173s vs configured2s (shared-credit-source-fast-final-retry.log). Stopwatch starts after reading the backend Call although the RPC timer is already running. Required scoped currentPASS2003ms/3.35stest; devac03archivePASS60003ms/60.93stest. IMPORTANT devarchive uses original60s timeout, currentfixture2s, so not equal-duration performance evidence. Logs shared-credit-deadline-{current,dev}.log, load23.31/24.69/26.50. No timeout/threshold changes; fullretryrequired.

kayg referenced this issue

2026-10-08 21:24:59 +00:00

Relay mode (TURN in the binary) and the WebRTC direct path, side by side (D128, D131, D132, D185) #103

kayg commented

2026-10-08 21:39:07 +00:00

Author

Owner

Snapshot comparison: scopedcurrentFAIL16.19s atone-byte pause assertion (not finalreattach); devac03PASS79.63s/allfour12MiBfloods/sameSnapshotcursors. Earlierfullcurrentfail was staleOutputat finalreattach; distinctfailures. Logs shared-credit-snapshot-{current,dev}.log. Found actual draftaccumulatorbug: randomselect could grant laterCredit before earlierInput. Deterministic credit_order test FAIL0.01s beforefix; now5helpertestsPASS0.03s with cumulative credit_before fences, exactorder acrossInput/Resize and mutable(singleproducer) admission. Legitimate consecutiveCreditsstillconstantspace/nonblocking8InputFIFO. Sourceuncommitted, realSnapshot rerunandfullgatepending; no thresholds changed. credit-order-{red,green}.log.

kayg referenced this issue

2026-10-08 21:40:10 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 22:01:22 +00:00

Author

Owner

Ordered credit fences pass realSnapshot4x12MiB,3tiny-creditpauses andfinalring-wrapSnapshot in168.69s (shared-credit-snapshot-ordered.log, highload49). Final5accounting/orderunit testsPASS0.11s andclippyclean31.32s. Sourcefullgate nowpassesRSS/restart/queue/isolation/Snapshot, but unchangedvt_credit fails5s detached12MiB producer ready marker. Required scoped currentFAIL9.93s anddevac03FAIL11.45s with IDENTICAL ready assertion (shared-credit-vt-{current,dev}.log and corresponding target/review-vt3-fixes/t1-gate-approximate-1.stderr.log). Load38.36/39.19/36.29. No threshold changes. Sourcex86staticpasses19212016bytes (+12000vsunfenceddraft, +23136vsnative-source), ARMbuilding, fullretryrequired.

kayg commented

2026-10-08 22:24:49 +00:00

Author

Owner

Gate environment cause verified: testscopeCPUWeight10000, fixture-owned detachedshimScopeCPUWeightnotset(default), because systemd launches eachshim in a separate surviving scope. Exactowned unit runtimeweight10000 succeeds; cleanup removesfixture/shim. .scope-weight-proof.log. Adhoc unchangedonebyteapproximate probePASS302.5ms atload67.94 withownedshimweightmatchinggate vsbothcurrent/dev5sproducerFAIL atdefaultweight. Reusable agent_fixture.py correction appliesnondefault parentcpu.weight ONLYto UUID-owned loadedshimscope; detached/non-cgroup/defaultweight unchanged. Predecessor source allfourunchangedvt_credit casesPASS16.78s, onebyteapprox resumed2MiB304.1ms, load81.32/70.70/61.12. Productionlauncher andallnumericassertionsUNCHANGED. .fixture-priority-vt-preview.log; fixture-onlyfullgate nextbeforeseparatecommit, thenrestorefencedaccumulator.

kayg commented

2026-10-08 22:41:48 +00:00

Author

Owner

Completed test-scope priority correction only. Detached fixture shims now inherit the requested gate CPUWeight; production launcher, deadlines and assertions remain unchanged. Current/dev both failed the original 5 s producer deadline at default shim priority; all four VT credit cases passed in 16.78 s with matching priority at load 81.32 on eight cores.
Head 434d4ff6ed. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/fixture-priority-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3446.49ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [24.36ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.50s]

Completed test-scope priority correction only. Detached fixture shims now inherit the requested gate CPUWeight; production launcher, deadlines and assertions remain unchanged. Current/dev both failed the original 5 s producer deadline at default shim priority; all four VT credit cases passed in 16.78 s with matching priority at load 81.32 on eight cores. Head 434d4ff6ede62d7f503f886cd8f1b3fbf6f68346. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/fixture-priority-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3446.49ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [24.36ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.50s]

kayg commented

2026-10-08 23:04:01 +00:00

Author

Owner

Fenced credit source gate is red only at auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket: unexpected WebSocket close, 140 other server tests passed. All real daemon restart/queue/isolation/Snapshot/VT gates passed. Static x86 19,212,016 and ARM 16,137,984 bytes pass unchanged limits. Load reached 90.21 on 8 cores; CPUWeight=10000, RUST_TEST_THREADS=4. Isolated current rerun in the same CPU scope passed in 2.88 s: 16/16 devices received start/cancel, other account 0. This test does not exist on ac03b19; comparing with current dev 1c3ae5f (identical test source) before retrying the full gate serially. Logs: fenced-credit-source-fast.log and credit-recovery-current.log. No threshold changes; source remains uncommitted.

Fenced credit source gate is red only at auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket: unexpected WebSocket close, 140 other server tests passed. All real daemon restart/queue/isolation/Snapshot/VT gates passed. Static x86 19,212,016 and ARM 16,137,984 bytes pass unchanged limits. Load reached 90.21 on 8 cores; CPUWeight=10000, RUST_TEST_THREADS=4. Isolated current rerun in the same CPU scope passed in 2.88 s: 16/16 devices received start/cancel, other account 0. This test does not exist on ac03b19; comparing with current dev 1c3ae5f (identical test source) before retrying the full gate serially. Logs: fenced-credit-source-fast.log and credit-recovery-current.log. No threshold changes; source remains uncommitted.

kayg commented

2026-10-08 23:05:31 +00:00

Author

Owner

Scoped recovery subscription comparison: current PASS 2.88 s; dev 1c3ae5f PASS 3.64 s, both CPUWeight=10000, one test thread, identical test source and all original assertions. Both delivered recovery start/cancel to 16/16 devices, with zero cross-account events. Latest measured load 57.60/66.41/72.47 on 8 cores. ac03b19 lacks this newer test. Logs credit-recovery-{current,dev}.log. The full unchanged fenced-credit source gate is now rerunning serially; no thresholds relaxed.

Scoped recovery subscription comparison: current PASS 2.88 s; dev 1c3ae5f PASS 3.64 s, both CPUWeight=10000, one test thread, identical test source and all original assertions. Both delivered recovery start/cancel to 16/16 devices, with zero cross-account events. Latest measured load 57.60/66.41/72.47 on 8 cores. ac03b19 lacks this newer test. Logs credit-recovery-{current,dev}.log. The full unchanged fenced-credit source gate is now rerunning serially; no thresholds relaxed.

kayg commented

2026-10-08 23:16:10 +00:00

Author

Owner

Second fenced-credit gate failure was the unchanged legacy Snapshot Ping assertion (vt_reconnect), not terminal loss. Scoped ordinary current and ac03b19 probes both passed. A deterministic real-shim retry queued stream 1 InputAck (kind 0x13, 8 bytes) before the later control Pong; the old next-frame assertion failed. Logs credit-reconnect-{current,dev,order-red}.log. Shared Binary.ping now waits for the exact nonce/timestamp Pong, processes intervening terminal frames with the existing cursor/event validation, rejects Close, and uses ONE original 20 s socket budget across the whole probe. The legacy approximation assertion remains and now covers frames received while waiting too. Identical delayed-credit probe passes both wrapped/less fixtures and subsequent live output (credit-reconnect-order-green.log). Fenced source saved/restored to predecessor; gating this fixture correction separately before the transport source commit.

Second fenced-credit gate failure was the unchanged legacy Snapshot Ping assertion (vt_reconnect), not terminal loss. Scoped ordinary current and ac03b19 probes both passed. A deterministic real-shim retry queued stream 1 InputAck (kind 0x13, 8 bytes) before the later control Pong; the old next-frame assertion failed. Logs credit-reconnect-{current,dev,order-red}.log. Shared Binary.ping now waits for the exact nonce/timestamp Pong, processes intervening terminal frames with the existing cursor/event validation, rejects Close, and uses ONE original 20 s socket budget across the whole probe. The legacy approximation assertion remains and now covers frames received while waiting too. Identical delayed-credit probe passes both wrapped/less fixtures and subsequent live output (credit-reconnect-order-green.log). Fenced source saved/restored to predecessor; gating this fixture correction separately before the transport source commit.

kayg commented

2026-10-08 23:28:45 +00:00

Author

Owner

Completed shared correlated-Pong fixture correction. Real delayed-credit reproduction failed on a valid queued InputAck (stream 1, kind 0x13); the corrected probe passes wrapped/less recovery and subsequent live output. Existing cursor/event checks, Close rejection and approximation rejection remain; no timeout increase. This gate used predecessor transport source, with the fenced accumulator still saved and uncommitted.
Head 589a59dc42. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/correlated-pong-fixture-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2347.55ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [6.87ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.37s]

Completed shared correlated-Pong fixture correction. Real delayed-credit reproduction failed on a valid queued InputAck (stream 1, kind 0x13); the corrected probe passes wrapped/less recovery and subsequent live output. Existing cursor/event checks, Close rejection and approximation rejection remain; no timeout increase. This gate used predecessor transport source, with the fenced accumulator still saved and uncommitted. Head 589a59dc4228b4d6d1e074614450c43b3ebe2003. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/correlated-pong-fixture-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 19188880 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2347.55ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [6.87ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.37s]

kayg commented

2026-10-08 23:44:10 +00:00

Author

Owner

Idle RSS reproduces at low load too: 20 current starts median 15,304 KiB, max 15,456, 8/20 over 15 MiB; dev ac03b19 0/20, median 11,828 KiB (load 10.14→13.07, 8 cores). Erasing only the inherited entry future did not help: paired medians 15,356/15,348 KiB, 9/20 failures on both. Experiment discarded. Resident ELF attribution (owned-process pagemap metadata only) identifies current .text 6,582 KiB and .rela.dyn 3,433 KiB versus dev 3,998/2,761 KiB; unwind sections are nearly nonresident. Logs entry-future-rss-{before,paired}.log and resident-sections.log. Testing existing-linker relative-relocation packing next, without profile/threshold changes or crypto-engine substitutions; GNU ABI compatibility and static-musl loader support must be measured before any configuration is kept.

Idle RSS reproduces at low load too: 20 current starts median 15,304 KiB, max 15,456, 8/20 over 15 MiB; dev ac03b19 0/20, median 11,828 KiB (load 10.14→13.07, 8 cores). Erasing only the inherited entry future did not help: paired medians 15,356/15,348 KiB, 9/20 failures on both. Experiment discarded. Resident ELF attribution (owned-process pagemap metadata only) identifies current .text 6,582 KiB and .rela.dyn 3,433 KiB versus dev 3,998/2,761 KiB; unwind sections are nearly nonresident. Logs entry-future-rss-{before,paired}.log and resident-sections.log. Testing existing-linker relative-relocation packing next, without profile/threshold changes or crypto-engine substitutions; GNU ABI compatibility and static-musl loader support must be measured before any configuration is kept.

kayg referenced this issue

2026-10-08 23:46:59 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 23:48:02 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-08 23:50:44 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 23:52:48 +00:00

Author

Owner

#87 local two-process rootless provisioning fixture exposed a CLI integration mismatch before production source changes. Proposed additive CLI boundary: infraternal agent --data DATA join URL --enroll-only consumes the existing invitation JSON on stdin, persists pinned enrollment identity and returns without starting the foreground daemon. The installer then activates infraternal agent --data DATA --state SESSIONS run as the normal-user service. --enroll-only is additive; ordinary join retains its current foreground behavior. The exact #78 invitation/remote wire shapes remain unchanged. Isolated snapshot 1f6e39b plus this fixture addition passed actual installation, pinned mTLS, native facts and browser PTY on ten uids; all marked installations removed. Evidence on #87: provision-cli-red.log (failing first), provision-cli-green.log and provision-ten.log. Production dev still lacks #78; owner/runtime integration must provide this boundary before production provisioning can be enabled.

#87 local two-process rootless provisioning fixture exposed a CLI integration mismatch before production source changes. Proposed additive CLI boundary: `infraternal agent --data DATA join URL --enroll-only` consumes the existing invitation JSON on stdin, persists pinned enrollment identity and returns without starting the foreground daemon. The installer then activates `infraternal agent --data DATA --state SESSIONS run` as the normal-user service. `--enroll-only` is additive; ordinary join retains its current foreground behavior. The exact #78 invitation/remote wire shapes remain unchanged. Isolated snapshot 1f6e39b plus this fixture addition passed actual installation, pinned mTLS, native facts and browser PTY on ten uids; all marked installations removed. Evidence on #87: provision-cli-red.log (failing first), provision-cli-green.log and provision-ten.log. Production dev still lacks #78; owner/runtime integration must provide this boundary before production provisioning can be enabled.

kayg referenced this issue

2026-10-08 23:52:49 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-08 23:56:51 +00:00

Author

Owner

Relative relocation packing preview: identical normal GNU builds, 20 paired idle starts: median 14,780→11,408 KiB (-3,372 KiB), maxima 14,968→11,592 KiB; .rela.dyn 3.4 MiB becomes 4,584 bytes plus 32,288-byte RELR. No profile or limit changes. Five paired direct-RTT control samples (25,000 correlated Pongs/side, no own compilation): packed p50/p99 218.310/538.538 us, predecessor 214.407/481.536 us; process CPU median 80,000 vs 72,000 ns/Ping, 100 Hz accounting. The observed +3.903/+57.002 us and +8,000 ns are a measured cost, not a speedup claim; testing shipping static-musl startup next before retaining config. The first oversize control run inherited the default 300 ms RTT and was interrupted/cleaned with no reported result; rerun explicitly INFRATERNAL_TEST_RTT=0. Logs packed-relocations-{rss,control-direct}.log. GNU RELR requires glibc>=2.36; musl static-PIE support was added in 1.2.4 (official release notes), actual bundled CRT still needs execution proof.

kayg commented

2026-10-09 00:03:46 +00:00

Author

Owner

Packed x86 static musl prototype executes successfully (--help plus real 24-stop PTY oracle): 4,710,396 exact replay bytes, all four stop positions x6, no loss/duplication. RELRSZ=14,152 bytes; file shrinks 19,212,016→18,106,064 bytes (-1,105,952). Actual bundled CRT therefore supports the format; no host-libc dependency was added. Keeping this optimization only for proven x86 GNU/musl targets for now; ARM remains on ordinary relocations pending its separate proof. New single-CLI build module reuses pinned linkers and leaves profiles/thresholds unchanged. The observed direct control p99 cost is +57 us; a 1,000-Ping burst projects +8 ms summed host-daemon CPU from the coarse 100 Hz median, in exchange for -3,372 KiB median debug-daemon RSS and a >1 MiB shipping size reduction. These are component projections, not 1,000 connected-server-host acceptance. GNU output already required strong GLIBC_2.38 without packing (RELR needs 2.36). Source fixture baseline restored; running a separate requested Nix fast gate for this build change before restoring fenced credit source. Logs packed-musl-{help,functional}.log and packed-relocations-*.

kayg referenced this issue

2026-10-09 00:08:24 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-09 00:10:20 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 00:12:22 +00:00

Author

Owner

Packing build-change gate failed only in the old embedded command FIFO: Close "terminal command queue full; reattach and replay unacknowledged input" at restart1 after all 470,784 payload bytes but before the final 17-byte marker Ack. Idle RSS now PASS 11,816 KiB; agent/shim idle scheduled slices=0. Both static sizes PASS (x86 packed 18,087,024; ARM unchanged 16,120,224). Required CPUWeight10000 functional reruns: current and dev ac03b19 both PASS all 24 stops/4,710,396 bytes. Logs packed-credit-queue-{current,dev}.log; load 20.24 during failed gate, 6.02 after scopes, 8 cores. No threshold changes. Retrying full build-only gate with saved fenced-credit source still excluded; that source will be the separate logical commit for legitimate credit bursts.

Packing build-change gate failed only in the old embedded command FIFO: Close "terminal command queue full; reattach and replay unacknowledged input" at restart1 after all 470,784 payload bytes but before the final 17-byte marker Ack. Idle RSS now PASS 11,816 KiB; agent/shim idle scheduled slices=0. Both static sizes PASS (x86 packed 18,087,024; ARM unchanged 16,120,224). Required CPUWeight10000 functional reruns: current and dev ac03b19 both PASS all 24 stops/4,710,396 bytes. Logs packed-credit-queue-{current,dev}.log; load 20.24 during failed gate, 6.02 after scopes, 8 cores. No threshold changes. Retrying full build-only gate with saved fenced-credit source still excluded; that source will be the separate logical commit for legitimate credit bursts.

kayg commented

2026-10-09 00:19:55 +00:00

Author

Owner

Completed x86 single-CLI relocation packing. Reused pinned linkers, no profile or threshold changes. Paired median normal-debug RSS 14,780→11,408 KiB; observed direct P50/P99 218/539 vs 214/482 us, CPU 80 vs 72 us/Ping, recorded as a cost. Actual x86 static loader and 24-stop/4,710,396-byte oracle pass. ARM unchanged pending separate execution proof. This gate contains predecessor transport source; the fenced credit accumulator remains the next separate source slice.
Head cf82af3102. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/packed-relocations-source-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18087024 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3037.74ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.94ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.08s]

Completed x86 single-CLI relocation packing. Reused pinned linkers, no profile or threshold changes. Paired median normal-debug RSS 14,780→11,408 KiB; observed direct P50/P99 218/539 vs 214/482 us, CPU 80 vs 72 us/Ping, recorded as a cost. Actual x86 static loader and 24-stop/4,710,396-byte oracle pass. ARM unchanged pending separate execution proof. This gate contains predecessor transport source; the fenced credit accumulator remains the next separate source slice. Head cf82af3102deb396293a9270c4ad41eef92fb270. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/packed-relocations-source-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18087024 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16120224 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3037.74ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.94ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.08s]

kayg commented

2026-10-09 00:32:17 +00:00

Author

Owner

Completed shared TCP session coordination: constant-space Credit, eight ordered Input/Resize slots, exact credit fences preserved across cancellation. Native QUIC retains independent awaited admission. Full fast green; real restart, Snapshot recovery and sibling isolation pass.
Head c83605c974. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/fenced-credit-after-packing-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2704.88ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.14ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.73s]

Completed shared TCP session coordination: constant-space Credit, eight ordered Input/Resize slots, exact credit fences preserved across cancellation. Native QUIC retains independent awaited admission. Full fast green; real restart, Snapshot recovery and sibling isolation pass. Head c83605c9742301cad162d4f370902ff5a013ea75. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/fenced-credit-after-packing-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2704.88ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.14ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.73s]

kayg commented

2026-10-09 00:33:56 +00:00

Author

Owner

Shared-credit coordination diagnostic on 8-core infraternal-dev, CPUWeight10000, release, 25 alternating paired samples, no own build/browser overlap; external load 40.73/45.34/41.35. Per sample: 800,000 credits in bursts of eight and 80,000 one-byte Input allocations. Credit p50/p99: accumulator 169/181 ns vs predecessor bounded FIFO 63/103 ns; Input 106/132 ns vs 71/84 ns. This is a measured coordination cost (+106 ns/credit, +35 ns/Input median), justified by exact burst handling without closing a healthy TCP session or blocking sibling/control routing; no speedup claim. At 1,000 hosts each sending 1,000 Input/s, median component projection is +35 ms CPU/s, not a measured full-server scale result. Sender/receiver inline sizes 16/72 bytes exclude channel heap allocations and transport. Five ordering/overflow/cancellation tests pass. Logs .scratch/run9/credit-coordination-release.log and credit-tests-current.log; test-slice full gate now running.

kayg commented

2026-10-09 00:51:48 +00:00

Author

Owner

Completed credit coordination test slice: five burst/ordering/overflow/cancellation regressions and release paired benchmark. Measured median cost +106 ns/Credit and +35 ns/Input versus predecessor FIFO; exact scope and host load posted in preceding finding. Both exact R1 review regressions pass.
Head 78170e2c19. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/credit-tests-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [7003.75ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [22.53ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [7.07s]

Completed credit coordination test slice: five burst/ordering/overflow/cancellation regressions and release paired benchmark. Measured median cost +106 ns/Credit and +35 ns/Input versus predecessor FIFO; exact scope and host load posted in preceding finding. Both exact R1 review regressions pass. Head 78170e2c199a003f1aa0a1032194f1682f8b59ec. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/credit-tests-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [7003.75ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [22.53ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [7.07s]

kayg commented

2026-10-09 00:57:30 +00:00

Author

Owner

Current fenced/packed release CLI live renewal over QUIC passes: retained one UDP socket and unchanged host key; atomic durable certificate matches server Ack. CLI CPU 2,170,998 ns, wall 46,520 us, RSS 10,880 to 11,020 KiB (+140), settled +140 after 11 s. Zero scheduler activations in each independent 10 s pre/post canary, one thread. Debug server fixture CPU 6,902,150 ns, RSS +92 KiB; this includes co-located browser/test coordination, not isolated shipping-server cost. Machine infraternal-dev, 8 cores, load 68.96/62.55/47.38; no own build/browser overlap during measurement. Log .scratch/run9/renewal-final-quic-cost-retry.log. First unchanged run reset the browser during setup (0.89 s), before any renewal measurement, at load 65.80/61.02/46.08; log renewal-final-quic-cost.log retained. No timeout/threshold edits; unchanged scoped rerun passed46.04 s. Seven active renewal preflight regressions also pass2.49 s; current canonical successful exchange is1790 TCP-mux application bytes /1786 raw QUIC frame bytes, excluding encryption/packet headers. TCP cost and exact50MiB proofs next.

kayg commented

2026-10-09 00:58:45 +00:00

Author

Owner

Current release CLI TCP live-renewal cost PASS45.61 s: same single TCP socket, unchanged host key, durable certificate equals acknowledged fingerprint. CLI CPU1,243,409 ns, wall45,056 us, RSS10,932→11,072 KiB (+140), settled+140; independent10.000/10.001 s pre/post canaries each0 scheduler activations,1 thread. In-process debug server fixture CPU4,615,320 ns/RSS+92 KiB includes browser+measurement coordination, not isolated production server. 8-core infraternal-dev load67.79/63.87/49.11; no own compilation overlap during measurement. Log .scratch/run9/renewal-final-tcp-cost.log. At1,000 agents the observed CLI +140 KiB/agent projects to136.72 MiB retained RSS; it is a projection, not1000 connected hosts measured. One renewal each totals1.24 s CLI CPU across1000 processes (synchronization excluded). Exact credited50MiB tests now running on final fenced packed artifact.

kayg commented

2026-10-09 01:02:20 +00:00

Author

Owner

Final-source rootless QUIC renewal50MiB proof exceeded unchanged120 s credited-flood deadline, total124.87 s; no exact-byte success claimed. Host load67.45/64.91/52.08 on8 cores. Scoped consumer CPUWeight10000, but Rust CLI harness did not apply the existing Python fixture correction to its detached session shim, which moves into a default-weight unit. Log .scratch/run9/renewal-final-quic-flood.log. Test now reuses Binary.inherit_scope_priority for ONLY its returned session UUID (same helper committed434d4ff), before measurement; no production scheduling, threshold or protocol changes. Scoped rerun started; outcome will be reported even if it fails.

kayg commented

2026-10-09 01:06:25 +00:00

Author

Owner

Priority-corrected QUIC flood setup failed before any terminal/flood: first browser Close4.11 s; unchanged scoped retry ResetWithoutClosingHandshake1.10 s. Backtrace proves failure at remote_demo_tests.rs:302 awaiting initial server Hello, before open_remote and before shim-priority helper; log .scratch/run9/renewal-final-quic-flood-priority-retry.log. Current WebSocket authority-read budget25 ms and write1 s remain unchanged. 8-core load67.59/66.63/55.50. Building optimized real-server test harness to remove debug execution cost from this acceptance run, then will rerun at identical limits; no passing50MiB claim on current artifact yet. CLI idle renewal CPU/RSS/socket evidence still valid as separately posted.

kayg commented

2026-10-09 01:15:16 +00:00

Author

Owner

Final fenced/packed release CLI + optimized real server harness: rootless credited50MiB live-renewal proof PASS on both transports, unchanged120 s deadline. QUIC52,428,800 exact bytes in5,873,326 us, agentRSS11,168 KiB, load18.52/37.22/47.86; TCP exact52,428,800 in6,966,245 us, RSS11,196 KiB, load14.91/32.01/45.26. Both0 lost/duplicated bytes,0 Snapshot substitutions, unchanged same process-owned transport socket, retained writer/input identity, replacement Ack during active flood. CPUWeight10000 inherited by ONLY owned UUID shim using existing helper; no production scheduler/threshold edits. No own compilation/browser overlap. Logs .scratch/run9/renewal-final-{quic,tcp}-flood-release.log. Different external loads/debug-vs-release harness mean these timings are not evidence of a speedup or no regression relative to prior runs. Repeating independent cost/canaries with optimized harness next; test-slice fast gate follows.

kayg commented

2026-10-09 01:22:30 +00:00

Author

Owner

Current R2 optimized-harness costs (same current-source release CLI,8-core infraternal-dev,CPUWeight10000,no own compile overlap): TCP CPU1,429,619 ns/wall18,030 us/RSS+136 KiB/load3.94/15.94/34.61; QUIC CPU1,830,807 ns/wall50,506 us/RSS+132 KiB/load6.43/14.30/32.86. Both retained socket/key/durableAck and zero pre/post10 s scheduler activations. Server fixture CPU2,541,813/3,698,596 ns and RSS+128/+80 KiB includes browser/test measurement coordination, not isolated shipping server. Earlier optimized QUIC output accidentally hardcoded harness_profile=debug; failed-first provenance check and corrected dynamic debug_assertions label retained, final logs renewal-final-{tcp-cost-release,quic-cost-release-labeled}.log. Actual1000 TCP/mTLS host-registry diagnostic PASS13.94 s: credential-preallocated baseline38,488 KiB→167,216 KiB, delta128,728 KiB (=128.728 KiB/pair+actor×1000). Both client/server transport endpoints and production registry actors are co-located; excludes PTY/shim and credential-setup baseline, not full-server acceptance. Handshake+Hello directp50/p992979/6573 us, load4.90/12.69/31.34. Revoking all1000 then registry cleanup173,473 us,0remaining while1000 client peers retained. Log renewal-round-registry-1000.log. 300ms component handshake diagnostics next.

kayg commented

2026-10-09 01:25:04 +00:00

Author

Owner

D167 current transport component diagnostic, 25 handshakes each over userspace150 ms each-way relay,8-core infraternal-dev,CPUWeight10000,no own compile overlap during measurement: QUIC p50/p99456,005/460,586 us; TCP+TLS758,759/763,537 us. Actual1000 retained direct connection pairs (both ends, excludes host registry/PTYs/credentials baseline): QUIC baseline11,208→78,836 KiB, delta67,628 KiB=67.628 KiB/pair×1000, connectCPU116 ticks; TCP10,748→80,156 KiB, delta69,408 KiB=69.408 KiB/pair×1000, connectCPU323 ticks (100 Hz). Loads QUIC7.73/10.41/27.67, TCP6.36/10.58/28.39. These are component measurements with relayRTT, not browser-path reconnection or isolated production-server budgets. Logs .scratch/run9/renewal-round-{quic,tcp}-300ms-1000.log. All cost/idle/50MiB/registry acceptance measurements complete for R2 test slice; requested full Nix fast now running, including both exact R1 regressions.

kayg commented

2026-10-09 01:32:52 +00:00

Author

Owner

R3 additive contract proposal before implementation: explicit administrator memberships with a monotone per-user generation in SQLite (initial owner seeds this role once; authorization never substitutes users.owner). CA-unlock ceremonies are purpose/session/user/generation bound, single-use, use the existing real WebAuthn verifier, and recheck live membership/session/credential under the SQLite writer lock before installing the key. Per-administrator CA copies stay outside SQLite under XDG_DATA_HOME/infraternal/ca; existing OpenSSL AES-256-GCM seals the D168 Ed25519 seed with issuer/member/generation authenticated binding. Browser derives only a domain-separated wrapping key using existing HKDF/account DEK flow; PRF/DEK never reaches the server, CA seed never reaches the browser, and envelopes are not returned to browsers. Role grant/revoke updates membership and rewrap/removal state; offline grant wrapping follows D151 pending-grant semantics. Cold-start lock survives public-trust loading; status and lock-change notifications expose no secrets. Keep invitation/join shape unchanged for #87. Actual shipping unlock/storage/role/notification tests are required; the existing trusted test adapter is not acceptance. R2 test gate currently running; these changes remain a separate source/schema/test sequence.

kayg commented

2026-10-09 01:42:31 +00:00

Author

Owner

Completed R2 live-renewal test slice: real half-life/control/Ack/negative-publication checks, atomic CLI persistence and strict identity rejection, rootless release CLI+server exact50MiB renewal floods on QUIC/TCP. Release cost/idle/1000-host/300ms measurements posted separately with scope, load and failed setup runs. R3 actual shipping passkey CA flow remains separate; no in-memory fixture substitution.
Head 003408ebe9. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-final-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4654.47ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.82ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.70s]

Completed R2 live-renewal test slice: real half-life/control/Ack/negative-publication checks, atomic CLI persistence and strict identity rejection, rootless release CLI+server exact50MiB renewal floods on QUIC/TCP. Release cost/idle/1000-host/300ms measurements posted separately with scope, load and failed setup runs. R3 actual shipping passkey CA flow remains separate; no in-memory fixture substitution. Head 003408ebe9482f330327459444c032ca69562a93. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-final-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4654.47ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.82ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.70s]

kayg commented

2026-10-09 01:57:28 +00:00

Author

Owner

Bounded renewal JSON ASan target added (proof DER≤4096, certificate DER≤8192, JSON≤32768; accepted input must reject trailing non-whitespace). Existing nightly2026-10-01/libFuzzer and OpenSSL reused; LTO disabled only for fuzz build, production profile unchanged; all targets/corpus/artifacts in job home cache, never/tmp. First run2,973,834 executions61 s/peak515 MiB; second run1,485,204 executions31 s/peak443 MiB after adding exact/just-over JSON and DER boundary fixtures. Both exit0, no sanitizer findings/crash artifacts. Initial5 public seeds include an actual signed public CSR; private key stayed in an OS pipe and never in files/logs/argv. Second run loaded1221 public/mutated corpus entries, including boundary fixtures. Logs .scratch/run9/renewal-json-fuzz{,-boundaries}.log. 8-core infraternal-dev external load20.27/19.31/20.90 during first fuzz; no perf VM. Full requested Nix fast for fuzz-only slice now running; head before this slice003408eb.

kayg referenced this issue

2026-10-09 02:03:55 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 02:05:50 +00:00

Author

Owner

Completed bounded renewal JSON ASan fuzz slice. Public CSR/JSON and exact/just-over size corpus; 2,973,834 executions61 s plus1,485,204 executions31 s, zero findings. Fuzz-only LTO setting; production profile unchanged. Full fast green.
Head f09899f8a4. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-fuzz-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [1861.11ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [7.26ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [1.88s]

Completed bounded renewal JSON ASan fuzz slice. Public CSR/JSON and exact/just-over size corpus; 2,973,834 executions61 s plus1,485,204 executions31 s, zero findings. Fuzz-only LTO setting; production profile unchanged. Full fast green. Head f09899f8a467611ec93d17b964042dad6a6ec6e7. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/renewal-fuzz-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [1861.11ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [7.26ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [1.88s]

kayg commented

2026-10-09 02:16:40 +00:00

Author

Owner

Completed additive R3 contract: explicit role generations, purpose/session-bound real passkey unlock, writer-lock rechecks, encrypted private XDG copies, lock/expiry notifications and actual configured release CLI acceptance. Join/invitation shape unchanged for #87. Implementation remains separate; prepared schema preview passes existing/new-owner cases on native SQLite3.53.3.
Head cfe8053415. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-shipping-contract-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3457.47ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.37ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.49s]

Completed additive R3 contract: explicit role generations, purpose/session-bound real passkey unlock, writer-lock rechecks, encrypted private XDG copies, lock/expiry notifications and actual configured release CLI acceptance. Join/invitation shape unchanged for #87. Implementation remains separate; prepared schema preview passes existing/new-owner cases on native SQLite3.53.3. Head cfe8053415f33c33146dea462aa2dca3c116401f. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-shipping-contract-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106064 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16137984 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3457.47ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.37ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.49s]

kayg referenced this issue

2026-10-09 02:24:51 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 02:32:00 +00:00

Author

Owner

Completed R3 administrator schema: explicit active/generation metadata, existing-owner seed and insertion-only first-owner trigger; owner updates cannot restore revoked roles. Native SQLite3.53.3 existing/new-owner and invalid-state preview passes; bundled SQLite/auth full gate green. No signing secrets/envelopes in SQLite.
Head 6a6670473a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administrator-schema-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3602.58ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.42ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.65s]

Completed R3 administrator schema: explicit active/generation metadata, existing-owner seed and insertion-only first-owner trigger; owner updates cannot restore revoked roles. Native SQLite3.53.3 existing/new-owner and invalid-state preview passes; bundled SQLite/auth full gate green. No signing secrets/envelopes in SQLite. Head 6a6670473ace1b3a12ba84df9ac264f78a435764. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administrator-schema-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3602.58ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.42ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.65s]

kayg commented

2026-10-09 02:35:27 +00:00

Author

Owner

R3 authority module preview: three real registered-passkey/SQLite tests PASS2.45 s. Explicit role survives owner-flag removal; owner flag cannot restore a revoked role; grant generation2 rejects generation1 ceremony binding. Pending/unlocked0, expired, exactly300 s stale and future sessions denied; deleted credential/session denied. Existing Software ES256 authenticator enters the real WebAuthn verifier, not an owner-bool/mock authority. Log .scratch/run9/ca-membership-preview-tests.log; source clippy green. Module acquires writer lock before current session/credential/member-generation read; test registration restored out for source-only atomic gate now running. Actual passkey unlock/store/CLI wiring remains to be implemented; no shipping-flow acceptance claim.

kayg commented

2026-10-09 02:50:18 +00:00

Author

Owner

R3 component: explicit administrator/registered-passkey/session guard committed; actual shipping unlock adapter still pending.
Head 1baecce7c8. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-membership-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3749.17ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.29ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.79s]

R3 component: explicit administrator/registered-passkey/session guard committed; actual shipping unlock adapter still pending. Head 1baecce7c879760866ff9acbbd050e91ae1d3440. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-membership-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3749.17ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.29ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.79s]

kayg commented

2026-10-09 02:54:12 +00:00

Author

Owner

D167 current R3 round: release administrator guard benchmark PASS at 1,000 actual SQLite administrator rows and 1,000 measured begin/authority-read/rollback operations: p50 112.245 us, p99 300.622 us. infraternal-dev, 8 cores, load6.39/9.29/10.68, CPUWeight10000, no own build/browser overlap during sampling. The measured principal has a real registered passkey; idle member credential provisioning, disk/HTTP and full-server memory are excluded. Log .scratch/run9/ca-membership-1000-release.log. Three active regressions PASS2.56 s; their full gate is running. This is component evidence, not R3 shipping acceptance.

kayg commented

2026-10-09 03:02:41 +00:00

Author

Owner

R3 guard tests committed: three real-passkey/SQLite regressions PASS2.56s; release 1000-row guard p50/p99 112.245/300.622us. Shipping CA unlock remains pending.
Head 19d4873da7. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-membership-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2911.45ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.24ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.96s]

R3 guard tests committed: three real-passkey/SQLite regressions PASS2.56s; release 1000-row guard p50/p99 112.245/300.622us. Shipping CA unlock remains pending. Head 19d4873da72749985992321a4e39bc671c898d0d. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-membership-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18106160 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16138064 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2911.45ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.24ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.96s]

kayg commented

2026-10-09 03:09:53 +00:00

Author

Owner

R3 encrypted-copy preview finding: an uncommitted seal draft accepted a mismatched issuer/key, though restore correctly refused it. Failing-first real OpenSSL test invalid_issuer_key_binding_is_refused_before_a_copy_is_persisted: FAIL0.00s (.scratch/run9/ca-wrap-issuer-binding-red.log). Seal now validates the same D168 material boundary before extracting/encrypting the seed; all five crypto preview tests PASS0.01s (.ca-wrap-preview-fixed.log), clippy PASS9.93s. Unknown/wrong member/gen/issuer, wrong key and GCM tampering denied; seed and failed-decrypt buffers Zeroizing. Source registration restored out so the direct existing zeroize dependency receives its own atomic full gate first. Actual shipping HTTP/passkey/store integration remains pending.

kayg referenced this issue

2026-10-09 03:09:54 +00:00

S1 integration: merge tracer lanes into dev, deploy to monitor01 #34

kayg commented

2026-10-09 03:28:44 +00:00

Author

Owner

R3 dependency committed: reuse pinned zeroize1.9.0 for transient seed/GCM-output/scoped-key buffers; existing MIT/Apache-2.0 utility, no version or crypto-provider changes. Crypto preview five real OpenSSL tests PASS0.01s/clippy PASS; source module remains separate.
Head 4d03efe643. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/zeroize-dependency-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2276.85ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.57ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.31s]

R3 dependency committed: reuse pinned zeroize1.9.0 for transient seed/GCM-output/scoped-key buffers; existing MIT/Apache-2.0 utility, no version or crypto-provider changes. Crypto preview five real OpenSSL tests PASS0.01s/clippy PASS; source module remains separate. Head 4d03efe643defaa9a2bd17dd8a559f96cc34f661. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/zeroize-dependency-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2276.85ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.57ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.31s]

kayg commented

2026-10-09 03:44:53 +00:00

Author

Owner

R3 encrypted-copy primitive committed: existing OpenSSL AES256GCM binds issuer/member/generation/salt, bounds JSON before parse, validates issuer/key before seal and after authenticated decrypt, wipes seed/error buffers. Five real crypto preview regressions PASS0.01s including failing-first issuer/key case; permanent tests and persistence/actual passkey/CLI integration follow.
Head a4a1666274. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-wrap-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3243.03ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.63ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.28s]

R3 encrypted-copy primitive committed: existing OpenSSL AES256GCM binds issuer/member/generation/salt, bounds JSON before parse, validates issuer/key before seal and after authenticated decrypt, wipes seed/error buffers. Five real crypto preview regressions PASS0.01s including failing-first issuer/key case; permanent tests and persistence/actual passkey/CLI integration follow. Head a4a1666274520098cf16217c500a44cf470bf71a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-wrap-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3243.03ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.63ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.28s]

kayg commented

2026-10-09 03:52:53 +00:00

Author

Owner

D167 R3 encrypted-copy release component: 1,000 real Ed25519/OpenSSL AES256GCM copies, seal p50/p99 135.648/268.966us including issuer/key validation; authenticated open+material validation p50/p99 175.568/332.806us. Whole-process RSS9492→10688KiB, +1196KiB with 1,000 retained copies (1.196KiB per copy, includes allocator/crypto validation retention); serialized encrypted+public-metadata bytes501008. No HTTP, database, passkey provisioning or connected-host memory included. infraternal-dev/8cores/load10.50/17.28/17.82, release CPUWeight10000, no own compile/browser overlap during sample. PASS0.37s; .scratch/run9/ca-wrap-1000-release.log. Six active crypto/decoder regressions PASS0.02s (.ca-wrap-tests-unit.log), including exact8192/8193-byte/duplicate/unknown-field cases. Test-slice full gate follows; R3 actual CLI/passkey/store wiring remains incomplete.

kayg commented

2026-10-09 04:08:15 +00:00

Author

Owner

R3 copy regressions committed: six real OpenSSL/decoder cases PASS0.02s; exact8192/8193 and duplicate/unknown fields denied; failing-first mismatched issuer/key retained. Release1000-copy seal p50/p99 135.648/268.966us, open175.568/332.806us, whole-process+1196KiB including crypto/allocator retention, serialized501008 bytes; details/scope posted separately. Shipping CA adapter remains incomplete.
Head ce736d9c94. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-wrap-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4616.47ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.36ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.67s]

R3 copy regressions committed: six real OpenSSL/decoder cases PASS0.02s; exact8192/8193 and duplicate/unknown fields denied; failing-first mismatched issuer/key retained. Release1000-copy seal p50/p99 135.648/268.966us, open175.568/332.806us, whole-process+1196KiB including crypto/allocator retention, serialized501008 bytes; details/scope posted separately. Shipping CA adapter remains incomplete. Head ce736d9c94f5c5afdce0f002536e4009efcddcfd. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-wrap-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4616.47ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.36ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.67s]

kayg commented

2026-10-09 04:15:23 +00:00

Author

Owner

R3 copy-parser ASan smoke PASS: 1,973,831 executions/61s, peak RSS482MiB, no findings/artifacts. Production WrappedCa::decode, max_len8193/RSSlimit1024MiB; 18 public dummy-ciphertext seeds include exact8192/8193-byte input, wrong nonce/salt/fingerprint/ciphertext lengths, duplicate/unknown fields, epoch bounds and recursion. Decoder grants no signing/admin authority; real OpenSSL GCM/binding tests are separate. Log .scratch/run9/ca-copy-json-fuzz.log; own cache target under HOME, existing pinned libFuzzer/nightly2026-10-01. LTO=false applies only to ASan build (same existing sanitizer workaround), production release profile untouched. Fuzz source receives its own full fast gate next.

kayg commented

2026-10-09 04:23:54 +00:00

Author

Owner

R3 encrypted-copy parser fuzz target committed: ASan1,973,831exec/61s, peak482MiB, no findings/artifacts; 18 public length/shape/duplicate/unknown/recursion/epoch/boundary seeds. Crypto/admin authority remains separate. Full fast green; actual passkey/copy-store/CLI integration next.
Head 55317ea6cf. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copy-fuzz-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4461.73ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.05ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.50s]

R3 encrypted-copy parser fuzz target committed: ASan1,973,831exec/61s, peak482MiB, no findings/artifacts; 18 public length/shape/duplicate/unknown/recursion/epoch/boundary seeds. Crypto/admin authority remains separate. Full fast green; actual passkey/copy-store/CLI integration next. Head 55317ea6cfe562f6506cc3bb02c3bf63979a54b6. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copy-fuzz-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18104176 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4461.73ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.05ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.50s]

kayg referenced this issue

2026-10-09 04:27:57 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 04:48:00 +00:00

Author

Owner

Encrypted-copy source gate: untouched auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket failed (server closed websocket unexpectedly), 154 server tests passed. Isolated CPUWeight10000 rerun passed 1/1 in 2.55s; machine infraternal-dev, 8 cores, load 19.04/13.88/14.29. Log .scratch/run9/ca-store-recovery-rerun.log. Exact test is absent from both requested ac03b19 and current dev (459070f); no zero-test baseline is claimed. Retrying full gate without changing test or thresholds. Static builds already passed: x86 18103856, ARM16135632 bytes.

Encrypted-copy source gate: untouched auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket failed (server closed websocket unexpectedly), 154 server tests passed. Isolated CPUWeight10000 rerun passed 1/1 in 2.55s; machine infraternal-dev, 8 cores, load 19.04/13.88/14.29. Log .scratch/run9/ca-store-recovery-rerun.log. Exact test is absent from both requested ac03b19 and current dev (459070f); no zero-test baseline is claimed. Retrying full gate without changing test or thresholds. Static builds already passed: x86 18103856, ARM16135632 bytes.

kayg commented

2026-10-09 04:49:44 +00:00

Author

Owner

Correction to baseline lookup: git grep across all server files finds the exact recovery-subscription test on current dev 459070f in auth/socket_tests.rs (not auth/tests.rs). It is absent from ac03b19. Will compare current dev under the same CPUWeight10000 scope; the earlier isolated head result remains PASS2.55s.

Correction to baseline lookup: git grep across all server files finds the exact recovery-subscription test on current dev 459070f in auth/socket_tests.rs (not auth/tests.rs). It is absent from ac03b19. Will compare current dev under the same CPUWeight10000 scope; the earlier isolated head result remains PASS2.55s.

kayg commented

2026-10-09 04:55:36 +00:00

Author

Owner

Encrypted CA-copy persistence complete: private0700/0600 XDG files, bounded no-follow reads, fsync/atomic rename and member-generation scoped removal. #34 data-layout row posted. Shipping passkey integration remains separate.
Head 01cb79b891. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copies-source-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3407.35ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.79ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.44s]

Encrypted CA-copy persistence complete: private0700/0600 XDG files, bounded no-follow reads, fsync/atomic rename and member-generation scoped removal. #34 data-layout row posted. Shipping passkey integration remains separate. Head 01cb79b8910e2de963e241e0d5604913f0c52211. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copies-source-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3407.35ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.79ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.44s]

kayg commented

2026-10-09 04:57:07 +00:00

Author

Owner

Recovery-subscription comparison complete: exact test absent on ac03b19; current dev459070fe passes1/1 in1.42s underCPUWeight10000 versus head isolated2.55s. Both16/16 start+cancel deliveries, foreign account0. Dev launch load [7.58203125, 8.88720703125, 11.4091796875], 8cores oninfraternal-dev. Dev log .scratch/run9/ca-store-recovery-dev.log. Head full retry now fast exit0 on01cb79b8; no test/threshold weakened.

Recovery-subscription comparison complete: exact test absent on ac03b19; current dev459070fe passes1/1 in1.42s underCPUWeight10000 versus head isolated2.55s. Both16/16 start+cancel deliveries, foreign account0. Dev launch load [7.58203125, 8.88720703125, 11.4091796875], 8cores oninfraternal-dev. Dev log .scratch/run9/ca-store-recovery-dev.log. Head full retry now fast exit0 on01cb79b8; no test/threshold weakened.

kayg commented

2026-10-09 05:01:28 +00:00

Author

Owner

Encrypted-copy store release measurement (CPUWeight10000, no own parallel build/browser):1,000 actual private disk files,496971 encrypted+public-metadata bytes. Durable publish (write+file fsync+rename+directory fsync) wall p50/p99=13797/33507us; bounded no-follow read+decode=86/5870us. Real8-core infraternal-dev load13.28/12.69/12.33, test15.50s. Crypto preparation/GCM open excluded; not isolated CPU or whole unlock latency. Log .scratch/run9/ca-copy-store-1000-release.log. These operations will stay on bounded blocking tasks, away from terminal reactors. Owned fixture removed after measurement.

kayg commented

2026-10-09 05:22:34 +00:00

Author

Owner

Encrypted-copy filesystem regressions complete:3 real CA/disk tests pass; ignored release diagnostic covers1000 durable files (publish p50/p99 13797/33507us, read86/5870us; load13.28). Exact R1 review regressions pass in full gate.
Head 865cf32685. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copies-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4802.13ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.48ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.85s]

Encrypted-copy filesystem regressions complete:3 real CA/disk tests pass; ignored release diagnostic covers1000 durable files (publish p50/p99 13797/33507us, read86/5870us; load13.28). Exact R1 review regressions pass in full gate. Head 865cf326857f4b8f23a8447d19d2d7e35f0704b8. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-copies-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4802.13ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.48ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.85s]

kayg commented

2026-10-09 05:24:27 +00:00

Author

Owner

Merging dev459070fe into remote-agents after865cf326 as requested. Two conflicts resolved: server dev dependencies retain both remote TLS clients and tokio test-util; shared fixture retains correlated Pong plus dev credit accounting/prelaunch CPU inheritance, with one exact-UUID scope property helper reused by remote flood tests. No thresholds changed. Running full fast on merged source before merge commit.

kayg commented

2026-10-09 05:38:52 +00:00

Author

Owner

Requested dev merge complete (459070fe): deterministic socket/review timing and production tracer integration retained. Rust server158passed/0failed/22ignored, both exact R1 tests and copy tests pass. Static sizes unchanged; no thresholds relaxed.
Head 42e51a5017. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/dev-merge-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [7760.20ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.02ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [7.87s]

Requested dev merge complete (459070fe): deterministic socket/review timing and production tracer integration retained. Rust server158passed/0failed/22ignored, both exact R1 tests and copy tests pass. Static sizes unchanged; no thresholds relaxed. Head 42e51a501765ee8ed90c34a4c637862c3b7042eb. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/dev-merge-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18103856 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16135632 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [7760.20ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.02ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [7.87s]

kayg commented

2026-10-09 05:41:37 +00:00

Author

Owner

R3 route finding reproduced on merged42e51a50: exact review_default_server_must_register_remote_join FAIL0.22s, POST /remote/join returned404 without a fixture signer (.scratch/run9/shipping-route-red.log). Fix registers stable invitation/join/revocation paths even when remote trust is unconfigured, returning static503; configured enrollment keeps its existing #87 shape. This closes route registration only; actual D168 passkey/copy/CLI integration is still incomplete.

kayg commented

2026-10-09 06:04:54 +00:00

Author

Owner

R3 default API registration source fixed: exact review test failed first404/0.22s then passed0.46s. Unconfigured invitation/join/revocation POSTs return503; configured #87 shape unchanged. Static growth x86+4704/ARM+3552bytes; actual D168 passkey unlock remains incomplete.
Head 248621219a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-route-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18108560 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16139184 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4158.08ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.33ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.21s]

R3 default API registration source fixed: exact review test failed first404/0.22s then passed0.46s. Unconfigured invitation/join/revocation POSTs return503; configured #87 shape unchanged. Static growth x86+4704/ARM+3552bytes; actual D168 passkey unlock remains incomplete. Head 248621219a9e97a837aaa73d8929914524358388. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-route-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18108560 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16139184 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4158.08ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [14.33ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.21s]

kayg commented

2026-10-09 06:14:29 +00:00

Author

Owner

Permanent R3 default-route reproduction complete: no signer injection; join/invitation/revocation503 and GET join405. Server159passed/0failed/22ignored. Actual administrator passkey/CLI adapter remains pending; requested dev merge is already in history.
Head 4193ac2111. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-route-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18108560 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16139184 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4055.74ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.08ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.09s]

Permanent R3 default-route reproduction complete: no signer injection; join/invitation/revocation503 and GET join405. Server159passed/0failed/22ignored. Actual administrator passkey/CLI adapter remains pending; requested dev merge is already in history. Head 4193ac2111657d75d694288a58a91923a8b7a644. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-route-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18108560 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16139184 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4055.74ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.08ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.09s]

kayg commented

2026-10-09 06:23:26 +00:00

Author

Owner

Browser gate on4193ac21, CPUWeight10000/TRACER_TEST_PORT4701 (no own compile overlap):319 tests running; one early failure in test/add-host-prototype.spec.ts:136, wizard floats over dimmed window. The test/frontend/shared UI/build manifest inputs compare byte-identical to dev459070fe (git diff dev HEAD -- apps/tracer/src packages/ui apps/tracer/test apps/tracer/build.ts apps/tracer/package.json empty). Waiting for full failure report, then isolated same-scope rerun; no assertion/threshold edits. Log .scratch/run9/browser-4701-correct-directory.log. Initial root-directory runner mismatch ran no tests; corrected cwd apps/tracer.

kayg referenced this issue

2026-10-09 06:35:58 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 07:15:43 +00:00

Author

Owner

Browser full gate on4193ac21: exit1,260passed/33failed/26skipped in58.7m, CPUWeight10000/TRACER_TEST_PORT4701/no own compiler overlap. All apps/tracer, packages/ui, protocol-ts and latency-proxy inputs compare byte-identical to dev459070fe. First deterministic failure expects blur(16px), receives blur(8px) saturate(1.6), add-host-prototype.spec.ts147. Current-dev same-scope isolated comparison next. No baseline, assertion or threshold changes. Root-directory initial runner mismatch ran no tests; proper cwd full log .scratch/run9/browser-4701-correct-directory.log. Fast remains green on4193ac21; R3 real passkey/CLI wiring incomplete, proof-only backend source/test preview prepared.

kayg commented

2026-10-09 07:18:09 +00:00

Author

Owner

Browser isolated comparison: dev459070fe and head4193ac21 both fail the same two cases underCPUWeight10000/TRACER4701. add-host147 expects blur16px, receives blur8px saturate1.6; clusters-memory82 expects restored canvas1162800pixels, receives0. Dev launch load[26.16064453125, 27.89892578125, 28.95361328125]/8cores; logs .scratch/run9/dev-browser-isolated.log and head-browser-isolated.log. Both tests absent from ac03b19. Whole UI/test/build inputs compare equal to dev; no assertion/snapshot/threshold edits. Full gate remains260pass/33fail/26skip58.7m. Backend proof-only verifier preview resumes now; R3 still incomplete.

Browser isolated comparison: dev459070fe and head4193ac21 both fail the same two cases underCPUWeight10000/TRACER4701. add-host147 expects blur16px, receives blur8px saturate1.6; clusters-memory82 expects restored canvas1162800pixels, receives0. Dev launch load[26.16064453125, 27.89892578125, 28.95361328125]/8cores; logs .scratch/run9/dev-browser-isolated.log and head-browser-isolated.log. Both tests absent from ac03b19. Whole UI/test/build inputs compare equal to dev; no assertion/snapshot/threshold edits. Full gate remains260pass/33fail/26skip58.7m. Backend proof-only verifier preview resumes now; R3 still incomplete.

kayg commented

2026-10-09 07:31:02 +00:00

Author

Owner

Fresh passkey proof preview: five real registered-passkey/SQLite tests pass (5.89s), including UV, replay, removed credential, monotone counter, cancellation and expiry during writer admission; workspace all-target Clippy green. Six alternating old/new release login runs, same CPUWeight10000 scope, 200 signed assertions/run, pending capacity1024: median run p50/p99 us {"before": {"p50_us": 260.0, "p99_us": 5283.0}, "after": {"p50_us": 275.5, "p99_us": 6014.0}}. Full samples/load in .scratch/run9/auth-verifier-paired-results.json. Existing 10ms budget unchanged; this measures shared login, not complete CA unlock. Source-only gate next.

kayg commented

2026-10-09 07:33:51 +00:00

Author

Owner

R3 additive HTTP shape proposed before implementation (existing D168 authority contract applies):

The configured server exposes same-origin POST /remote/ca/status,
/remote/ca/unlock/start and /remote/ca/unlock/finish to authenticated
administrators. Start returns the existing real WebAuthn options/ceremony plus
public CA wrapping metadata: member, generation, base64url salt and issuer
fingerprint. Finish consumes the ceremony with the actual assertion and a
32-byte domain-separated scoped wrapping key; it never accepts PRF or DEK.
Encrypted copies and the CA seed never enter HTTP responses. Requests are
bounded to32,768 bytes and eight simultaneous operations. No remote transport
configuration means enrollment routes return503 rather than disappear. These
routes do not change the #87 invitation/join schema.

The unlock adapter will preserve current session/credential/role checks through final writer admission. Initial copy provisioning, role grant/rewrap and notifications remain separate work; no complete R3 claim from an unlock-only adapter.

R3 additive HTTP shape proposed before implementation (existing D168 authority contract applies):  The configured server exposes same-origin POST `/remote/ca/status`, `/remote/ca/unlock/start` and `/remote/ca/unlock/finish` to authenticated administrators. Start returns the existing real WebAuthn options/ceremony plus public CA wrapping metadata: member, generation, base64url salt and issuer fingerprint. Finish consumes the ceremony with the actual assertion and a 32-byte domain-separated scoped wrapping key; it never accepts PRF or DEK. Encrypted copies and the CA seed never enter HTTP responses. Requests are bounded to32,768 bytes and eight simultaneous operations. No remote transport configuration means enrollment routes return503 rather than disappear. These routes do not change the #87 invitation/join schema. The unlock adapter will preserve current session/credential/role checks through final writer admission. Initial copy provisioning, role grant/rewrap and notifications remain separate work; no complete R3 claim from an unlock-only adapter.

kayg commented

2026-10-09 07:49:13 +00:00

Author

Owner

Shared proof-only real passkey verifier committed; no browser session creation. Five preview security regressions pass. Six paired release login runs old/new median p50/p99: 260/5283 versus 275.5/6014 us, load34.27-34.82 on8cores, unchanged10ms budget; not a speedup claim. Actual CA HTTP/runtime adapter remains next.
Head 23f0efe104. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/auth-verified-source-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4075.70ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.29ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.14s]

Shared proof-only real passkey verifier committed; no browser session creation. Five preview security regressions pass. Six paired release login runs old/new median p50/p99: 260/5283 versus 275.5/6014 us, load34.27-34.82 on8cores, unchanged10ms budget; not a speedup claim. Actual CA HTTP/runtime adapter remains next. Head 23f0efe1045dc85fe34967a09218434207773abb. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/auth-verified-source-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4075.70ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.29ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.14s]

kayg commented

2026-10-09 07:58:13 +00:00

Author

Owner

Permanent proof-only regression gate: all5new tests PASS, server163PASS/1FAIL/22ignored. Untouched socket_tests.rs:151 expired_handshake_releases_user_permits failed the 4999ms admission-full assertion; load18.14/21.14/22.06 aftergate on8cores. Exact scoped head rerun PASS0.90s (.scratch/run9/auth-verified-expired-handshake-rerun.log); same exact ac03b19 scoped baseline PASS (log .scratch/run9/auth-expired-handshake-ac03.log, launch load in auth-expired-baseline-env.json). No test/deadline changes. Fullgate retry next.

Permanent proof-only regression gate: all5new tests PASS, server163PASS/1FAIL/22ignored. Untouched socket_tests.rs:151 expired_handshake_releases_user_permits failed the 4999ms admission-full assertion; load18.14/21.14/22.06 aftergate on8cores. Exact scoped head rerun PASS0.90s (.scratch/run9/auth-verified-expired-handshake-rerun.log); same exact ac03b19 scoped baseline PASS (log .scratch/run9/auth-expired-handshake-ac03.log, launch load in auth-expired-baseline-env.json). No test/deadline changes. Fullgate retry next.

kayg commented

2026-10-09 08:07:19 +00:00

Author

Owner

Permanent5 real passkey proof-only regressions committed; full fast retry green, including original socket deadline and R1 exact reproductions. Earlier red and same-scope head/ac03b19 exact reruns recorded separately; no thresholds changed.
Head 47f2fc1d14. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/auth-verified-tests-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3523.25ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.13ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.56s]

Permanent5 real passkey proof-only regressions committed; full fast retry green, including original socket deadline and R1 exact reproductions. Earlier red and same-scope head/ac03b19 exact reruns recorded separately; no thresholds changed. Head 47f2fc1d14bfdff966f6dcdb42d064262f1b08dd. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/auth-verified-tests-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3523.25ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [13.13ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.56s]

kayg commented

2026-10-09 08:10:34 +00:00

Author

Owner

R3 actual unlock authority preview:7 real software-passkey/SQLite/private encrypted-copy tests PASS11.06s. Covers cold signer unlock/single-use/no extra browser session; stale original tap requires fresh proof; revoked role/session, changed generation, expired session, deleted credential, wrong wrapping key, missingUV and wrong purpose fail closed; foreign-browser attempt preserves original ceremony. All-target Clippy preview green17.37s. Crypto/fileI/O bounded8 off reactor; final current session/role/exact credential rechecked under SQLite writer lock. Source-only fullgate next; HTTP/CLI wiring and provisioning/role lifecycle/notifications still not complete.

kayg commented

2026-10-09 08:26:41 +00:00

Author

Owner

Real administrator-passkey CA unlock authority committed; seven real signed-proof/private-copy preview security tests pass. Bounded crypto off-reactor, exact browser/purpose/generation binding and final live policy writer lock. This commits the authority module; shipping HTTP/CLI/provisioning/role lifecycle remains separate.
Head 473c2fb716. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administration-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4294.33ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [19.43ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.35s]

Real administrator-passkey CA unlock authority committed; seven real signed-proof/private-copy preview security tests pass. Bounded crypto off-reactor, exact browser/purpose/generation binding and final live policy writer lock. This commits the authority module; shipping HTTP/CLI/provisioning/role lifecycle remains separate. Head 473c2fb7160084aa1c1fa9e1422fdc60afe1abbd. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administration-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4294.33ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [19.43ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.35s]

kayg commented

2026-10-09 08:33:11 +00:00

Author

Owner

R3 real CA authority release cost:100 unlocks at1000 actual SQLite administrator records+1000 private encrypted files; one measured real registered ES256 credential. Start wall p50/p99 0.648250/4.911657ms; finish wall1.842820/9.246756ms; finish process CPU1.906580/3.109636ms (includes independent measurement spawn/pipe coordination, not isolated crypto). RSS16376→16524KiB +148KiB;999 idle ciphertext+publicmetadata files481600bytes. HTTP, client signing, fixture/filepublication setup excluded.8cores/infraternal-dev/CPUWeight10000/load16.06/23.01/22.58; no own build/browser overlap during sampling. Actual test PASS23.71s, owned fixture cleaned by Drop; log .scratch/run9/ca-administration-cost-release-final.log. First attempted direct clock rejected unsafe_code=forbid, then missing-import compile error; corrected without policy/dependency changes. Permanent7 security tests+ignored diagnostic fullgate next.

kayg commented

2026-10-09 08:42:39 +00:00

Author

Owner

Permanent7 real CA unlock policy regressions and ignored1000-record/private-copy cost diagnostic committed. Real release cost start wall0.648/4.912ms, finish wall1.843/9.247ms, measured process CPU1.907/3.110ms including coordination; RSS+148KiB. Scope/exclusions in earlier finding. Full fast green.
Head 7087838973. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administration-tests-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4568.86ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.29ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.62s]

Permanent7 real CA unlock policy regressions and ignored1000-record/private-copy cost diagnostic committed. Real release cost start wall0.648/4.912ms, finish wall1.843/9.247ms, measured process CPU1.907/3.110ms including coordination; RSS+148KiB. Scope/exclusions in earlier finding. Full fast green. Head 70878389731bb83d81346485946a4d9e8443a697. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-administration-tests-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18113104 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16140496 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4568.86ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.29ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.62s]

kayg commented

2026-10-09 08:45:54 +00:00

Author

Owner

R3 bounded CA HTTP preview:3 actual signed-proof/private-copy tests PASS2.16s; all-target Clippy PASS12.92s. Covers pinnedOrigin/live cookie, successful actual cold unlock without extra session/Set-Cookie, unknown fields and malformed scoped key static empty400, oversized32769body413. Initial test expected403 for malformed cookie but existing parser correctly401; added separate valid-shaped unknown cookie403. No production auth policy changed. Opaque decoder bounded32768 and ceremony1..128 reused by HTTP, ready for actual-parser fuzz target. Source-only gate next; CLI wiring remains next.

kayg referenced this issue

2026-10-09 08:50:27 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 09:02:39 +00:00

Author

Owner

Bounded same-origin CA status/start/finish HTTP adapter committed; opaque32768-byte decoder, eight requests, static parser errors and no Set-Cookie. Three real preview tests+Clippy pass. Shipping CLI/runtime wiring remains next; this is not full R3 acceptance.
Head 98a22b5e56. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-source-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4630.25ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [17.49ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.68s]

Bounded same-origin CA status/start/finish HTTP adapter committed; opaque32768-byte decoder, eight requests, static parser errors and no Set-Cookie. Three real preview tests+Clippy pass. Shipping CLI/runtime wiring remains next; this is not full R3 acceptance. Head 98a22b5e56ad66c47de8342f17866c9a86d5f58a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-source-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4630.25ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [17.49ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.68s]

kayg commented

2026-10-09 09:10:36 +00:00

Author

Owner

CA HTTP permanent gate: all3new HTTP tests PASS; server173PASS/1FAIL/23ignored. Same untouched socket_tests.rs:151 4999ms admission-full assertion failed; all other Rust/static rows green, x86/ARM18109456/16141104. Exact same-scope head rerun PASS0.96s (.scratch/run9/ca-http-expired-handshake-rerun.log). Exact ac03b19 same-scope baseline previouslyPASS6.09s in this round (auth-expired-handshake-ac03.log); socket fixture/deadline source untouched and byte-identical currentdev. Gateendload11.15/14.59/17.93. No deadline/capacity/lint changes. Fullgate retry next; recurring timing finding remains recorded.

CA HTTP permanent gate: all3new HTTP tests PASS; server173PASS/1FAIL/23ignored. Same untouched socket_tests.rs:151 4999ms admission-full assertion failed; all other Rust/static rows green, x86/ARM18109456/16141104. Exact same-scope head rerun PASS0.96s (.scratch/run9/ca-http-expired-handshake-rerun.log). Exact ac03b19 same-scope baseline previouslyPASS6.09s in this round (auth-expired-handshake-ac03.log); socket fixture/deadline source untouched and byte-identical currentdev. Gateendload11.15/14.59/17.93. No deadline/capacity/lint changes. Fullgate retry next; recurring timing finding remains recorded.

kayg commented

2026-10-09 09:19:32 +00:00

Author

Owner

Permanent3 real CA HTTP origin/cookie/parser/unlock regressions committed; full fast retry green including untouched socket deadline. Earlier timing red and same-scope rerun recorded separately; no threshold changes. CLI runtime wiring remains next after decoder fuzz proof.
Head 6d3bc7087e. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-tests-fast-retry.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4237.21ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [16.47ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.29s]

Permanent3 real CA HTTP origin/cookie/parser/unlock regressions committed; full fast retry green including untouched socket deadline. Earlier timing red and same-scope rerun recorded separately; no threshold changes. CLI runtime wiring remains next after decoder fuzz proof. Head 6d3bc7087e35c90aa577a0f136777a542e448954. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-tests-fast-retry.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4237.21ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [16.47ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.29s]

kayg commented

2026-10-09 09:30:48 +00:00

Author

Owner

R3 actual CA unlock JSON decoder ASAN/libFuzzer:2,528,103executions in61s, peak508MiB, zero artifacts;14 initial public-only seeds include32768/32769byte boundary, ceremony128/129, duplicate/unknown fields, nesting and key shape/length/range. Target calls shipping decode_unlock and asserts accepted size/suffix refusal; syntax grants no role/unlock. Nightly2026-10-01, fuzz-onlyLTO=false, own HOME cache (not/tmp), no production flag changes. Log .scratch/run9/ca-unlock-json-fuzz.log. Fuzz-target atomic fast gate next, then actual CLI runtime wiring.

kayg commented

2026-10-09 09:38:31 +00:00

Author

Owner

Actual CA unlock JSON ASAN fuzz target committed:2528103executions/61s, peak508MiB, zero artifacts; public-only exact-boundary corpus, fuzz-onlyLTO=false. Full fast green. Actual configured CLI wiring next.
Head 8f3d37e961. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-unlock-fuzz-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4465.31ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.01ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.50s]

Actual CA unlock JSON ASAN fuzz target committed:2528103executions/61s, peak508MiB, zero artifacts; public-only exact-boundary corpus, fuzz-onlyLTO=false. Full fast green. Actual configured CLI wiring next. Head 8f3d37e96174d9645c7791d703d8adaf001b56cb. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-unlock-fuzz-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [4465.31ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [12.01ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.50s]

kayg commented

2026-10-09 09:44:32 +00:00

Author

Owner

R3 configured release CLI failing-first proof now reproduces actual missing adapter: rootless normal infraternal server with real disk Auth/passkey and private encrypted copy started on10.69.69.125:4701/7443; valid invitation+signed CSR correctly refused403 while cold. POST /remote/ca/status returned404, expected200 (.scratch/run9/ca-shipping-cli-red-disk.log,2.99s). No fixture signer injected; public trust/leaf key+wrapped administrator copy only. Initial test fixture compile/import/name-shadow issues and memory-VACUUM export corrected before this actual reproduction. Server process/owned directory cleaned by Drop. Wiring the exact same cold source into real Auth/HTTP authority next.

kayg commented

2026-10-09 09:50:32 +00:00

Author

Owner

R3 actual configured x86 musl release CLI preview PASS3.04s: rootless process on10.69.69.125:4701/7443, real physical SQLite/passkey, encrypted copy only, no fixture signer injection. Cold valid CSR+join refused403; administrator status/unlock using real signed proof succeeds; same token/CSR enrolls200; kill/restart cold-locks again and refuses new enrollment. New binary18238192bytes vs18109456 (+128736) within x86limit. ARM measurement next before gate/commit; initial provisioning/role rewrap/notification delivery still remaining. Log .scratch/run9/ca-shipping-cli-wired-preview.log; failing-first404 log ca-shipping-cli-red-disk.log. Owned CLI/directory cleaned on test exit.

kayg commented

2026-10-09 09:54:40 +00:00

Author

Owner

R3 configured CLI size measurement: ARM wired 16251744bytes vs16141104 (+110640), current limit16196376, over55368. x86 wired18238192 vs18109456 (+128736), withinlimit19244272. Cargo.lock/dependencies unchanged by runtime wiring; this activates existing real CA authority/HTTP/crypto code. No baseline raised. Investigating per-crate/code growth and reducing duplication before source gate/commit. Actual cold/unlock/enroll/restart release behavior preview passes3.04s.

kayg commented

2026-10-09 10:07:36 +00:00

Author

Owner

R3 same-profile ARM bloat before/after wiring: text 11312992→11400800 bytes. Per-crate top rows: [{"crate": "[Unknown]", "before": 3240868, "after": 3240868, "delta": 0}, {"crate": "std", "before": 1369920, "after": 1380716, "delta": 10796}, {"crate": "openssl_sys", "before": 1250772, "after": 1250824, "delta": 52}, {"crate": "infraternal_server", "before": 585076, "after": 604220, "delta": 19144}, {"crate": "tokio", "before": 493612, "after": 504704, "delta": 11092}, {"crate": "h2", "before": 431144, "after": 431144, "delta": 0}, {"crate": "quinn_proto", "before": 380616, "after": 380708, "delta": 92}, {"crate": "rustls", "before": 305048, "after": 305048, "delta": 0}, {"crate": "infraternal_agent", "before": 248092, "after": 247828, "delta": -264}, {"crate": "axum", "before": 209888, "after": 243508, "delta": 33620}, {"crate": "clap_builder", "before": 195560, "after": 195560, "delta": 0}, {"crate": "infraternal_shim", "before": 173184, "after": 173184, "delta": 0}, {"crate": "hyper", "before": 161760, "after": 161760, "delta": 0}, {"crate": "serde_json", "before": 160728, "after": 161212, "delta": 484}, {"crate": "infraternal", "before": 152560, "after": 152912, "delta": 352}, {"crate": "ring", "before": 131212, "after": 131212, "delta": 0}, {"crate": "webauthn_rs_core", "before": 129476, "after": 129476, "delta": 0}, {"crate": "sqlx_sqlite", "before": 126640, "after": 126640, "delta": 0}, {"crate": "sqlx_core", "before": 125772, "after": 126056, "delta": 284}, {"crate": "regex_syntax", "before": 125276, "after": 125276, "delta": 0}]. No dependency changes/second new provider. Largest wired server functions include build_router_core77664, CA router6624, private copy read6844 bytes. Reducing duplicated handler pipelines first; no baseline raised. JSON reports .scratch/run9/ca-shipping-arm-crates-{before,after}.json and functions-after.json.

kayg commented

2026-10-09 10:15:38 +00:00

Author

Owner

R3 first size candidate measured: sharing all3fixed CA HTTP routes through one identical extractor/handler pipeline saves8448ARMbytes:16251744→16243296, still46920over limit16196376.3real HTTP tests PASS2.23s; URLs/bodylimit32768/Origin/cookie/admission8 unchanged. No baseline raised. Trying one final writer-locked authority query to reduce repeated session/policy reads next, keeping exact registered proof/current generation/deadline checks.

kayg commented

2026-10-09 10:39:54 +00:00

Author

Owner

CA final-admission experiment: six alternating release runs, 100 actual passkey unlocks/run with 1,000 administrator rows/private copies, CPUWeight10000, 8 cores, launch load38.5–45.8. Median per-run metrics (ns): before: finish_process_cpu_p50_ns=2558305, finish_process_cpu_p99_ns=3839477, finish_wall_p50_ns=2574675, finish_wall_p99_ns=13840041; after: finish_process_cpu_p50_ns=1355632, finish_process_cpu_p99_ns=2485580, finish_wall_p50_ns=1278374, finish_wall_p99_ns=9200146. ARM size +272 bytes; one after-run CPU p99 rose to4,572,980ns. Reverted the experiment: this shared-host measurement does not justify retaining it as a performance change. Runtime CA wiring remains uncommitted while reducing ARM size; no baseline increase.

kayg commented

2026-10-09 10:53:20 +00:00

Author

Owner

ARM size probe (no baseline change): both alternate Axum adapters passed the three real HTTP regressions but grew the configured ARM CLI; reverted. Investigating the existing x86 RELR optimization for the same pinned ARM musl loader. Refetched o1 ed25519 key over NetBird: SHA256:uMAQHBbZ/cuo8T3nCMhAu30Y2XPSenXqlLYkSiJF9ww, exact owner-authorized run8 pin, dedicated known_hosts/strict checking. Read-only o1 probe: aarch64, rootless uid1002, load0.26/0.21/0.19. Will use only a private user test directory and remove it after loader/PTY/RSS/control measurements. No production service or perf VM involved.

kayg commented

2026-10-09 10:55:49 +00:00

Author

Owner

ARM RELR probe rejected: current aarch64 musl CLI is a fixed ET_EXEC static executable, with no dynamic section; enabling the existing pack-relative-relocs linker option leaves size exactly16,251,744 bytes. Reverted; no files installed on o1, no host cleanup necessary. Three CA dispatch experiments did not meet unchanged16,196,376-byte limit. Configured D168 adapter adds110,640 bytes over8f3d37e9 and misses limit by55,368. Prior per-crate text breakdown identifies Axum/auth/runtime, not a new TLS/crypto provider. Owner decision requested: authorize a separate measured CA budget adjustment, or retain the limit and continue code reduction. No baseline changed. Preparing the actual signed-passkey release-CLI regression and fixed CA API contract while the budget answer is pending.

kayg commented

2026-10-09 10:58:54 +00:00

Author

Owner

Proposed additive CA HTTP contract (invitation/join API unchanged):

Administrator CA HTTP adapter

A configured remote service mounts these POST-only paths at the pinned public
HTTPS origin. All three require exact Origin, the existing secure session
cookie and current explicit administrator membership with a registered passkey.
The finish body is bounded to32768 bytes and rejects unknown fields; status and
start do not consume a request body.
Missing/malformed cookies return401; a valid-shaped unauthorized cookie or bad
Origin returns403. Admission is bounded to eight requests and exhaustion
returns429. Finish parser errors return an empty400; oversized finish bodies
return413.
Responses never set a session cookie or include private CA material.

/remote/ca/status, body {}: returns {"locked":true} or
{"locked":false}. Existing administrator session liveness is required; a
stale freshness timestamp does not prevent starting a new passkey proof.
/remote/ca/unlock/start, body {}: returns the existing login_start
ceremony/options plus public ca metadata: member, positive generation,
base64url salt and issuer_fingerprint. The private purpose registry binds
this300-second single-use ceremony to its original session and membership
generation. Neither encrypted copy nor CA seed is returned.
/remote/ca/unlock/finish, body with exactly ceremony, existing WebAuthn
proof, and scoped_key (array of exactly32 bytes): requires a fresh real
registered-passkey proof, authenticated copy decryption and final authority
checks under the database writer lock. Returns only {"locked":false}.
Failures never echo wrapping material. The scoped key is the locally derived
CA wrapping key described above, never the account DEK or passkey PRF output.

The normal configured release CLI uses the same migrated Auth/database and cold
MemoryCaSource for this HTTP authority and enrollment/renewal. Unlocking one
therefore enables signing in the other; restart recreates the cold lock. Startup
refuses unsafe encrypted-copy storage rather than silently disabling unlock.
The API does not provision a missing administrator copy or alter role membership;
those actions must follow the provisioning/rewrap rules above.

Proposed additive CA HTTP contract (invitation/join API unchanged): ### Administrator CA HTTP adapter A configured remote service mounts these POST-only paths at the pinned public HTTPS origin. All three require exact `Origin`, the existing secure session cookie and current explicit administrator membership with a registered passkey. The finish body is bounded to32768 bytes and rejects unknown fields; status and start do not consume a request body. Missing/malformed cookies return401; a valid-shaped unauthorized cookie or bad Origin returns403. Admission is bounded to eight requests and exhaustion returns429. Finish parser errors return an empty400; oversized finish bodies return413. Responses never set a session cookie or include private CA material. - `/remote/ca/status`, body `{}`: returns `{"locked":true}` or `{"locked":false}`. Existing administrator session liveness is required; a stale freshness timestamp does not prevent starting a new passkey proof. - `/remote/ca/unlock/start`, body `{}`: returns the existing `login_start` ceremony/options plus public `ca` metadata: `member`, positive `generation`, base64url `salt` and `issuer_fingerprint`. The private purpose registry binds this300-second single-use ceremony to its original session and membership generation. Neither encrypted copy nor CA seed is returned. - `/remote/ca/unlock/finish`, body with exactly `ceremony`, existing WebAuthn `proof`, and `scoped_key` (array of exactly32 bytes): requires a fresh real registered-passkey proof, authenticated copy decryption and final authority checks under the database writer lock. Returns only `{"locked":false}`. Failures never echo wrapping material. The scoped key is the locally derived CA wrapping key described above, never the account DEK or passkey PRF output. The normal configured release CLI uses the same migrated Auth/database and cold `MemoryCaSource` for this HTTP authority and enrollment/renewal. Unlocking one therefore enables signing in the other; restart recreates the cold lock. Startup refuses unsafe encrypted-copy storage rather than silently disabling unlock. The API does not provision a missing administrator copy or alter role membership; those actions must follow the provisioning/rewrap rules above.

kayg commented

2026-10-09 11:08:22 +00:00

Author

Owner

Permanent configured release CLI regression committed; actual adapter wiring still awaiting ARM budget decision.
Head d14a7713a7. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-cli-test-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2291.40ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.77ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.32s]

Permanent configured release CLI regression committed; actual adapter wiring still awaiting ARM budget decision. Head d14a7713a761b61ced553e427333b028a6b18d02. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/shipping-cli-test-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2291.40ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [9.77ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.32s]

kayg commented

2026-10-09 11:17:02 +00:00

Author

Owner

Merged current dev01a6d848 cleanly; all exact review regressions pass. Browser verification next.
Head 031c8552b7. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/dev-latest-merge-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3058.61ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.76ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.09s]

Merged current dev01a6d848 cleanly; all exact review regressions pass. Browser verification next. Head 031c8552b78dc29d90e089f6e4aea10905ea05b1. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/dev-latest-merge-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3058.61ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.76ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.09s]

kayg commented

2026-10-09 11:18:24 +00:00

Author

Owner

CA HTTP self-review finding: finish decoded bounded proof/scoped-key JSON before Origin/cookie checks and before its eight-request admission reservation. New real-router regression failed first (0PASS/1FAIL0.90s, HTTP400 instead of forbidden403 for absent Origin with malformed wrapping input), .scratch/run9/ca-http-header-order-red.log. Moved cheap header/admission checks before decoder; existing successful request/API shapes unchanged. Running all four real HTTP cases before the full gate. No new parser or dependency.

kayg commented

2026-10-09 11:24:31 +00:00

Author

Owner

Pending R3 runtime activation, recorded as the concrete patch for the ARM budget decision. It connects the already committed real Auth/CaCopies authority to the same cold signing source; no dependency changes. Exact patch below, applicable after031c8552/d14a7713. The configured static CLI process proof passed3.04s; baseline remains unchanged.

--- a/crates/infraternal-server/src/remote_demo_tests.rs
+++ b/crates/infraternal-server/src/remote_demo_tests.rs
@@ -239,6 +239,7 @@
     )
     .unwrap();
     let service = crate::remote_runtime::RemoteService {
+        ca_administration: None,
         enrollment: crate::remote_http::EnrollmentService {
             source: signer.clone(),
             endpoint: crate::remote_http::EnrollmentEndpoint {
--- a/crates/infraternal-server/src/remote_runtime.rs
+++ b/crates/infraternal-server/src/remote_runtime.rs
@@ -19,6 +19,8 @@
 
 /// Trusted server transport identity and public issuers, supplied independently of the CA lock.
 pub struct RemoteService {
+    /// Cold signer and private copy store for the shipping administrator adapter.
+    pub ca_administration: Option<crate::ca_administration::CaAdministrationConfig>,
     /// Enrollment signer source and transport coordinates.
     pub enrollment: crate::remote_http::EnrollmentService,
     /// Server-only TLS key and certificate.
--- a/crates/infraternal-server/src/remote_startup.rs
+++ b/crates/infraternal-server/src/remote_startup.rs
@@ -89,6 +89,10 @@
         verify_server(&issuer, &certificate, name)?;
         let source = Arc::new(MemoryCaSource::cold_start(issuer.clone()));
         Ok(RemoteService {
+            ca_administration: Some(crate::ca_administration::CaAdministrationConfig::new(
+                source.clone(),
+                ca_dir,
+            )),
             enrollment: EnrollmentService {
                 source,
                 endpoint: EnrollmentEndpoint {
--- a/crates/infraternal-server/src/runtime.rs
+++ b/crates/infraternal-server/src/runtime.rs
@@ -306,6 +306,16 @@
     let auth = Auth::new(pool.clone(), rp_id, &config.public_origin)
         .await
         .map_err(ServerError::Auth)?;
+    let ca_api = remote
+        .as_ref()
+        .and_then(|service| service.ca_administration.as_ref())
+        .map(|configuration| {
+            configuration
+                .with_auth(auth.clone(), pool.clone())
+                .map(|authority| crate::ca_http::router(auth.clone(), authority))
+                .map_err(|_| ServerError::TlsConfiguration)
+        })
+        .transpose()?;
     let now = unix_seconds()?;
     websocket::recover_connections(&pool, now)
         .await
@@ -372,6 +382,11 @@
         .with_state(pool)
         .merge(auth::router(auth))
         .merge(websocket::router(ws_state));
+    let app = if let Some(ca_api) = ca_api {
+        app.merge(ca_api)
+    } else {
+        app
+    };
     let app = if let Some(remote_api) = remote_api {
         app.merge(remote_api)
     } else {

Pending R3 runtime activation, recorded as the concrete patch for the ARM budget decision. It connects the already committed real Auth/CaCopies authority to the same cold signing source; no dependency changes. Exact patch below, applicable after031c8552/d14a7713. The configured static CLI process proof passed3.04s; baseline remains unchanged. ```diff --- a/crates/infraternal-server/src/remote_demo_tests.rs +++ b/crates/infraternal-server/src/remote_demo_tests.rs @@ -239,6 +239,7 @@ ) .unwrap(); let service = crate::remote_runtime::RemoteService { + ca_administration: None, enrollment: crate::remote_http::EnrollmentService { source: signer.clone(), endpoint: crate::remote_http::EnrollmentEndpoint { --- a/crates/infraternal-server/src/remote_runtime.rs +++ b/crates/infraternal-server/src/remote_runtime.rs @@ -19,6 +19,8 @@ /// Trusted server transport identity and public issuers, supplied independently of the CA lock. pub struct RemoteService { + /// Cold signer and private copy store for the shipping administrator adapter. + pub ca_administration: Option<crate::ca_administration::CaAdministrationConfig>, /// Enrollment signer source and transport coordinates. pub enrollment: crate::remote_http::EnrollmentService, /// Server-only TLS key and certificate. --- a/crates/infraternal-server/src/remote_startup.rs +++ b/crates/infraternal-server/src/remote_startup.rs @@ -89,6 +89,10 @@ verify_server(&issuer, &certificate, name)?; let source = Arc::new(MemoryCaSource::cold_start(issuer.clone())); Ok(RemoteService { + ca_administration: Some(crate::ca_administration::CaAdministrationConfig::new( + source.clone(), + ca_dir, + )), enrollment: EnrollmentService { source, endpoint: EnrollmentEndpoint { --- a/crates/infraternal-server/src/runtime.rs +++ b/crates/infraternal-server/src/runtime.rs @@ -306,6 +306,16 @@ let auth = Auth::new(pool.clone(), rp_id, &config.public_origin) .await .map_err(ServerError::Auth)?; + let ca_api = remote + .as_ref() + .and_then(|service| service.ca_administration.as_ref()) + .map(|configuration| { + configuration + .with_auth(auth.clone(), pool.clone()) + .map(|authority| crate::ca_http::router(auth.clone(), authority)) + .map_err(|_| ServerError::TlsConfiguration) + }) + .transpose()?; let now = unix_seconds()?; websocket::recover_connections(&pool, now) .await @@ -372,6 +382,11 @@ .with_state(pool) .merge(auth::router(auth)) .merge(websocket::router(ws_state)); + let app = if let Some(ca_api) = ca_api { + app.merge(ca_api) + } else { + app + }; let app = if let Some(remote_api) = remote_api { app.merge(remote_api) } else { ```

kayg commented

2026-10-09 11:35:07 +00:00

Author

Owner

CA unlock header/admission ordering fixed after failing real-router regression; four HTTP cases pass.
Head a317a56d5a. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-header-order-fast.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3162.01ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.72ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [3.21s]

CA unlock header/admission ordering fixed after failing real-router regression; four HTTP cases pass. Head a317a56d5a8d4f57289ad05ca9ee7bd935b1f121. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-http-header-order-fast.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3162.01ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.72ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.21s]

kayg commented

2026-10-09 12:52:02 +00:00

Author

Owner

Production verification at a317a56d after dev01a6d848 merge: build/typecheck PASS; real rootless two-process remote/browser proof PASS7.16s, join-to-terminal428998us, native key44721us,352bytes lost0/duplicated0, three independently acknowledged browser writers. Desktop/phone Chromium n25 glyph p50/p99 23.50/49.00ms and23.30/49.60ms; load10.09/18.69/21.30,8cores; no own compiler overlap. Captures docs/verification/remote-agents/run9-merged-production/{desktop,iphone}.png for owner review, no author visual-quality judgment. Full325-case browser4701 is RED:281PASS/18FAIL/26skip51.1min. All18 failures rechecked against actual dev01a6d848 (6PASS/12FAIL7.5min) and head (5PASS/13FAIL7.4min). Twelve failures reproduce on both, five pass on both; the differing mesh-access case reverses on recheck (headPASS/devFAIL). UI/protocol/harness inputs byte-identical to merged dev; no baseline/assertion/deadline weakened. Temporary comparison worktree removed. Full sanitized comparison is being added to docs/verification/remote-agents-run9-ca-authority.md with a separate fast gate. R3 runtime patch/budget decision still pending; no baseline increase or remote install.

Production verification at a317a56d after dev01a6d848 merge: build/typecheck PASS; real rootless two-process remote/browser proof PASS7.16s, join-to-terminal428998us, native key44721us,352bytes lost0/duplicated0, three independently acknowledged browser writers. Desktop/phone Chromium n25 glyph p50/p99 23.50/49.00ms and23.30/49.60ms; load10.09/18.69/21.30,8cores; no own compiler overlap. Captures docs/verification/remote-agents/run9-merged-production/{desktop,iphone}.png for owner review, no author visual-quality judgment. Full325-case browser4701 is RED:281PASS/18FAIL/26skip51.1min. All18 failures rechecked against actual dev01a6d848 (6PASS/12FAIL7.5min) and head (5PASS/13FAIL7.4min). Twelve failures reproduce on both, five pass on both; the differing mesh-access case reverses on recheck (headPASS/devFAIL). UI/protocol/harness inputs byte-identical to merged dev; no baseline/assertion/deadline weakened. Temporary comparison worktree removed. Full sanitized comparison is being added to docs/verification/remote-agents-run9-ca-authority.md with a separate fast gate. R3 runtime patch/budget decision still pending; no baseline increase or remote install.

kayg commented

2026-10-09 12:58:51 +00:00

Author

Owner

Documentation fast first attempt RED in untouched one_hertz_wakeup_is_detected_past_the_legacy_half_second_window: legacy500ms CPU ticks2→3, fixture assertion, .scratch/run9/ca-authority-docs-fast.log; load12.99/13.64/10.14,8cores. Exact head CPUWeight10000 rerun PASS3.11s (schedstat2 slices/2.500s). Exact devac03b19 same test/scope/required Nix-Zig environment PASS3.10s (2 slices/2.501s), .scratch/run9/idle-canary-ac03-nix-comparison.log. Wrapper/fixture/observer byte-identical. Baseline initially lacked Zig then Nix in scratch PATH; neither build failure is counted as a test result. Used absolute Nix/Cargo paths, removed temporary worktree. No observer/assertion/deadline change; full requested fast retry now running before docs commit.

kayg commented

2026-10-09 13:05:58 +00:00

Author

Owner

Documentation full retry RED only in untouched expired_handshake_releases_user_permits at auth/socket_tests.rs:151; static builds PASS18,109,456/16,141,104. Exact head rerun under CPUWeight10000/required Nix shell PASS0.72s; prior exact ac03b19 comparison PASS6.09s, both in .scratch/run9. Inspection load13.46/10.48/10.86 on8cores is not launch-time load. No source/threshold change. Full gate retry uses default test concurrency. Budget decision still pending; the concrete 4-file runtime patch and measured crate breakdown remain on this issue.

Documentation full retry RED only in untouched expired_handshake_releases_user_permits at auth/socket_tests.rs:151; static builds PASS18,109,456/16,141,104. Exact head rerun under CPUWeight10000/required Nix shell PASS0.72s; prior exact ac03b19 comparison PASS6.09s, both in .scratch/run9. Inspection load13.46/10.48/10.86 on8cores is not launch-time load. No source/threshold change. Full gate retry uses default test concurrency. Budget decision still pending; the concrete 4-file runtime patch and measured crate breakdown remain on this issue.

kayg commented

2026-10-09 13:06:38 +00:00

Author

Owner

Author security checklist at a317a56d: reviewed exact Origin/cookie admission, bounded 32768-byte unlock decoder/ASAN, purpose/original-session/member-generation binding, real registered UV passkey proof without a new login session, credential/current-role/session rechecks under the SQLite writer before installation, private 0700/0600 encrypted-copy publication and zeroized wrapping buffers. HTTP responses omit private material and Set-Cookie. Four real HTTP regressions plus seven real authority cases cover these boundaries. Rootless two-process remote session and three durable browser writers pass. Production captures are attached for owner visual review; no author aesthetic judgment. Remaining D168 gaps: first-copy provisioning/browser derivation, grant/revoke rewrap, notification delivery and update IPC. R3 activation patch is concrete and passes the configured CLI proof but remains unapplied pending the ARM budget decision. Full browser gate remains red with same-source dev comparisons recorded; no threshold weakened.

Author security checklist at a317a56d: reviewed exact Origin/cookie admission, bounded 32768-byte unlock decoder/ASAN, purpose/original-session/member-generation binding, real registered UV passkey proof without a new login session, credential/current-role/session rechecks under the SQLite writer before installation, private 0700/0600 encrypted-copy publication and zeroized wrapping buffers. HTTP responses omit private material and Set-Cookie. Four real HTTP regressions plus seven real authority cases cover these boundaries. Rootless two-process remote session and three durable browser writers pass. Production captures are attached for owner visual review; no author aesthetic judgment. Remaining D168 gaps: first-copy provisioning/browser derivation, grant/revoke rewrap, notification delivery and update IPC. R3 activation patch is concrete and passes the configured CLI proof but remains unapplied pending the ARM budget decision. Full browser gate remains red with same-source dev comparisons recorded; no threshold weakened.

kayg commented

2026-10-09 13:10:00 +00:00

Author

Owner

Default-concurrency documentation gate RED: concurrent legacy fixtures hit existing process-global ARGON_SLOTS(2), Throttled at auth/tests.rs:3094, affecting existing auth and new CA cases before CA execution; crypto.rs:26-28 unchanged. All other Rust rows/statics PASS. Returning full gate to RUST_TEST_THREADS=1 used by prior green per-step gates; no admission/threshold/source change. Evidence .scratch/run9/ca-authority-docs-fast-default.log.

kayg commented

2026-10-09 13:17:15 +00:00

Author

Owner

Additive CA HTTP contract and sanitized measured/security/browser verification committed. Real production captures cited by this commit; shipping runtime patch remains unapplied pending measured ARM budget decision. Phase1 incomplete, browser gate RED with actual dev comparisons.
Head 7d3caf7bae. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-authority-docs-fast-serial-final.log. Verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272)
PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376)
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2836.10ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.47ms]

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.86s]

Additive CA HTTP contract and sanitized measured/security/browser verification committed. Real production captures cited by this commit; shipping runtime patch remains unapplied pending measured ARM budget decision. Phase1 incomplete, browser gate RED with actual dev comparisons. Head 7d3caf7bae1b674596e56c31c318c470d3bdb24c. CPUWeight10000/TRACER_TEST_PORT4701 requested Nix fast exit0; log .scratch/run9/ca-authority-docs-fast-serial-final.log. Verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ PT_INTERP: absent; size: 18109456 bytes (baseline 18982128 + allowance 262144 = max 19244272) PT_INTERP: absent; size: 16141104 bytes (baseline 15934232 + allowance 262144 = max 16196376) stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [2836.10ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.47ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.86s]

kayg commented

2026-10-09 13:18:22 +00:00

Author

Owner

Run9 handoff, head 7d3caf7b (remote-agents): R1 exact live-revocation and retained-expiry regressions PASS. R2 live half-life/durable-ACK renewal and uninterrupted 50MiB QUIC/TCP proofs PASS. CLI renewal CPU QUIC 1,830,807ns / TCP 1,429,619ns, RSS +132/+136KiB, application bytes 1786/1790 (encrypted framing excluded). At 300ms RTT, n25 QUIC handshake p50/p99 456,005/460,586us, TCP 758,759/763,537us. 1000 direct paired transports RSS +67,628KiB QUIC / +69,408KiB TCP, excluding credentials/shims/full server. 1000 retained TLS host actors RSS +128,728KiB includes both ends; revocation removes all 1000 in 173,473us. Earlier per-step comments record machine/load/methods; unchanged paths were not remeasured for docs.

R3: real administrator authority/private wrapped-copy store/HTTP API and bounded parser ASAN are committed, plus the permanent configured-release-CLI cold-lock/passkey-unlock/restart regression. The concrete four-file runtime activation patch is on this issue and .scratch/run9/runtime-ca-wiring.patch; its CLI preview PASS 3.04s. It remains unapplied: last canonical activation ARM 16,251,744 exceeds unchanged 16,196,376 by 55,368 bytes. x86 18,238,192 fits; committed builds 18,109,456/16,141,104. No added dependency/provider. Matched crate breakdown and reverted reductions recorded above. Owner budget decision requested via chat and this issue, no answer received. Run7 permits unapproved baseline growth only for justified QUIC; this is CA HTTP/auth activation, so no silent adjustment.

Final requested Nix/CPUWeight10000/TRACER_TEST_PORT4701/RUST_TEST_THREADS1 fast exit0 is quoted verbatim in the preceding comment. Red attempts retained: untouched canary and handshake pass exact isolated head/ac03 comparisons; default parallel legacy fixtures hit existing ARGON_SLOTS2 before CA. Production build/check pass; full browser325: 281PASS/18FAIL/26skip. Actual merged dev01a6d848/sourcea317 rechecks reproduce12 failures on both, five pass both, mesh reverses. No threshold/image baseline changed. Real rootless two-process proof PASS7.16s/352bytes lost0 duplicated0/three independent writers; join428,998us; key44,721us. Captures and sanitized limitations: docs/verification/remote-agents-run9-ca-authority.md.

Remaining: R3 activation plus initial CA-copy provisioning/browser derivation, role rewrap/notifications/update IPC; authenticated uninstall/removal, fail-closed lease, direct o1/o2 chaos and rotation proofs. Phase1 remains incomplete. Direct o1 reachability previously failed; only prior TCP-relay proof exists. No remote installation this round, no push/deploy/perf VM. Temporary comparison worktrees and own build/scratch cache removed; review patch/small logs retained inside worktree. Unused unregistered remote_lease.rs remains uncommitted. Issue left open.

Run9 handoff, head 7d3caf7b (remote-agents): R1 exact live-revocation and retained-expiry regressions PASS. R2 live half-life/durable-ACK renewal and uninterrupted 50MiB QUIC/TCP proofs PASS. CLI renewal CPU QUIC 1,830,807ns / TCP 1,429,619ns, RSS +132/+136KiB, application bytes 1786/1790 (encrypted framing excluded). At 300ms RTT, n25 QUIC handshake p50/p99 456,005/460,586us, TCP 758,759/763,537us. 1000 direct paired transports RSS +67,628KiB QUIC / +69,408KiB TCP, excluding credentials/shims/full server. 1000 retained TLS host actors RSS +128,728KiB includes both ends; revocation removes all 1000 in 173,473us. Earlier per-step comments record machine/load/methods; unchanged paths were not remeasured for docs. R3: real administrator authority/private wrapped-copy store/HTTP API and bounded parser ASAN are committed, plus the permanent configured-release-CLI cold-lock/passkey-unlock/restart regression. The concrete four-file runtime activation patch is on this issue and .scratch/run9/runtime-ca-wiring.patch; its CLI preview PASS 3.04s. It remains unapplied: last canonical activation ARM 16,251,744 exceeds unchanged 16,196,376 by 55,368 bytes. x86 18,238,192 fits; committed builds 18,109,456/16,141,104. No added dependency/provider. Matched crate breakdown and reverted reductions recorded above. Owner budget decision requested via chat and this issue, no answer received. Run7 permits unapproved baseline growth only for justified QUIC; this is CA HTTP/auth activation, so no silent adjustment. Final requested Nix/CPUWeight10000/TRACER_TEST_PORT4701/RUST_TEST_THREADS1 fast exit0 is quoted verbatim in the preceding comment. Red attempts retained: untouched canary and handshake pass exact isolated head/ac03 comparisons; default parallel legacy fixtures hit existing ARGON_SLOTS2 before CA. Production build/check pass; full browser325: 281PASS/18FAIL/26skip. Actual merged dev01a6d848/sourcea317 rechecks reproduce12 failures on both, five pass both, mesh reverses. No threshold/image baseline changed. Real rootless two-process proof PASS7.16s/352bytes lost0 duplicated0/three independent writers; join428,998us; key44,721us. Captures and sanitized limitations: docs/verification/remote-agents-run9-ca-authority.md. Remaining: R3 activation plus initial CA-copy provisioning/browser derivation, role rewrap/notifications/update IPC; authenticated uninstall/removal, fail-closed lease, direct o1/o2 chaos and rotation proofs. Phase1 remains incomplete. Direct o1 reachability previously failed; only prior TCP-relay proof exists. No remote installation this round, no push/deploy/perf VM. Temporary comparison worktrees and own build/scratch cache removed; review patch/small logs retained inside worktree. Unused unregistered remote_lease.rs remains uncommitted. Issue left open.

kayg commented

2026-10-09 13:22:03 +00:00

Author

Owner

Independent verification started on review-remote-agents, target 7d3caf7bae, merge base with dev 01a6d84824. Detached target checkout moved to a new local review branch; implementation stays unchanged. Reading #78/#5 history, main decisions, contracts and author result. Exact target-head fast gate running under CPUWeight=10000, unique browser port 4786, job-owned HOME cache. Checking shipping CA routing, pre-body admission and remote authority boundaries. No push/deploy or remote host use.

Independent verification started on review-remote-agents, target 7d3caf7bae1b674596e56c31c318c470d3bdb24c, merge base with dev 01a6d848242d8a4e723f5777942211ac4df12c6f. Detached target checkout moved to a new local review branch; implementation stays unchanged. Reading #78/#5 history, main decisions, contracts and author result. Exact target-head fast gate running under CPUWeight=10000, unique browser port 4786, job-owned HOME cache. Checking shipping CA routing, pre-body admission and remote authority boundaries. No push/deploy or remote host use.

kayg referenced this issue

2026-10-09 13:23:18 +00:00

Mesh data plane: WireGuard on nodes, coordinator wiring, deny by default, resolver, CLI #129

kayg commented

2026-10-09 13:43:15 +00:00

Author

Owner

Independent review RA3 (P2), commit a3a7c231 on review-remote-agents: new remote CLI definitions refuse --json for agent join, agent run and remote-enabled server (D199/D202). Failing test remote_server::tests::independent_review_remote_operator_commands_accept_json_output uses the actual Clap definitions; parser results [false,false,false], expected [true,true,true], 0 passed / 1 failed, 0.00s. Location crates/infraternal/src/main.rs:14 and AgentAction. No identity reads/network calls; implementation unchanged. Raw log remote-agents-review/regressions-final.log, findings appended to review-remote-agents/findings.md. Separate CA route/body tests next.

Independent review RA3 (P2), commit a3a7c231 on review-remote-agents: new remote CLI definitions refuse --json for agent join, agent run and remote-enabled server (D199/D202). Failing test remote_server::tests::independent_review_remote_operator_commands_accept_json_output uses the actual Clap definitions; parser results [false,false,false], expected [true,true,true], 0 passed / 1 failed, 0.00s. Location crates/infraternal/src/main.rs:14 and AgentAction. No identity reads/network calls; implementation unchanged. Raw log remote-agents-review/regressions-final.log, findings appended to review-remote-agents/findings.md. Separate CA route/body tests next.

kayg commented

2026-10-09 13:46:26 +00:00

Author

Owner

RA1 P1: The configured production router omits CA status and unlock routes. Review commit 8953e45b on review-remote-agents. A configured remote service with a cold CA source returns [404, 404, 404] for POST /remote/ca/status, /remote/ca/unlock/start and /remote/ca/unlock/finish; expected cookie admission [401, 401, 401]. The standalone CA router exists but build_router_core does not mount it. D168/D198. This confirms the author-reported runtime activation gap. Tests: independent_review_configured_server_mounts_ca_unlock_routes; raw evidence will be retained in docs/verification/review-remote-agents/. No implementation change.

RA1 P1: The configured production router omits CA status and unlock routes. Review commit 8953e45b on review-remote-agents. A configured remote service with a cold CA source returns [404, 404, 404] for POST /remote/ca/status, /remote/ca/unlock/start and /remote/ca/unlock/finish; expected cookie admission [401, 401, 401]. The standalone CA router exists but build_router_core does not mount it. D168/D198. This confirms the author-reported runtime activation gap. Tests: independent_review_configured_server_mounts_ca_unlock_routes; raw evidence will be retained in docs/verification/review-remote-agents/. No implementation change.

kayg commented

2026-10-09 13:46:28 +00:00

Author

Owner

RA2 P2: CA body extraction precedes header refusal and request admission. Review commit bebdec4c on review-remote-agents. A request without origin/cookie and with an unfinished body remains pending after 1 second instead of returning 403. Eight valid-header unfinished requests permit a ninth request (200, expected 429). Pending tasks are aborted and awaited before assertions. The per-body byte limit does not bound aggregate pending requests. D40/D168. Tests: independent_review_ca_headers_are_refused_before_reading_an_unfinished_body; independent_review_ca_body_reads_share_the_eight_request_admission_limit; raw evidence will be retained in docs/verification/review-remote-agents/. No implementation change.

RA2 P2: CA body extraction precedes header refusal and request admission. Review commit bebdec4c on review-remote-agents. A request without origin/cookie and with an unfinished body remains pending after 1 second instead of returning 403. Eight valid-header unfinished requests permit a ninth request (200, expected 429). Pending tasks are aborted and awaited before assertions. The per-body byte limit does not bound aggregate pending requests. D40/D168. Tests: independent_review_ca_headers_are_refused_before_reading_an_unfinished_body; independent_review_ca_body_reads_share_the_eight_request_admission_limit; raw evidence will be retained in docs/verification/review-remote-agents/. No implementation change.

kayg commented

2026-10-09 13:58:33 +00:00

Author

Owner

Review tests committed: RA1 8953e45b (P1), RA2 bebdec4c (P2; two failures), RA3 a3a7c231 (P2). CA unlock ASAN: 1,202,458 executions/31s, no crash. Head gate rerun: the long owned TMPDIR makes an existing UUID UNIX-socket fixture path 125 bytes and fails SUN_LEN; retry uses an owned short scratch alias with a 107-byte fixture path, without changing tests. Credit/auth timeout tests passed. ARM and release scale builds continue; no pinned-host access.

Review tests committed: RA1 8953e45b (P1), RA2 bebdec4c (P2; two failures), RA3 a3a7c231 (P2). CA unlock ASAN: 1,202,458 executions/31s, no crash. Head gate rerun: the long owned TMPDIR makes an existing UUID UNIX-socket fixture path 125 bytes and fails SUN_LEN; retry uses an owned short scratch alias with a 107-byte fixture path, without changing tests. Credit/auth timeout tests passed. ARM and release scale builds continue; no pinned-host access.

kayg commented

2026-10-09 14:03:28 +00:00

Author

Owner

RA4 P2: D198 build-time removal is absent. The offline locked normal graphs for both infraternal-agent and infraternal-server retain quinn with --no-default-features. Failing integration test independent_review_core_build_without_features_omits_remote_transport: 0 passed / 1 failed in 0.53s. Review commit 43aaf93b; no implementation or foundational choice. Test checks resolved graphs, including indirect dependencies.

kayg commented

2026-10-09 14:05:50 +00:00

Author

Owner

Parser verification complete: five production decoder ASAN campaigns, 30s configured / 31s reported each, 16,942,400 executions total, zero artifacts. Unlock 1,202,458; CSR 5,793,824; binding 7,020,572; renewal 738,163; copy 2,187,383. Public/synthetic seeds cover accepted shapes, oversize bodies, width and ceremony boundaries. Peak reported RSS 476–569 MiB. Logs will be retained under docs/verification/review-remote-agents/. RA4 final test commit is 347ce302 (same logical test, added standard test-only lint allowances before retaining it); supersedes the earlier short SHA in the finding comment. Head gate short-path retry: completed native suites have zero failures so far.

Parser verification complete: five production decoder ASAN campaigns, 30s configured / 31s reported each, 16,942,400 executions total, zero artifacts. Unlock 1,202,458; CSR 5,793,824; binding 7,020,572; renewal 738,163; copy 2,187,383. Public/synthetic seeds cover accepted shapes, oversize bodies, width and ceremony boundaries. Peak reported RSS 476–569 MiB. Logs will be retained under docs/verification/review-remote-agents/. RA4 final test commit is 347ce302 (same logical test, added standard test-only lint allowances before retaining it); supersedes the earlier short SHA in the finding comment. Head gate short-path retry: completed native suites have zero failures so far.

kayg commented

2026-10-09 14:22:40 +00:00

Author

Owner

Target 7d3caf7b full fast gate PASS (exit 0), source equality checked against the target before and after native checks. Serial Rust tests: 352 passed, 0 failed, 46 ignored. Production tracer check/build/transfer budget pass. Protocol: 7 pass, 0 fail, 34390 assertions; 134 streams / 11439 schedules, zero divergences. Static x86 18105104 bytes; ARM 16141104 bytes; both static/no PT_INTERP and within unchanged limits. Earlier failures were existing fixture paths (missing target parent; long TMPDIR SUN_LEN); the final run corrects only environment paths. Review failures remain committed separately. Verbatim Rust summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Scale/native-latency runs started with all owned build scopes inactive.

Target 7d3caf7b full fast gate PASS (exit 0), source equality checked against the target before and after native checks. Serial Rust tests: 352 passed, 0 failed, 46 ignored. Production tracer check/build/transfer budget pass. Protocol: 7 pass, 0 fail, 34390 assertions; 134 streams / 11439 schedules, zero divergences. Static x86 18105104 bytes; ARM 16141104 bytes; both static/no PT_INTERP and within unchanged limits. Earlier failures were existing fixture paths (missing target parent; long TMPDIR SUN_LEN); the final run corrects only environment paths. Review failures remain committed separately. Verbatim Rust summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Scale/native-latency runs started with all owned build scopes inactive.

kayg commented

2026-10-09 14:26:38 +00:00

Author

Owner

Independent native latency gate is red on target 7d3caf7b: same-session flood confirmed echo/PTY echo p99 477.90/479.06ms versus334ms, PTY growth154.09ms versus16.67ms; baseline and other-session metrics passed. 100 samples/phase, 300ms RTT ±30ms, infraternal-dev8cores, CPUWeight10000, no own compiler/browser overlap; load14.23/16.86/23.14 at start and11.24/15.40/21.97 at end. Attribution is pending a fresh detached dev01a6d848 baseline build/run in the owned scratch checkout. No implementation change.

Independent native latency gate is red on target 7d3caf7b: same-session flood confirmed echo/PTY echo p99 477.90/479.06ms versus334ms, PTY growth154.09ms versus16.67ms; baseline and other-session metrics passed. 100 samples/phase, 300ms RTT ±30ms, infraternal-dev8cores, CPUWeight10000, no own compiler/browser overlap; load14.23/16.86/23.14 at start and11.24/15.40/21.97 at end. Attribution is pending a fresh detached dev01a6d848 baseline build/run in the owned scratch checkout. No implementation change.

kayg commented

2026-10-09 14:27:47 +00:00

Author

Owner

Correction to the preceding metric: same-session confirmed echo p99 is448.64ms (not477.90); PTY echo479.06ms and growth154.09ms are unchanged. The detached baseline is pinned to merge-base01a6d848 for attribution against the reviewed diff; dev advanced to7d6df447 during this review. Initial baseline build could not find nix in the new checkout environment; retry uses its absolute executable path. No credential investigation or source changes.

kayg commented

2026-10-09 16:00:27 +00:00

Author

Owner

Repair round started: sole writer on remote-agents, base 7d3caf7bae. Read #78 history (341 comments), parent #5, repository contract/process, and last 20 commits. Merge dev 42e50d42 first; then reproduce RA1–RA4 from review head 347ce302 and repair each independently. D205 authorizes measured CA activation growth; preserve existing scratch/lease prototype. No push/deploy or external host use.

Repair round started: sole writer on remote-agents, base 7d3caf7bae1b674596e56c31c318c470d3bdb24c. Read #78 history (341 comments), parent #5, repository contract/process, and last 20 commits. Merge dev 42e50d42 first; then reproduce RA1–RA4 from review head 347ce302 and repair each independently. D205 authorizes measured CA activation growth; preserve existing scratch/lease prototype. No push/deploy or external host use.

kayg commented

2026-10-09 16:11:17 +00:00

Author

Owner

Merge gate environment finding: initial_attach_requires_explicit_credit_before_replay failed before protocol work because verify-agent-attach-credit.py:17 creates target/ac without creating target. Build output is correctly under HOME cache; added worktree target symlink to that cache and queued the exact unchanged regression. fmt/Clippy passed; static targets still cold-building. Evidence: merge-fast.log lines 619–632 under HOME cache remote-agents. No source/deadline changes.

Merge gate environment finding: initial_attach_requires_explicit_credit_before_replay failed before protocol work because verify-agent-attach-credit.py:17 creates target/ac<PID> without creating target. Build output is correctly under HOME cache; added worktree target symlink to that cache and queued the exact unchanged regression. fmt/Clippy passed; static targets still cold-building. Evidence: merge-fast.log lines 619–632 under HOME cache remote-agents. No source/deadline changes.

kayg commented

2026-10-09 16:38:21 +00:00

Author

Owner

kayg commented

2026-10-09 16:38:54 +00:00

Author

Owner

RA1 reproduced before repair after cherry-pick of 8953e45b: independent_review_configured_server_mounts_ca_unlock_routes failed 0 passed/1 failed in 0.09s; actual [404,404,404], expected [401,401,401]. Applied preserved run9 runtime-ca-wiring.patch. Review fixture now supplies explicit CaAdministrationConfig sharing its cold source; route assertions unchanged. Production RemoteStartup supplies checked private storage. Full gate running; configured CLI proof follows. D168/D205, no dependency/provider or size-baseline change. Evidence HOME cache remote-agents/ra1-red.log, paths runtime.rs/remote_startup.rs/remote_runtime.rs.

RA1 reproduced before repair after cherry-pick of 8953e45b: independent_review_configured_server_mounts_ca_unlock_routes failed 0 passed/1 failed in 0.09s; actual [404,404,404], expected [401,401,401]. Applied preserved run9 runtime-ca-wiring.patch. Review fixture now supplies explicit CaAdministrationConfig sharing its cold source; route assertions unchanged. Production RemoteStartup supplies checked private storage. Full gate running; configured CLI proof follows. D168/D205, no dependency/provider or size-baseline change. Evidence HOME cache remote-agents/ra1-red.log, paths runtime.rs/remote_startup.rs/remote_runtime.rs.

kayg commented

2026-10-09 16:52:17 +00:00

Author

Owner

RA4 repair proposal [D198/D205], before code: extract existing TLS/QUIC/native-channel/renewal primitives into infraternal-plugin-remote, behind optional remote Cargo features. Share the existing Channel contract through infraternal-plugin-api; declare remote action/settings/default/role-dependency metadata without a new loader, transport or crypto engine. Core host/server defaults do not enable remote; the shipping CLI remote feature preserves current enabled behavior and explicitly forwards features with dependency defaults disabled. Gate common actor/router integration and operator implementation too, then check no-default core/CLI compilation and offline normal graphs. Existing wire, admission and join JSON remain unchanged. Reject only hiding CLI flags or making direct quinn optional while retaining an indirect unconditional dependency.

kayg commented

2026-10-09 17:09:32 +00:00

Author

Owner

RA1 / R3 runtime activation completed a81d9daebc. Regression [404,404,404] -> cookie admission [401,401,401]. Actual configured rootless release CLI proof PASS 2.61s: cold join refusal, real signed registered-passkey unlock using private encrypted copy, successful same-token enrollment, restart cold lock; no fixture signer injected into server. Two bare CLI stubs pass. Final stripped static x86 18233840 B (+128736) / ARM 16250592 B (+109488); ARM is 54216 B above unchanged max, accepted feature growth under D205. No dependency/provider or size baseline changes. Router extraction preserves private-storage refusal before listeners; existing web-root check moves into config validation. Native gate rows and TS pass; fast exit 1 solely from ARM size. Verbatim fast summary:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+

Supplemental TS stage (normally skipped by set -e after size-only failure), exit 0:
7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.99s]

RA1 / R3 runtime activation completed a81d9daebcb8551060360b05daa69b959afbdd4b. Regression [404,404,404] -> cookie admission [401,401,401]. Actual configured rootless release CLI proof PASS 2.61s: cold join refusal, real signed registered-passkey unlock using private encrypted copy, successful same-token enrollment, restart cold lock; no fixture signer injected into server. Two bare CLI stubs pass. Final stripped static x86 18233840 B (+128736) / ARM 16250592 B (+109488); ARM is 54216 B above unchanged max, accepted feature growth under D205. No dependency/provider or size baseline changes. Router extraction preserves private-storage refusal before listeners; existing web-root check moves into config validation. Native gate rows and TS pass; fast exit 1 solely from ARM size. Verbatim fast summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Supplemental TS stage (normally skipped by set -e after size-only failure), exit 0: 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.99s]

kayg commented

2026-10-09 17:17:39 +00:00

Author

Owner

RA2 red evidence (2d3c7b19): both review tests failed in 2.48s. Missing headers waited 1s on an unfinished body; eight unfinished bodies left /status at HTTP 200 instead of 429. Additional deadline regression failed (outer 6s elapsed). Fix reserves the shared eight-slot permit after header validation and before body reads, with a five-second deadline through verification. Targeted real HTTP suite: 7 passed, 0 failed, 1 ignored. Debug router benchmark, 1000 requests, infraternal-dev/8 cores: before p50 33606 ns/p99 116360 ns (load 9.16/14.23/17.74); after p50 35716 ns/p99 100524 ns (load 10.84/11.25/15.55). Median overhead 2110 ns/request, 2.11 ms projected at 1000; bounded bodies 8 x 32768 = 262144 bytes. Excludes network and passkey work; shared host load limits comparison. Full gate running. Evidence: ca_http.rs, auth/ca_http_tests.rs; scratch ra2-{red,deadline-red,green,bench-before,bench-after}.log.

RA2 red evidence (2d3c7b19): both review tests failed in 2.48s. Missing headers waited 1s on an unfinished body; eight unfinished bodies left /status at HTTP 200 instead of 429. Additional deadline regression failed (outer 6s elapsed). Fix reserves the shared eight-slot permit after header validation and before body reads, with a five-second deadline through verification. Targeted real HTTP suite: 7 passed, 0 failed, 1 ignored. Debug router benchmark, 1000 requests, infraternal-dev/8 cores: before p50 33606 ns/p99 116360 ns (load 9.16/14.23/17.74); after p50 35716 ns/p99 100524 ns (load 10.84/11.25/15.55). Median overhead 2110 ns/request, 2.11 ms projected at 1000; bounded bodies 8 x 32768 = 262144 bytes. Excludes network and passkey work; shared host load limits comparison. Full gate running. Evidence: ca_http.rs, auth/ca_http_tests.rs; scratch ra2-{red,deadline-red,green,bench-before,bench-after}.log.

kayg commented

2026-10-09 17:33:28 +00:00

Author

Owner

RA2 completed: 3822204500. Stripped static sizes x86 18235344 (+1504), ARM 16253424 (+2832) bytes versus a81d9dae; no PT_INTERP. Only fast failure is ARM 57048 bytes over the old budget, reported per D205. Supplemental TypeScript compiler/production bundle/protocol checks passed (7 pass, 0 fail, 34390 assertions; 134 streams/11439 schedules/zero divergences). Full Rust gate output, verbatim:

Supplemental TS output, verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [4.69s]

RA2 completed: 38222045003ce81f6943a5864e3cdbe87242a557. Stripped static sizes x86 18235344 (+1504), ARM 16253424 (+2832) bytes versus a81d9dae; no PT_INTERP. Only fast failure is ARM 57048 bytes over the old budget, reported per D205. Supplemental TypeScript compiler/production bundle/protocol checks passed (7 pass, 0 fail, 34390 assertions; 134 streams/11439 schedules/zero divergences). Full Rust gate output, verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Supplemental TS output, verbatim: 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.69s]

kayg commented

2026-10-09 17:42:56 +00:00

Author

Owner

RA4 red: cherry-picked 347ce302 as 158a12d2. The unchanged std-only regression compiled with rustc --test failed in 0.52s: both infraternal-agent and infraternal-server retain quinn in offline locked normal graphs with defaults disabled. Stopped my redundant package-specific native build; the test needs only std and cargo tree. After extraction/gating the same test passes in 0.63s. New local plugin crate uses the existing owner-selected engine versions and shared Channel in plugin-api; core packages default remote off, shipping CLI explicitly forwards remote. No registry dependency/version was added. Enabled/disabled compilation and full gate pending. Evidence: tests/remote_plugin_contract.rs; scratch ra4-{red,green}-direct.log.

RA4 red: cherry-picked 347ce302 as 158a12d2. The unchanged std-only regression compiled with rustc --test failed in 0.52s: both infraternal-agent and infraternal-server retain quinn in offline locked normal graphs with defaults disabled. Stopped my redundant package-specific native build; the test needs only std and cargo tree. After extraction/gating the same test passes in 0.63s. New local plugin crate uses the existing owner-selected engine versions and shared Channel in plugin-api; core packages default remote off, shipping CLI explicitly forwards remote. No registry dependency/version was added. Enabled/disabled compilation and full gate pending. Evidence: tests/remote_plugin_contract.rs; scratch ra4-{red,green}-direct.log.

kayg referenced this issue

2026-10-09 17:53:36 +00:00

Mesh API for the Mesh view: hosts, tags and grants (D163-D167, D180, D187) #108

kayg commented

2026-10-09 18:06:09 +00:00

Author

Owner

RA4 completed: b76c05ec7a. Stripped sizes x86 18256656 (+21312), ARM 16275584 (+22160) bytes versus RA2; no PT_INTERP. x86 change: .text +18496, unwind sections +3596, alignment/headers -780 bytes. ARM: .text +17920, unwind +4312, .data.rel.ro +16, alignment/headers -88. Both normal core graphs and the disabled CLI exclude Quinn/Rustls/plugin; all-target disabled Clippy passes; real disabled CLI PTY test 1 pass/0 fail, 24 abrupt restarts/39.23s. Shipping normal cargo tree -d (excluding proc macros) has no duplicate TLS/QUIC engines. Workspace tree -d additionally separates the same Either 1.18.0 build/macro and normal contexts; not a second shipping library/version. No registry versions added. ARM old budget is exceeded by 79208 bytes (D205); other Rust rows and supplemental TS pass. Verbatim fast summary:

Supplemental TS, verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.13s]

RA4 completed: b76c05ec7a5ee4a4027c7a789a14bfe30134da32. Stripped sizes x86 18256656 (+21312), ARM 16275584 (+22160) bytes versus RA2; no PT_INTERP. x86 change: .text +18496, unwind sections +3596, alignment/headers -780 bytes. ARM: .text +17920, unwind +4312, .data.rel.ro +16, alignment/headers -88. Both normal core graphs and the disabled CLI exclude Quinn/Rustls/plugin; all-target disabled Clippy passes; real disabled CLI PTY test 1 pass/0 fail, 24 abrupt restarts/39.23s. Shipping normal cargo tree -d (excluding proc macros) has no duplicate TLS/QUIC engines. Workspace tree -d additionally separates the same Either 1.18.0 build/macro and normal contexts; not a second shipping library/version. No registry versions added. ARM old budget is exceeded by 79208 bytes (D205); other Rust rows and supplemental TS pass. Verbatim fast summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Supplemental TS, verbatim: 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.13s]

kayg commented

2026-10-09 18:16:55 +00:00

Author

Owner

RA3 red: cherry-picked a3a7c231 as b5402ef0; all three shipping Clap cases reject --json (0 pass/1 fail, 0.00s). Added actual command refusal tests fail 0/2 before the fix. The pre-fix stripped release executable also fails all three output assertions, including organized human/NO_COLOR output (0/3, 0.01s). Fixed global JSON result records, static refusals, human sections/next steps and server log presentation. Remote CLI descriptions/ordered help and enabled action IDs use plugin-api action metadata; Clap owned-string support adds no package/version. New real-command suite now passes 3/3 enabled and 3/3 disabled; all-target Clippy passes both configurations. No invocation-specific identity/path/proof is reflected. Full gate and release verification pending. Evidence: remote_server_tests.rs, tests/remote_output.rs, output.rs; scratch ra3-{red,output-red,shipping-before,output-green,disabled-output}.log.

RA3 red: cherry-picked a3a7c231 as b5402ef0; all three shipping Clap cases reject --json (0 pass/1 fail, 0.00s). Added actual command refusal tests fail 0/2 before the fix. The pre-fix stripped release executable also fails all three output assertions, including organized human/NO_COLOR output (0/3, 0.01s). Fixed global JSON result records, static refusals, human sections/next steps and server log presentation. Remote CLI descriptions/ordered help and enabled action IDs use plugin-api action metadata; Clap owned-string support adds no package/version. New real-command suite now passes 3/3 enabled and 3/3 disabled; all-target Clippy passes both configurations. No invocation-specific identity/path/proof is reflected. Full gate and release verification pending. Evidence: remote_server_tests.rs, tests/remote_output.rs, output.rs; scratch ra3-{red,output-red,shipping-before,output-green,disabled-output}.log.

kayg commented

2026-10-09 18:32:01 +00:00

Author

Owner

RA3 completed: 3c29f8c3d1. Real stripped release output suite: 3/3 pass. Configured release CA test: 1/1 pass, 1.77s; rootless cold refusal, real registered passkey unlock of encrypted copy, enrollment and cold restart lock, no fixture signer injected. CLI startup/refusal benchmark: 1000 paired stripped processes, before median 1981779 ns/p99 6259302 ns, after median 2122798 ns/p99 6261441 ns. +141019 ns/process (+141.019 ms at 1000); load 5.19/8.41/9.52 to 5.02/8.32/9.49 on infraternal-dev. D202 presentation/help cost; inherited-fd/shim fast path bypasses it. Sizes x86 18354736 (+98080), ARM 16347440 (+71856) bytes versus RA4; stripped/static, no PT_INTERP. ARM old budget exceeded by 151064 bytes, reported per D205. No new registry versions. Verbatim fast summary:

Supplemental TS, verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.21s]

RA3 completed: 3c29f8c3d1ccad600fd5d5fd8cb3f8da5b3e124b. Real stripped release output suite: 3/3 pass. Configured release CA test: 1/1 pass, 1.77s; rootless cold refusal, real registered passkey unlock of encrypted copy, enrollment and cold restart lock, no fixture signer injected. CLI startup/refusal benchmark: 1000 paired stripped processes, before median 1981779 ns/p99 6259302 ns, after median 2122798 ns/p99 6261441 ns. +141019 ns/process (+141.019 ms at 1000); load 5.19/8.41/9.52 to 5.02/8.32/9.49 on infraternal-dev. D202 presentation/help cost; inherited-fd/shim fast path bypasses it. Sizes x86 18354736 (+98080), ARM 16347440 (+71856) bytes versus RA4; stripped/static, no PT_INTERP. ARM old budget exceeded by 151064 bytes, reported per D205. No new registry versions. Verbatim fast summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Supplemental TS, verbatim: 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.21s]

kayg commented

2026-10-09 18:44:48 +00:00

Author

Owner

Repair complete on remote-agents: head b701a6ea7d. Merged dev first; cherry-picked and reproduced all four review regressions; fixed each separately and activated the saved R3 CA runtime wiring. Record: docs/verification/remote-agents-repair-round.md (regressions, reviewer check, reproduced commands, limits, section-by-section sizes and scale numbers). Issue remains open; no push/deploy.

Final shipping stripped/static sizes: x86 18354736 bytes (+249632 versus merged dev), ARM 16347440 (+206336); no PT_INTERP. ARM is 151064 bytes over the old size budget, accepted feature growth per D205, not a claimed green size gate. Core-only x86 15113744 bytes, saves 3240992; no Quinn/Rustls/plugin in normal disabled graphs and no duplicate shipping transport engines. Existing unrelated version duplicates remain.

Final restored stripped configured CLI proof: 1/1 pass in 2.90s (rootless cold refusal, real registered passkey unlock of encrypted copy, no fixture signer injected, enrollment unlock, cold restart locked). Output assertions pass 3/3 active and removed release builds; removed CLI preserves all bytes through 24 abrupt PTY-owner restarts. Bare CLI smoke checks 2/2 pass. CA admission 1000-request median cost +2.11 us/request, bounded bodies 256 KiB total; 1000-pair CLI startup cost +0.141 ms/process outside inherited-fd/shim fast path. No qualifying load-sensitive failure required a dev baseline run.

Final scripts/verify fast output, verbatim:

Fast exits 1 solely for the ARM size row; every other row passes. The script stops before TypeScript on that row, so unchanged ts_verify_fast was run separately; compiler/production bundle/transfer budget and protocol checks pass. Final supplemental protocol output, verbatim:

7 pass
0 fail
34390 expect() calls
Ran 7 tests across 2 files. [2.13s]

First-copy/browser provisioning, role rewrap, notifications, update IPC and #10 generated adapter registry remain outside this repair, as already recorded on this issue. Private build targets are being removed; inherited worktree scratch/evidence is retained.

Repair complete on remote-agents: head b701a6ea7d4d9f43949b1883485ef686c88e68b4. Merged dev first; cherry-picked and reproduced all four review regressions; fixed each separately and activated the saved R3 CA runtime wiring. Record: docs/verification/remote-agents-repair-round.md (regressions, reviewer check, reproduced commands, limits, section-by-section sizes and scale numbers). Issue remains open; no push/deploy. Final shipping stripped/static sizes: x86 18354736 bytes (+249632 versus merged dev), ARM 16347440 (+206336); no PT_INTERP. ARM is 151064 bytes over the old size budget, accepted feature growth per D205, not a claimed green size gate. Core-only x86 15113744 bytes, saves 3240992; no Quinn/Rustls/plugin in normal disabled graphs and no duplicate shipping transport engines. Existing unrelated version duplicates remain. Final restored stripped configured CLI proof: 1/1 pass in 2.90s (rootless cold refusal, real registered passkey unlock of encrypted copy, no fixture signer injected, enrollment unlock, cold restart locked). Output assertions pass 3/3 active and removed release builds; removed CLI preserves all bytes through 24 abrupt PTY-owner restarts. Bare CLI smoke checks 2/2 pass. CA admission 1000-request median cost +2.11 us/request, bounded bodies 256 KiB total; 1000-pair CLI startup cost +0.141 ms/process outside inherited-fd/shim fast path. No qualifying load-sensitive failure required a dev baseline run. Final scripts/verify fast output, verbatim: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Fast exits 1 solely for the ARM size row; every other row passes. The script stops before TypeScript on that row, so unchanged ts_verify_fast was run separately; compiler/production bundle/transfer budget and protocol checks pass. Final supplemental protocol output, verbatim: 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.13s] First-copy/browser provisioning, role rewrap, notifications, update IPC and #10 generated adapter registry remain outside this repair, as already recorded on this issue. Private build targets are being removed; inherited worktree scratch/evidence is retained.

kayg commented

2026-10-09 18:47:13 +00:00

Author

Owner

Cleanup complete at b701a6ea7d: private build target and saved benchmark executables removed; worktree target symlink removed. Only inherited untracked .scratch/, evidence/ and remote_lease.rs remain. Tracked worktree is clean. Small gate/finding logs remain in the job cache; durable evidence is docs/verification/remote-agents-repair-round.md.

Cleanup complete at b701a6ea7d4d9f43949b1883485ef686c88e68b4: private build target and saved benchmark executables removed; worktree target symlink removed. Only inherited untracked .scratch/, evidence/ and remote_lease.rs remain. Tracked worktree is clean. Small gate/finding logs remain in the job cache; durable evidence is docs/verification/remote-agents-repair-round.md.

kayg referenced this issue

2026-10-09 19:17:59 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 19:27:43 +00:00

Author

Owner

Independent review at b701a6ea: HOLD on P1 — anonymous stalled /remote/join bodies share the 8-slot admission with owner revocation and can block it indefinitely. P2: 64 idle anonymous sockets starve all host handshakes; enrolment cannot work in production because nothing creates the first CA key or administrators' wrapped copies (D168); verify-fast test fixture throttles under parallel tests. P3: no QUIC liveness; remote schema present in feature-off builds. Audited sound: CA key handling, issuance, renewal, revocation, expiry, mutual authentication, D198 removal. Round 11 started: CA bootstrap + the fixes.

Independent review at b701a6ea: HOLD on P1 — anonymous stalled /remote/join bodies share the 8-slot admission with owner revocation and can block it indefinitely. P2: 64 idle anonymous sockets starve all host handshakes; enrolment cannot work in production because nothing creates the first CA key or administrators' wrapped copies (D168); verify-fast test fixture throttles under parallel tests. P3: no QUIC liveness; remote schema present in feature-off builds. Audited sound: CA key handling, issuance, renewal, revocation, expiry, mutual authentication, D198 removal. Round 11 started: CA bootstrap + the fixes.

kayg commented

2026-10-09 19:28:52 +00:00

Author

Owner

Round 11 started on remote-agents at base b701a6ea7d, sole writer. Preserving inherited untracked .scratch/, evidence/, remote_lease.rs. Read contract/architecture/process, current main owner D151/D168/D198/D201/D205 and latest review/history. Scope: production CA provisioning via fresh passkey, isolated owner admission, bounded per-source handshakes, test-only Argon fixture waiting, QUIC liveness, local bootstrap/join/renew/revoke proof. No push/deploy or external hosts. Existing ARM size overage remains explicitly reported per D205.

Round 11 started on remote-agents at base b701a6ea7d4d9f43949b1883485ef686c88e68b4, sole writer. Preserving inherited untracked .scratch/, evidence/, remote_lease.rs. Read contract/architecture/process, current main owner D151/D168/D198/D201/D205 and latest review/history. Scope: production CA provisioning via fresh passkey, isolated owner admission, bounded per-source handshakes, test-only Argon fixture waiting, QUIC liveness, local bootstrap/join/renew/revoke proof. No push/deploy or external hosts. Existing ARM size overage remains explicitly reported per D205.

kayg commented

2026-10-09 19:30:54 +00:00

Author

Owner

Additive contract before code (D151/D168): remote.ca.bootstrap start/finish is purpose-bound to one live administrator session, role generation and fresh registered-passkey proof. Start returns a random public wrapping salt and member/generation; finish receives only the domain-separated scoped wrapping key. Generate Ed25519 issuer only after proof; publish issuer, server-only remote TLS identity and administrator copies as one fsynced private directory rename under SQLite writer serialization. Existing/malformed retained state is never replaced. Current administrators without an available wrapping key remain explicit pending grants, per D151; no shared DEK or PRF output reaches server. Role grants/revocations use generation-bound copy publication/removal under writer lock. Separate pinned HTTPS trust from the internal issuer with an additive optional https_der invitation field; legacy invitations unchanged. Deferred remote transport starts only after provisioning. New bootstrap never creates a server (D201).
Admission contract correction: owner invitations/revocations and administrator CA routes use independent authenticated capacity; validate Origin and live session before reserving. Anonymous joins bounded per source. Handshakes: per-source budgets, two-second first-byte deadline, separate authenticated-source reserve. QUIC keepalive15s/idle60s: healthy ACKs preserve connections; lost paths trigger reconnect, no periodic SQLite traffic.

Additive contract before code (D151/D168): remote.ca.bootstrap start/finish is purpose-bound to one live administrator session, role generation and fresh registered-passkey proof. Start returns a random public wrapping salt and member/generation; finish receives only the domain-separated scoped wrapping key. Generate Ed25519 issuer only after proof; publish issuer, server-only remote TLS identity and administrator copies as one fsynced private directory rename under SQLite writer serialization. Existing/malformed retained state is never replaced. Current administrators without an available wrapping key remain explicit pending grants, per D151; no shared DEK or PRF output reaches server. Role grants/revocations use generation-bound copy publication/removal under writer lock. Separate pinned HTTPS trust from the internal issuer with an additive optional https_der invitation field; legacy invitations unchanged. Deferred remote transport starts only after provisioning. New bootstrap never creates a server (D201). Admission contract correction: owner invitations/revocations and administrator CA routes use independent authenticated capacity; validate Origin and live session before reserving. Anonymous joins bounded per source. Handshakes: per-source budgets, two-second first-byte deadline, separate authenticated-source reserve. QUIC keepalive15s/idle60s: healthy ACKs preserve connections; lost paths trigger reconnect, no periodic SQLite traffic.

kayg commented

2026-10-09 19:41:32 +00:00

Author

Owner

Baseline b701a6ea + unchanged independent review patch: 0/2 pass in 0.39s. Owner revocation returned429 instead of204 with eight anonymous stalled joins; 64 idle sockets refused a real TLS host handshake. Logs r11-review-red-baseline.log. Working fixes: same real tests2/2 pass0.27s. Per-source anonymous joins2; owner admission8 after Origin/live-owner session checks. Idle first-byte capacity48 +16 short probes, separate48 TLS slots +16 known-source reserve, per-source4, first-byte deadline2s (overflow probe100ms). No daemon/background source cleanup worker.
CA bootstrap tests3/3 pass1.17s: fresh UV proof required before private state, one durable issuer across concurrent ceremonies, replay refused, only issuer/remote-leaf/private remote-leaf key and wrapped administrator copies published, cold source locked then copy unlock succeeds. Existing unlock controls retained. Full gate/atomic commits/release end-to-end still pending; no completion claim.

Baseline b701a6ea + unchanged independent review patch: 0/2 pass in 0.39s. Owner revocation returned429 instead of204 with eight anonymous stalled joins; 64 idle sockets refused a real TLS host handshake. Logs r11-review-red-baseline.log. Working fixes: same real tests2/2 pass0.27s. Per-source anonymous joins2; owner admission8 after Origin/live-owner session checks. Idle first-byte capacity48 +16 short probes, separate48 TLS slots +16 known-source reserve, per-source4, first-byte deadline2s (overflow probe100ms). No daemon/background source cleanup worker. CA bootstrap tests3/3 pass1.17s: fresh UV proof required before private state, one durable issuer across concurrent ceremonies, replay refused, only issuer/remote-leaf/private remote-leaf key and wrapped administrator copies published, cold source locked then copy unlock succeeds. Existing unlock controls retained. Full gate/atomic commits/release end-to-end still pending; no completion claim.

kayg commented

2026-10-09 20:11:40 +00:00

Author

Owner

R11 implementation contract for ssh-bootstrap add-host flow: POST /remote/ca/bootstrap/start with {} using the existing session cookie and exact HTTPS Origin. Response includes WebAuthn ceremony/options and ca.member/generation/salt/operation. Perform fresh passkey user verification; derive HKDF-SHA256(account DEK, base64url ca.salt, info "infraternal/ca-wrap/v1||", 32 bytes) locally. POST /remote/ca/bootstrap/finish with {ceremony,proof,scoped_key:[32 bytes]}. Success {locked:false}; then POST /remote/invitations. Cold retained CA is handled by the same calls (operation=unlock). Never send the DEK/PRF output. New declared action remote.ca.bootstrap; contract in contracts/remote.md. Offline administrator copies are pending until their device runs this action while unlocked, per D151. No UI unlock hook exists in this branch.

R11 implementation contract for ssh-bootstrap add-host flow: POST /remote/ca/bootstrap/start with {} using the existing session cookie and exact HTTPS Origin. Response includes WebAuthn ceremony/options and ca.member/generation/salt/operation. Perform fresh passkey user verification; derive HKDF-SHA256(account DEK, base64url ca.salt, info "infraternal/ca-wrap/v1|<member>|<generation>", 32 bytes) locally. POST /remote/ca/bootstrap/finish with {ceremony,proof,scoped_key:[32 bytes]}. Success {locked:false}; then POST /remote/invitations. Cold retained CA is handled by the same calls (operation=unlock). Never send the DEK/PRF output. New declared action remote.ca.bootstrap; contract in contracts/remote.md. Offline administrator copies are pending until their device runs this action while unlocked, per D151. No UI unlock hook exists in this branch.

kayg commented

2026-10-09 20:22:31 +00:00

Author

Owner

R11 findings: parallel fast exposed fixture hashing occupying both ARGON_SLOTS, so audit_recovery_session_expiring_during_verification_keeps_delay could receive 429 before its pause hook and stall the SERIAL tests (r11-fast3.log). Test-only recovery_hash_fixture now serializes fixture generation and waits for ARGON_SLOTS, leaving one production verification slot free; recovery checks passed in r11-fast4.log. Production try_acquire unchanged. That run completed server tests: 187 passed, 2 failed, 27 ignored in108.08s; failures were 401 vs403 in revocation authorization tests after the added owner precheck, corrected to preserve403. Full release-process E2E currently fails before server readiness; isolating startup/cold-retained trust before committing. No pushed/deployed changes.

kayg commented

2026-10-09 20:23:50 +00:00

Author

Owner

R11 release lifecycle found the generated remote TLS leaf used the issuer's exact subject name. OpenSSL rejected cold-start path building. Regression ca_bootstrap::tests::generated_remote_leaf_is_verifiable_after_cold_restart: red0/1 in0.00s (r11-leaf-red.log), green1/1 in0.00s (r11-leaf-green.log). The leaf now uses its configured server name as subject and the CA subject only as issuer. Rebuilding and repeating the real CLI lifecycle, including cold lock and retained-copy unlock. Generated CA signing material is still published only as wrapped administrator copies.

kayg commented

2026-10-09 20:32:10 +00:00

Author

Owner

R11 real stripped release process proof passed1/1 in5.35s (r11-e2e3.log). Server starts with fresh CA directory; actual registered passkey bootstrap generates all CA state (no injected fixture signer), cold restart locked, retained-copy fresh-passkey unlock succeeds. Local rootless infraternal agent joins using invitation on private stdin, renews through its live control stream with the same key, then owner revocation cuts a live QUIC connection using its actual renewed identity. Measured bootstrap99871us; join CLI→durable identity46545us; reconnect→durable renewal731182us; revoke→live QUIC close21390us. Machine infraternal-dev,8cores, load8.46/7.59/8.58. Only public ledger half-life metadata was aged302400s to trigger the normal scheduler without waiting84h. Pending work: independently gated atomic commits, fuzz/scale evidence and final gate/size accounting.

kayg commented

2026-10-09 21:00:35 +00:00

Author

Owner

R11 self-review finding: revoking the only administrator with a retained wrapped copy was allowed when another active administrator's grant was still pending. A cold start would lose every usable unlock path. Regression pending_administrator_cannot_replace_the_last_retained_wrapped_copy failed0/1 in0.76s (r11-last-copy-red2.log). Additive role refusal: when an issuer exists, preserve at least one current generation-bound, issuer-matching retained copy under the same writer lock before role revocation. Pending grants remain permitted per D151; they cannot substitute for cold-start unlock custody under D168. No CA rotation, DEK transport or new dependency. Implementing and gating this in the separate administrator role module.

kayg commented

2026-10-09 21:03:51 +00:00

Author

Owner

R11 step1/10 completed on remote-agents: c8cfe6e196. Parallel enrollment fixtures occupied both Argon slots or threw Throttled, including before recovery pause hooks. Serialize test-only fixture hashing and await a bounded slot, leaving production verification capacity available.
Stripped/static sizes x86 18359248 (+4512 vs prior), ARM 16347456 (+16); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 811.12s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-01-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step1/10 completed on remote-agents: c8cfe6e1961b0e6f5173b7d8bd4272ab7a1da58c. Parallel enrollment fixtures occupied both Argon slots or threw Throttled, including before recovery pause hooks. Serialize test-only fixture hashing and await a bounded slot, leaving production verification capacity available. Stripped/static sizes x86 18359248 (+4512 vs prior), ARM 16347456 (+16); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 811.12s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-01-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 21:14:59 +00:00

Author

Owner

R11 idempotency self-review: durable active/ publication can outlive failed in-memory installation (authority expiry or filesystem finalization failure). A retry must load that public issuer as locked trust rather than attempt another setup. Regression published_issuer_without_memory_projection_is_recovered_as_locked_trust failed0/1 in0.83s (r11-projection-red.log). Add recovery of public issuer only, with bounded private-file validation and self-signature/type checks; keep signing locked until the existing wrapped copy passes fresh passkey unlock. Role custody checks also recover published public trust before judging pending grants. Distinguish unprovisioned state from a poisoned lock; never regenerate retained trust. Parser fuzz passed2339788 executions in61s with ASAN; ThinLTO coverage linking failed, so only the fuzz build used LTO=false. Shipping profile unchanged.

kayg commented

2026-10-09 21:23:05 +00:00

Author

Owner

R11 late safeguards passed in the complete saved source:22 CA-administration tests passed,4 ignored,22.21s; clippy server/all-targets PASS (r11-late-green.log,r11-late-clippy.log). Pending grants cannot replace the last retained current issuer/generation-matching copy. Public issuer recovery never unlocks signing or creates another issuer. Three alternating optimized malformed CA-body runs at1000 requests: before p50 ns2940/5228/2952, p99 ns32863/50633/25664; after p50 ns65247/63739/64850, p99 ns3110239/130956/338141. Median p50 added61898ns/request (+61.898ms at1000); justified by live administrator authorization before reserved capacity. Both binaries are release/musl; baseline diagnostic's hardcoded profile=debug label is inherited (build proof r11-baseline-release-build.log). Shared host load37.77/32.62/24.54; no own build active. Atomic replay started; c8cfe6e1 fixture fix completed, separate liveness slice gating.

R11 late safeguards passed in the complete saved source:22 CA-administration tests passed,4 ignored,22.21s; clippy server/all-targets PASS (r11-late-green.log,r11-late-clippy.log). Pending grants cannot replace the last retained current issuer/generation-matching copy. Public issuer recovery never unlocks signing or creates another issuer. Three alternating optimized malformed CA-body runs at1000 requests: before p50 ns2940/5228/2952, p99 ns32863/50633/25664; after p50 ns65247/63739/64850, p99 ns3110239/130956/338141. Median p50 added61898ns/request (+61.898ms at1000); justified by live administrator authorization before reserved capacity. Both binaries are release/musl; baseline diagnostic's hardcoded profile=debug label is inherited (build proof r11-baseline-release-build.log). Shared host load37.77/32.62/24.54; no own build active. Atomic replay started; c8cfe6e1 fixture fix completed, separate liveness slice gating.

kayg commented

2026-10-09 21:43:25 +00:00

Author

Owner

R11 step2/10 completed on remote-agents: e730b602ec. Acknowledged 15-second probes preserve healthy mobile/NAT connections. A60-second idle timeout allows four intervals of transient loss and bounds recovery from expired mappings; a real UDP relay regression exercises both states.
Stripped/static sizes x86 18359248 (+0 vs prior), ARM 16347456 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 1312.86s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-02-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step2/10 completed on remote-agents: e730b602ec6a7205908ba37141d54ca88ee99304. Acknowledged 15-second probes preserve healthy mobile/NAT connections. A60-second idle timeout allows four intervals of transient loss and bounds recovery from expired mappings; a real UDP relay regression exercises both states. Stripped/static sizes x86 18359248 (+0 vs prior), ARM 16347456 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 1312.86s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-02-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:06:32 +00:00

Author

Owner

R11 step3/10 completed on remote-agents: f106c1d91c. Stalled anonymous join bodies shared all eight owner revocation slots. Check exact origin and live owner authority before a separate owner pool; bound anonymous bodies per canonical trusted source and enforce a total request deadline.
Stripped/static sizes x86 18374736 (+15488 vs prior), ARM 16361200 (+13744); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 1378.68s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-03-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step3/10 completed on remote-agents: f106c1d91c8f696a75572de19558423b4922a610. Stalled anonymous join bodies shared all eight owner revocation slots. Check exact origin and live owner authority before a separate owner pool; bound anonymous bodies per canonical trusted source and enforce a total request deadline. Stripped/static sizes x86 18374736 (+15488 vs prior), ARM 16361200 (+13744); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 1378.68s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-03-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:17:36 +00:00

Author

Owner

R11 step4/10 completed on remote-agents: 98816f8ca9. Idle sockets exhausted64 TLS handshake slots. Separate bounded two-second first-byte checks and short NAT probes from TLS, limit each source, and reserve16 slots for addresses previously admitted through durable certificate authority. Hints never bypass ledger checks.
Stripped/static sizes x86 18393072 (+18336 vs prior), ARM 16376864 (+15664); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 662.67s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-04-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step4/10 completed on remote-agents: 98816f8ca9bdaa1cb82f538d127a70960387802c. Idle sockets exhausted64 TLS handshake slots. Separate bounded two-second first-byte checks and short NAT probes from TLS, limit each source, and reserve16 slots for addresses previously admitted through durable certificate authority. Hints never bypass ledger checks. Stripped/static sizes x86 18393072 (+18336 vs prior), ARM 16376864 (+15664); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 662.67s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-04-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:21:44 +00:00

Author

Owner

R11 self-review finding: remote_revocation_http_tests.rs:308 sends all eight pending bodies without ClientAddress, so the new per-source limit admits only two. That can mask a future owner/anonymous pool-sharing regression. Strengthen this test with eight distinct canonical sources and an explicit notification that every body has entered the anonymous pool. This is a separate test-only step after the ten existing source/contract commits; production admission code stays unchanged.

kayg commented

2026-10-09 22:28:45 +00:00

Author

Owner

R11 step5/10 completed on remote-agents: 7142a63ec9. Add the CA publication module and memory source contract with Ed25519 issuance and atomic private-directory publication. Only wrapped CA signing copies reach disk. Distinct TLS leaf subjects pass cold-start verification; process-memory handoff preserves public enrollment trust.
Stripped/static sizes x86 18394064 (+992 vs prior), ARM 16378048 (+1184); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 667.64s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-05-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step5/10 completed on remote-agents: 7142a63ec9cf813a5fb49c1eaa2c6481535485f7. Add the CA publication module and memory source contract with Ed25519 issuance and atomic private-directory publication. Only wrapped CA signing copies reach disk. Distinct TLS leaf subjects pass cold-start verification; process-memory handoff preserves public enrollment trust. Stripped/static sizes x86 18394064 (+992 vs prior), ARM 16378048 (+1184); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 667.64s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-05-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:38:24 +00:00

Author

Owner

R11 step6/10 completed on remote-agents: 677a2ed805. A freshly generated machine issuer cannot verify the pre-existing HTTPS listener. Invitations carry the configured HTTPS leaf pin or system-root policy while issued host certificates remain verified against the internal CA. Legacy invitation behavior stays compatible.
Stripped/static sizes x86 18403344 (+9280 vs prior), ARM 16386864 (+8816); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 577.55s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-06-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step6/10 completed on remote-agents: 677a2ed8050038164ac3c03de3a323e69c6ffd81. A freshly generated machine issuer cannot verify the pre-existing HTTPS listener. Invitations carry the configured HTTPS leaf pin or system-root policy while issued host certificates remain verified against the internal CA. Legacy invitation behavior stays compatible. Stripped/static sizes x86 18403344 (+9280 vs prior), ARM 16386864 (+8816); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 577.55s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-06-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:48:17 +00:00

Author

Owner

R11 step7/10 completed on remote-agents: 20ff2672f0. Production never created the first issuer or wrapped copy. Bind setup to a fresh real passkey and original live administrator generation, serialize durable publication under the writer lock, retain unlocked signing in memory, and activate configured listeners only after setup. Retries retain one issuer; cold restart remains locked.
Stripped/static sizes x86 18604752 (+201408 vs prior), ARM 16570776 (+183912); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 591.32s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-07-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step7/10 completed on remote-agents: 20ff2672f054a8edd91d9e95db08ebae63c814e2. Production never created the first issuer or wrapped copy. Bind setup to a fresh real passkey and original live administrator generation, serialize durable publication under the writer lock, retain unlocked signing in memory, and activate configured listeners only after setup. Retries retain one issuer; cold restart remains locked. Stripped/static sizes x86 18604752 (+201408 vs prior), ARM 16570776 (+183912); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 591.32s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-07-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 22:57:57 +00:00

Author

Owner

R11 step8/10 completed on remote-agents: b70464bba6. Add the separate role module and declared role action. Fresh owner proof binds the exact transition; recheck current role/session/credential under the writer lock, remove old copies and advance generation. Offline grants remain pending until their own passkey device wraps the unlocked issuer; old ceremonies cannot resurrect revoked copies.
Stripped/static sizes x86 18687856 (+83104 vs prior), ARM 16646856 (+76080); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 578.14s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-08-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step8/10 completed on remote-agents: b70464bba6eabd29f71d0a33d2748b7429440321. Add the separate role module and declared role action. Fresh owner proof binds the exact transition; recheck current role/session/credential under the writer lock, remove old copies and advance generation. Offline grants remain pending until their own passkey device wraps the unlocked issuer; old ceremonies cannot resurrect revoked copies. Stripped/static sizes x86 18687856 (+83104 vs prior), ARM 16646856 (+76080); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 578.14s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-08-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 23:04:14 +00:00

Author

Owner

R11 step9 gate stopped before commit: clippy reports fresh_release_bootstrap_join_renew_revoke_cuts_a_live_connection at auth/ca_bootstrap_cli_tests.rs:128 has107/100 lines after the live-before-revoke assertions. All376 tests passed; other rows passed except the reported ARM size limit. Extract a focused QUIC observer helper that returns and retains both control-stream handles so this refactor cannot prematurely close the observed connection. Then rerun the complete step gate. Evidence: r11-step-09-fast.log.

kayg commented

2026-10-09 23:09:40 +00:00

Author

Owner

R11 step9/10 completed on remote-agents: d319b7ae6e. The shipping process must bootstrap without a fixture signer, cold-lock/reunlock, issue a real invitation and enroll a local rootless infraternal agent. Exercise live half-life renewal with retained key, then owner revocation cutting an authenticated QUIC connection from the renewed identity.
Stripped/static sizes x86 18687856 (+0 vs prior), ARM 16646856 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 294.22s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-09-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step9/10 completed on remote-agents: d319b7ae6e480f6ecdeff111b02506841bf5fc70. The shipping process must bootstrap without a fixture signer, cold-lock/reunlock, issue a real invitation and enroll a local rootless infraternal agent. Exercise live half-life renewal with retained key, then owner revocation cutting an authenticated QUIC connection from the renewed identity. Stripped/static sizes x86 18687856 (+0 vs prior), ARM 16646856 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 294.22s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-09-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 23:15:32 +00:00

Author

Owner

R11 step10/10 completed on remote-agents: 85af7b8119. Document the exact add-host calls and local HKDF derivation, pending-copy grants, cold-lock semantics and bounded admission/liveness policy so ssh-bootstrap can integrate without this chat.
Stripped/static sizes x86 18687856 (+0 vs prior), ARM 16646856 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 350.58s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-10-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 step10/10 completed on remote-agents: 85af7b8119d92cbcbad124d334efd675b698d9db. Document the exact add-host calls and local HKDF derivation, pending-copy grants, cold-lock semantics and bounded admission/liveness policy so ssh-bootstrap can integrate without this chat. Stripped/static sizes x86 18687856 (+0 vs prior), ARM 16646856 (+0); no PT_INTERP. ARM size-only excess reported per D205; budgets/profile unchanged. No dependency additions. Gate 350.58s; full log /home/kayg/.cache/codex-scratch/remote-agents/r11-step-10-fast.log. Unchanged TS stage independently passed r11-ts.log and will be repeated after the final tree. Verbatim fast summary: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 23:21:56 +00:00

Author

Owner

R11 test-only step completed: 5ae8ff9192. Eight distinct sources explicitly reached stalled body reads before owner revocation; the strengthened review test and every other test passed. Production code/dependencies unchanged. CLI stub checks separately passed (r11-final-cli-stubs.log), since the ARM size row prevents them in fast. Stripped sizes {'x86': 18687856, 'arm': 16646856}; delta {'x86': 0, 'arm': 0}; ARM old-limit failure reported per D205. Verbatim fast summary (/home/kayg/.cache/codex-scratch/remote-agents/r11-distributed-fast.log):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

R11 test-only step completed: 5ae8ff91928ded8cf3ad5c516bf15371833449fc. Eight distinct sources explicitly reached stalled body reads before owner revocation; the strengthened review test and every other test passed. Production code/dependencies unchanged. CLI stub checks separately passed (r11-final-cli-stubs.log), since the ARM size row prevents them in fast. Stripped sizes {'x86': 18687856, 'arm': 16646856}; delta {'x86': 0, 'arm': 0}; ARM old-limit failure reported per D205. Verbatim fast summary (/home/kayg/.cache/codex-scratch/remote-agents/r11-distributed-fast.log): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-09 23:29:22 +00:00

Author

Owner

R11 final evidence gate stopped before the evidence commit: real_binary_preserves_input_and_output_across_24_abrupt_stops refused its first terminal (verify-agent.py:41 / agent_fixture.py:188). The host PTY counter immediately afterward was4089/4096; later4048/4096. This is not a #118 allowed exemption, so no baseline waiver is applied and no host limit or other job is changed. A focused real-daemon retry is running; the full final gate must pass its test row before committing. All eleven existing commits and final bootstrap/join/renew/revoke + core-only clippy/TS checks remain recorded. Evidence: r11-final-fast.log, r11-final-daemon-retry.log.

kayg commented

2026-10-09 23:35:49 +00:00

Author

Owner

R11 finished on remote-agents: ca8a09d43d. Twelve atomic commits, each gated. Fresh first-use Ed25519 CA publication and retained-copy unlock, generation-bound role changes with final-copy protection, independent HTTPS trust, isolated owner/anonymous admission, bounded first-byte/source handshakes with known-source reserve, fixture hashing wait and QUIC 15s/60s liveness. No push/deploy/UI change or dependency addition.

Final release lifecycle PASS (live-before-revoke and application-close assertions included):
REMOTE_BOOTSTRAP_E2E cold_restart_locked=true retained_copy_unlock=true bootstrap_us=83204 join_cli_to_durable_identity_us=33560 renewal_reconnect_to_durable_identity_us=50611 revoke_to_live_quic_close_us=12300 rootless=true fixture_signer_injected=false aged_public_half_life_fixture=true host_key_retained=true machine=infraternal-dev cores=8 load=6.18 6.27 6.27 7/9427 1772339

Stripped/static sizes x86 18687856 (+333120 vs b701a6ea); ARM 16646856 (+299416). No PT_INTERP. Growth is from reachable CA generation/publication and fresh-proof/role actions, separate HTTPS trust and bounded transport/HTTP admission. Evidence-only commit has zero-byte delta. ARM exceeds the old 16196376 limit; reported under D205, budget/profile unchanged. All other fast rows PASS. Core-only clippy and separate TS production stage PASS. ASAN decoder fuzz 2339788 executions/61s without crash. Scale and paired-cost measurements, exact add-host API and auth self-review: docs/verification/remote-agents-bootstrap-round.md. Small full logs retained under $HOME/.cache/codex-scratch/remote-agents; own temporary targets/checkouts will be deleted before returning.

Final scripts/verify fast summary verbatim (303.95s; /home/kayg/.cache/codex-scratch/remote-agents/r11-final-fast.log):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

TypeScript complete output: /home/kayg/.cache/codex-scratch/remote-agents/r11-final-ts.log. Physical passkey/add-host UI end-to-end remains the owner's scheduled check; this run used actual signed registered software-passkey proofs and the stripped serving process. Issue remains open.

R11 finished on remote-agents: ca8a09d43d648e06853fc817b1ad6597c34e2372. Twelve atomic commits, each gated. Fresh first-use Ed25519 CA publication and retained-copy unlock, generation-bound role changes with final-copy protection, independent HTTPS trust, isolated owner/anonymous admission, bounded first-byte/source handshakes with known-source reserve, fixture hashing wait and QUIC 15s/60s liveness. No push/deploy/UI change or dependency addition. Final release lifecycle PASS (live-before-revoke and application-close assertions included): REMOTE_BOOTSTRAP_E2E cold_restart_locked=true retained_copy_unlock=true bootstrap_us=83204 join_cli_to_durable_identity_us=33560 renewal_reconnect_to_durable_identity_us=50611 revoke_to_live_quic_close_us=12300 rootless=true fixture_signer_injected=false aged_public_half_life_fixture=true host_key_retained=true machine=infraternal-dev cores=8 load=6.18 6.27 6.27 7/9427 1772339 Stripped/static sizes x86 18687856 (+333120 vs b701a6ea); ARM 16646856 (+299416). No PT_INTERP. Growth is from reachable CA generation/publication and fresh-proof/role actions, separate HTTPS trust and bounded transport/HTTP admission. Evidence-only commit has zero-byte delta. ARM exceeds the old 16196376 limit; reported under D205, budget/profile unchanged. All other fast rows PASS. Core-only clippy and separate TS production stage PASS. ASAN decoder fuzz 2339788 executions/61s without crash. Scale and paired-cost measurements, exact add-host API and auth self-review: docs/verification/remote-agents-bootstrap-round.md. Small full logs retained under $HOME/.cache/codex-scratch/remote-agents; own temporary targets/checkouts will be deleted before returning. Final scripts/verify fast summary verbatim (303.95s; /home/kayg/.cache/codex-scratch/remote-agents/r11-final-fast.log): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` TypeScript complete output: /home/kayg/.cache/codex-scratch/remote-agents/r11-final-ts.log. Physical passkey/add-host UI end-to-end remains the owner's scheduled check; this run used actual signed registered software-passkey proofs and the stripped serving process. Issue remains open.

kayg commented

2026-10-09 23:40:11 +00:00

Author

Owner

R11 final cleanup verified at ca8a09d43d: own build targets, temporary source checkouts, fuzz corpus/artifacts and benchmark executables deleted; small logs retained. Temporary worktree target link removed. Inherited .scratch/, evidence/ and remote_lease.rs remain untouched; tracked diff/check clean. Ports4701 and7443 have no remaining listener. CLI stub checks passed separately. Final TypeScript footer verbatim:


 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [2.24s]

The earlier PTY refusal is preserved in r11-final-fast-pty-failed.log; focused retry passed and the complete final rerun passed all376 tests without a baseline exemption. The final gate and size/timing record remain in the preceding finish comment and docs/verification/remote-agents-bootstrap-round.md. Nothing pushed or deployed; issue remains open.

R11 final cleanup verified at ca8a09d43d648e06853fc817b1ad6597c34e2372: own build targets, temporary source checkouts, fuzz corpus/artifacts and benchmark executables deleted; small logs retained. Temporary worktree target link removed. Inherited .scratch/, evidence/ and remote_lease.rs remain untouched; tracked diff/check clean. Ports4701 and7443 have no remaining listener. CLI stub checks passed separately. Final TypeScript footer verbatim: ```text 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [2.24s] ``` The earlier PTY refusal is preserved in r11-final-fast-pty-failed.log; focused retry passed and the complete final rerun passed all376 tests without a baseline exemption. The final gate and size/timing record remain in the preceding finish comment and docs/verification/remote-agents-bootstrap-round.md. Nothing pushed or deployed; issue remains open.

kayg commented

2026-10-09 23:43:21 +00:00

Author

Owner

Release integration started on release-addhost at production base db8c527042. Read source histories and issue/parent records; integrate remote ca8a09d4, SSH 06d063ac, then canvas-addhost 0bf00d07. Preserve deployed Mesh/host-facts and shipped migration checksums. Local container-only SSH proof, port 47591; no external VM contact, push or deployment. Gates, migration rehearsal, static artifacts and operator steps follow.

Release integration started on release-addhost at production base db8c5270429230365e6df34b664bdfed95f623be. Read source histories and issue/parent records; integrate remote ca8a09d4, SSH 06d063ac, then canvas-addhost 0bf00d07. Preserve deployed Mesh/host-facts and shipped migration checksums. Local container-only SSH proof, port 47591; no external VM contact, push or deployment. Gates, migration rehearsal, static artifacts and operator steps follow.

kayg referenced this issue

2026-10-09 23:48:23 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg commented

2026-10-09 23:48:25 +00:00

Author

Owner

Integration findings at production db8c5270: shipped migrations are 0001–0014 (0012_mesh_api, 0013_mesh_node_identity, 0014_plugin_settings). Remote source also declares 0012–0014; append its unchanged SQL as 0015_remote_identity, 0016_remote_sessions, 0017_ca_administrators. Shared plugin API reconciles Mesh socket/role metadata, host-facts node registry and remote channel constants using integrate-network reference declarations. Preserve one descriptor type, add node lifecycle/default/action fields rather than replacing production dispatch. UI source apps/tracer/src/add-host-prototype.ts still fetches /__mock/proto/addhost even when mounted in the product; production discovery/manual flow needs wiring. SSH bootstrap_runtime.rs default backend deliberately refuses invitations/readiness; local end-to-end requires live #78 adapters. Docker29.8.2 is accessible locally via sudo, no external hosts needed.

Integration findings at production db8c5270: shipped migrations are 0001–0014 (0012_mesh_api, 0013_mesh_node_identity, 0014_plugin_settings). Remote source also declares 0012–0014; append its unchanged SQL as 0015_remote_identity, 0016_remote_sessions, 0017_ca_administrators. Shared plugin API reconciles Mesh socket/role metadata, host-facts node registry and remote channel constants using integrate-network reference declarations. Preserve one descriptor type, add node lifecycle/default/action fields rather than replacing production dispatch. UI source apps/tracer/src/add-host-prototype.ts still fetches /__mock/proto/addhost even when mounted in the product; production discovery/manual flow needs wiring. SSH bootstrap_runtime.rs default backend deliberately refuses invitations/readiness; local end-to-end requires live #78 adapters. Docker29.8.2 is accessible locally via sudo, no external hosts needed.

kayg commented

2026-10-10 00:02:27 +00:00

Author

Owner

Remote merge resolution checks: cargo check --workspace --all-features completed successfully (7m25s, remote-check2.log); tracer bun run check and production build completed. All shipped SQL files 0001–0014 are byte-identical to db8c5270 (14/14); remote SQL is appended unchanged as 0015_remote_identity, 0016_remote_sessions, 0017_ca_administrators. Shared plugin API retains production AgentPlugin/PluginRegistry and integrates SchemaRef/action lifecycle declarations rather than replacing either API. fast/no-default checks are running; no merge commit yet. Correction to prior UI note: add-host-prototype is mock-only; shipping canvas/addhost/real.ts is the actual adapter. Its completion sink is empty and its proposed credential/host-key HTTP endpoints do not match the SSH branch websocket actions; these seams require integration tests and fixes.

Remote merge resolution checks: cargo check --workspace --all-features completed successfully (7m25s, remote-check2.log); tracer bun run check and production build completed. All shipped SQL files 0001–0014 are byte-identical to db8c5270 (14/14); remote SQL is appended unchanged as 0015_remote_identity, 0016_remote_sessions, 0017_ca_administrators. Shared plugin API retains production AgentPlugin/PluginRegistry and integrates SchemaRef/action lifecycle declarations rather than replacing either API. fast/no-default checks are running; no merge commit yet. Correction to prior UI note: add-host-prototype is mock-only; shipping canvas/addhost/real.ts is the actual adapter. Its completion sink is empty and its proposed credential/host-key HTTP endpoints do not match the SSH branch websocket actions; these seams require integration tests and fixes.

kayg commented

2026-10-10 00:04:24 +00:00

Author

Owner

Delta review of round 11 (b701a6ea..ca8a09d4), independent Claude Opus reviewer — verdict MERGE (no P0/P1).
25 targeted lib tests passed (ca_administration, remote_accept, remote_admission, ca_bootstrap). Claims 1, 2, 4, 5, 6 hold; claim 3 holds only partly.

Next-round fixes:

P2-a remote_accept.rs:72-75,135,169: a QUIC attempt is charged to known/per-source capacity before its source address is proven. Forged UDP sources can fill the reserved lane, and TCP shares those Limits. Fix: charge only when remote_address_validated(); send retry() to unvalidated sources only under pressure, so there is no extra round trip normally (India↔Germany path).
P2-b ca_http.rs:92-113, ca_membership.rs:58: unauthenticated /remote/ca/* takes the SQLite writer lock (the no-op UPDATE) before admission and can queue ahead of revocation. Fix: a read-only session lookup first; consider a pool connection reserved for revocation.
P2-c remote_admission.rs:22: IPv6 sources are counted per address. Bucket them by /64.

P3s:

Known hosts don't fall back to the anonymous pool.
known never forgets revoked IPs.
roles.rs:160 deletes a wrapped copy before commit.
!= hash comparisons at bootstrap.rs:76 and roles.rs:76 should use memcmp.
The owner can remove their own administrator role and lock role changes.
No TCP keepalive.
Old backups keep decrypting (document under D168).

**Delta review of round 11 (b701a6ea..ca8a09d4), independent Claude Opus reviewer — verdict MERGE (no P0/P1).** 25 targeted lib tests passed (ca_administration, remote_accept, remote_admission, ca_bootstrap). Claims 1, 2, 4, 5, 6 hold; claim 3 holds only partly. Next-round fixes: - **P2-a** `remote_accept.rs:72-75,135,169`: a QUIC attempt is charged to known/per-source capacity before its source address is proven. Forged UDP sources can fill the reserved lane, and TCP shares those Limits. Fix: charge only when `remote_address_validated()`; send `retry()` to unvalidated sources only under pressure, so there is no extra round trip normally (India↔Germany path). - **P2-b** `ca_http.rs:92-113`, `ca_membership.rs:58`: unauthenticated `/remote/ca/*` takes the SQLite writer lock (the no-op UPDATE) before admission and can queue ahead of revocation. Fix: a read-only session lookup first; consider a pool connection reserved for revocation. - **P2-c** `remote_admission.rs:22`: IPv6 sources are counted per address. Bucket them by /64. P3s: - Known hosts don't fall back to the anonymous pool. - `known` never forgets revoked IPs. - `roles.rs:160` deletes a wrapped copy before commit. - `!=` hash comparisons at `bootstrap.rs:76` and `roles.rs:76` should use memcmp. - The owner can remove their own administrator role and lock role changes. - No TCP keepalive. - Old backups keep decrypting (document under D168).

kayg commented

2026-10-10 00:20:47 +00:00

Author

Owner

Remote candidate validation (uncommitted merge): all 448 executed Rust tests passed, 52 diagnostics ignored; strict clippy and cargo-deny passed. Static x86_64 = 18,987,536 B versus production 16,435,312 B: +2,552,224 B (+15.53%), from remote transport/CA/enrollment; existing size ceiling remains unchanged and will report the D205 exception. ARM and the remaining fast rows are still running.

Migration fixture uses the saved production executable SHA256 3f92caf9771cd39874a3d2ce22f6ce6242a1f729423cc473bc7f2c466bea7de7. Actual software passkey enrolled through UI; actual PTY echo returned migration-terminal-42; mesh.node.enroll committed through the production websocket API. Baseline has migrations 0001–0014, one owner/passkey/session/terminal/writer/Mesh node/audit row and two wraps. Candidate static server started on 10.69.69.125:47591 against a stopped-DB copy. Existing columns and row values match across all 22 old tables; integrity/foreign keys pass; legacy terminal remains embedded.

Weighted migration output, verbatim:

Running as unit: run-p2596694-i27753193.scope; invocation ID: 2abf756bdd464003a84b697cee1e0f9c
{"machine": "infraternal-dev", "load_average": [11.62451171875, 13.5927734375, 16.02001953125], "migrations": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17], "preserved_tables": 22, "preserved_rows": 12, "existing_values": "identical", "integrity_check": "ok", "foreign_key_check": "ok", "legacy_terminal_route": "embedded", "startup_ms": 70.81}

Remote candidate validation (uncommitted merge): all 448 executed Rust tests passed, 52 diagnostics ignored; strict clippy and cargo-deny passed. Static x86_64 = 18,987,536 B versus production 16,435,312 B: +2,552,224 B (+15.53%), from remote transport/CA/enrollment; existing size ceiling remains unchanged and will report the D205 exception. ARM and the remaining fast rows are still running. Migration fixture uses the saved production executable SHA256 3f92caf9771cd39874a3d2ce22f6ce6242a1f729423cc473bc7f2c466bea7de7. Actual software passkey enrolled through UI; actual PTY echo returned migration-terminal-42; mesh.node.enroll committed through the production websocket API. Baseline has migrations 0001–0014, one owner/passkey/session/terminal/writer/Mesh node/audit row and two wraps. Candidate static server started on 10.69.69.125:47591 against a stopped-DB copy. Existing columns and row values match across all 22 old tables; integrity/foreign keys pass; legacy terminal remains embedded. Weighted migration output, verbatim: ``` Running as unit: run-p2596694-i27753193.scope; invocation ID: 2abf756bdd464003a84b697cee1e0f9c {"machine": "infraternal-dev", "load_average": [11.62451171875, 13.5927734375, 16.02001953125], "migrations": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17], "preserved_tables": 22, "preserved_rows": 12, "existing_values": "identical", "integrity_check": "ok", "foreign_key_check": "ok", "legacy_terminal_route": "embedded", "startup_ms": 70.81} ```

kayg commented

2026-10-10 00:26:06 +00:00

Author

Owner

Completed remote merge: release-addhost 4fdaa4917e, parents db8c5270 and ca8a09d4. Resolutions and rejected alternatives are in the merge body. No source branches changed. Workspace all-features and server no-default checks pass; 448 Rust tests, 67 tracer tests and 36 protocol tests pass. Migration 0001–0014 checksums unchanged; remote additions are 0015–0017. Production-shaped real UI/PTY/Mesh upgrade preserves all values across 22 tables. Static x86=18,987,536 B (+2,552,224 B); ARM=16,953,344 B (+3,111,200 B). Both stripped/static without PT_INTERP. D205 size-only exception; no limits raised.

Fast Rust summary, verbatim (exit 1 for size only):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Because Rust returns 1 before TS, the unchanged ts_verify_fast was run separately and passed; compiler/build/transfer/protocol rows pass. Full logs: /home/kayg/.cache/codex-scratch/release-addhost/logs/remote-fast.log and remote-ts-fast.log. Critical gzip=285265/307200 B, Brotli=236724/256000 B; deferred gzip=45317/51200 B, Brotli=40046/45056 B; largest on-demand gzip=13264/20480 B, Brotli=11989/18432 B. SSH adapter, CA UI step and trusted host completion are next; the whole release is not finished.

Completed remote merge: release-addhost 4fdaa4917e1a78371d02b2a3da8028e020aa80a5, parents db8c5270 and ca8a09d4. Resolutions and rejected alternatives are in the merge body. No source branches changed. Workspace all-features and server no-default checks pass; 448 Rust tests, 67 tracer tests and 36 protocol tests pass. Migration 0001–0014 checksums unchanged; remote additions are 0015–0017. Production-shaped real UI/PTY/Mesh upgrade preserves all values across 22 tables. Static x86=18,987,536 B (+2,552,224 B); ARM=16,953,344 B (+3,111,200 B). Both stripped/static without PT_INTERP. D205 size-only exception; no limits raised. Fast Rust summary, verbatim (exit 1 for size only): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` Because Rust returns 1 before TS, the unchanged ts_verify_fast was run separately and passed; compiler/build/transfer/protocol rows pass. Full logs: /home/kayg/.cache/codex-scratch/release-addhost/logs/remote-fast.log and remote-ts-fast.log. Critical gzip=285265/307200 B, Brotli=236724/256000 B; deferred gzip=45317/51200 B, Brotli=40046/45056 B; largest on-demand gzip=13264/20480 B, Brotli=11989/18432 B. SSH adapter, CA UI step and trusted host completion are next; the whole release is not finished.

kayg commented

2026-10-10 03:32:31 +00:00

Author

Owner

Completed CA trust-state helper 8aada65b, additive HTTP status c027e6a9, browser crypto reuse 744cdca9, on-demand CA ceremony 6e350f7b and provisioning hooks 71999cf11f. Status exposes initialized + locked only, behind existing live administrator/same-origin checks; finish responses unchanged. Regression fails before and passes afterward for fresh/retained trust; existing 4 CA HTTP tests pass. Browser uses the existing purpose-bound passkey proof and prescribed HKDF scope; transient PRF/account/scoped byte buffers are erased and only the scoped key is sent. Native fast gate: 552 passed / 59 ignored, 65 suites; all rows except D205 size-only exception. x86 19,578,352 bytes (+4,352 from previous head; no dependency/migration). Log /home/kayg/.cache/codex-scratch/release-addhost/logs/ca-status-fast.log.

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Completed CA trust-state helper 8aada65b, additive HTTP status c027e6a9, browser crypto reuse 744cdca9, on-demand CA ceremony 6e350f7b and provisioning hooks 71999cf11fac3f63dbd4f621c616ced0e1d50aa6. Status exposes initialized + locked only, behind existing live administrator/same-origin checks; finish responses unchanged. Regression fails before and passes afterward for fresh/retained trust; existing 4 CA HTTP tests pass. Browser uses the existing purpose-bound passkey proof and prescribed HKDF scope; transient PRF/account/scoped byte buffers are erased and only the scoped key is sent. Native fast gate: 552 passed / 59 ignored, 65 suites; all rows except D205 size-only exception. x86 19,578,352 bytes (+4,352 from previous head; no dependency/migration). Log /home/kayg/.cache/codex-scratch/release-addhost/logs/ca-status-fast.log. ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-10 04:19:16 +00:00

Author

Owner

Completed readiness routing at 89a6ace9, honest cleanup guide at e80055b3, and real-server WebSocket fixture correction at dbd0d5c0. Actual actor regression red→green; 553 native tests pass / 59 ignored / 65 suites. No-default server check passes (0.50 s). x86_64 static 19,578,352 B, unchanged from the previous native commit; production delta +3,143,040 B. The immutable size ceiling is the sole fast-gate failure, reported under D205; no limits changed.

Model tests: 20 pass / 74 assertions; tracer compiler and transfer budgets pass. Critical JS 286,768 gzip / 238,248 Brotli B, deferred 50,112 / 44,258 B, largest on-demand 14,587 / 12,942 B. Real-server bootstrap route/frame-type regression fails before fixture correction, passes after (5.9 s); private bootstrap frames are excluded from protocol diagnostics. Full output: release-addhost/logs/canary-fast.log.

Verbatim fast-gate summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Completed readiness routing at 89a6ace9, honest cleanup guide at e80055b3, and real-server WebSocket fixture correction at dbd0d5c0. Actual actor regression red→green; 553 native tests pass / 59 ignored / 65 suites. No-default server check passes (0.50 s). x86_64 static 19,578,352 B, unchanged from the previous native commit; production delta +3,143,040 B. The immutable size ceiling is the sole fast-gate failure, reported under D205; no limits changed. Model tests: 20 pass / 74 assertions; tracer compiler and transfer budgets pass. Critical JS 286,768 gzip / 238,248 Brotli B, deferred 50,112 / 44,258 B, largest on-demand 14,587 / 12,942 B. Real-server bootstrap route/frame-type regression fails before fixture correction, passes after (5.9 s); private bootstrap frames are excluded from protocol diagnostics. Full output: release-addhost/logs/canary-fast.log. Verbatim fast-gate summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-10 04:33:06 +00:00

Author

Owner

Local actual UI → fresh software passkey CA → private one-use password → static upload → systemd user service → certificate → admitted remote host → usable canvas terminal succeeded. Controlled container rootless UID 1000; certificate validity 604,800 seconds; Continue→ready 6,875.99 ms; Continue→confirmed terminal output 8,528.22 ms; SQL remote terminal count 1. Screenshot artifacts/remote-terminal-desktop.png; safe phases/public-ledger metrics logs/container-ui-eleventh.log. Static x86_64 now 19,578,416 B (+64 B across pending rollback/runtime + snapshot corrections).

Fixture correction: shared host devpts has a mode-000 pts/ptmx; the container inherited a symlink and unprivileged PTY creation failed with Permission denied. Replaced only the owned container /dev/ptmx symlink with its own 0666 c5:2 device; no host devices or limits changed. The preceding failed real attempt now rolls back completely: installation root and unit absent, demonstrating empty-runtime cleanup on real files.

Remote echo benchmark pending: Chromium alone had the fixture hostname resolver rule; the independent measurement client failed DNS. Use the named local listener IP with unchanged pinned Origin, then repeat the fresh proof. No external VM contacted or host key accepted/changed.

Local actual UI → fresh software passkey CA → private one-use password → static upload → systemd user service → certificate → admitted remote host → usable canvas terminal succeeded. Controlled container rootless UID 1000; certificate validity 604,800 seconds; Continue→ready 6,875.99 ms; Continue→confirmed terminal output 8,528.22 ms; SQL remote terminal count 1. Screenshot artifacts/remote-terminal-desktop.png; safe phases/public-ledger metrics logs/container-ui-eleventh.log. Static x86_64 now 19,578,416 B (+64 B across pending rollback/runtime + snapshot corrections). Fixture correction: shared host devpts has a mode-000 pts/ptmx; the container inherited a symlink and unprivileged PTY creation failed with Permission denied. Replaced only the owned container /dev/ptmx symlink with its own 0666 c5:2 device; no host devices or limits changed. The preceding failed real attempt now rolls back completely: installation root and unit absent, demonstrating empty-runtime cleanup on real files. Remote echo benchmark pending: Chromium alone had the fixture hostname resolver rule; the independent measurement client failed DNS. Use the named local listener IP with unchanged pinned Origin, then repeat the fresh proof. No external VM contacted or host key accepted/changed.

kayg commented

2026-10-10 04:39:51 +00:00

Author

Owner

Complete local UI/container proof (logs/container-ui-thirteenth.log): Continue→ready 6,276.50 ms; Continue→confirmed remote terminal 8,208.85 ms; rootless UID 1000; certificate 604,800 seconds; public SQL remote terminal count 1; canvas layout restores after reload. Actual remote echo through browser protocol + admitted transport + real PTY: n=1,000, p50 5.670 ms, p99 28.148 ms, max 66.740 ms; machine infraternal-dev / 8 cores / load 21.33,24.49,19.43; CPUWeight=10000 scope; no synthetic CPU or output load.

Local scale proof (logs/echo-scale-first.log): 50 real PTYs × 20 samples = 1,000 echoes; echo p50 0.33 ms / p99 5.29 ms (350 ms budget PASS), input Ack p50 0.24 ms / p99 3.10 ms. Load start 32.24,25.03,18.67 and finish 31.98,25.10,18.73; same 8-core machine / CPUWeight=10000 / zero injected RTT. Fixture cleanup restored PTY usage; no host limits changed. Screenshots artifacts/ca-setup-desktop.png, ssh-install-ready.png, remote-terminal-desktop.png, remote-reload-desktop.png. Native source has pending atomic snapshot/readiness + rollback corrections; full gate running before committing them. D198 generic lifecycle integration, target-specific host details, full suites, final upgrade/artifacts/operator record remain outstanding.

Complete local UI/container proof (logs/container-ui-thirteenth.log): Continue→ready 6,276.50 ms; Continue→confirmed remote terminal 8,208.85 ms; rootless UID 1000; certificate 604,800 seconds; public SQL remote terminal count 1; canvas layout restores after reload. Actual remote echo through browser protocol + admitted transport + real PTY: n=1,000, p50 5.670 ms, p99 28.148 ms, max 66.740 ms; machine infraternal-dev / 8 cores / load 21.33,24.49,19.43; CPUWeight=10000 scope; no synthetic CPU or output load. Local scale proof (logs/echo-scale-first.log): 50 real PTYs × 20 samples = 1,000 echoes; echo p50 0.33 ms / p99 5.29 ms (350 ms budget PASS), input Ack p50 0.24 ms / p99 3.10 ms. Load start 32.24,25.03,18.67 and finish 31.98,25.10,18.73; same 8-core machine / CPUWeight=10000 / zero injected RTT. Fixture cleanup restored PTY usage; no host limits changed. Screenshots artifacts/ca-setup-desktop.png, ssh-install-ready.png, remote-terminal-desktop.png, remote-reload-desktop.png. Native source has pending atomic snapshot/readiness + rollback corrections; full gate running before committing them. D198 generic lifecycle integration, target-specific host details, full suites, final upgrade/artifacts/operator record remain outstanding.

kayg commented

2026-10-10 05:00:01 +00:00

Author

Owner

Completed atomic slices: SSH rollback 117dcc19 retains ownership and cleanup receipts around unknown files and removes only empty owned runtime directories; three real-filesystem regressions red→green, all 28 install tests pass (1.86 s). Actual failed-container retry now removes its fresh root and unit. Snapshot readiness a5dea8cc accepts the same bounded split marker in Output or Snapshot; actual actor regressions pass for both forms.

Native checkpoint: 557 tests passed, 59 ignored; fmt, clippy, tests and dependency policy pass. Static x86_64 is 19,578,416 B, +64 B across those native changes; only the immutable size ceiling fails under D205. Installed payload SHA256 c83cdc5cbd6340ad5a4439dbc2e0a1e2a72767288369ab193780b7287b629178.

Cancellation wording 2dd4451b no longer claims rollback completed: two browser cases pass (40.4 s), compiler and units pass. Reusable primary/secondary buttons 98913b33 and dialog reuse 153dad0a remove duplicated states [D160]; compiler, 25 unit tests/84 assertions and unchanged transfer ceilings pass. 27-case browser run: 26 passed; obsolete policy fixture stopped at the required root consent. Corrected consent-aware test befc4585 passes (16.1 s total). Real fixture options d8ecd870 support the isolated release proof already recorded; all private material remains in memory.

Current finding: details-live.on-demand.ts sends bare host.facts.read even for a remote window, presenting the server's login/address and facts. A new unit regression fails on that bare input. Additive bounded node addressing (proposal already recorded) now selects the canonical enrolled UUID, verifies ownership/revocation via the existing terminal selector, and refuses malformed/unknown routes without local fallback. Parser regressions red→implementation underway; full native/browser gates running. No deploy.

Completed atomic slices: SSH rollback 117dcc19 retains ownership and cleanup receipts around unknown files and removes only empty owned runtime directories; three real-filesystem regressions red→green, all 28 install tests pass (1.86 s). Actual failed-container retry now removes its fresh root and unit. Snapshot readiness a5dea8cc accepts the same bounded split marker in Output or Snapshot; actual actor regressions pass for both forms. Native checkpoint: 557 tests passed, 59 ignored; fmt, clippy, tests and dependency policy pass. Static x86_64 is 19,578,416 B, +64 B across those native changes; only the immutable size ceiling fails under D205. Installed payload SHA256 c83cdc5cbd6340ad5a4439dbc2e0a1e2a72767288369ab193780b7287b629178. Cancellation wording 2dd4451b no longer claims rollback completed: two browser cases pass (40.4 s), compiler and units pass. Reusable primary/secondary buttons 98913b33 and dialog reuse 153dad0a remove duplicated states [D160]; compiler, 25 unit tests/84 assertions and unchanged transfer ceilings pass. 27-case browser run: 26 passed; obsolete policy fixture stopped at the required root consent. Corrected consent-aware test befc4585 passes (16.1 s total). Real fixture options d8ecd870 support the isolated release proof already recorded; all private material remains in memory. Current finding: details-live.on-demand.ts sends bare host.facts.read even for a remote window, presenting the server's login/address and facts. A new unit regression fails on that bare input. Additive bounded node addressing (proposal already recorded) now selects the canonical enrolled UUID, verifies ownership/revocation via the existing terminal selector, and refuses malformed/unknown routes without local fallback. Parser regressions red→implementation underway; full native/browser gates running. No deploy.

kayg commented

2026-10-10 05:46:45 +00:00

Author

Owner

Node-addressing checkpoint (uncommitted): a clean scripts/verify fast run passed 562 tests / 59 ignored, fmt, native fmt, clippy and dependency policy. Only D205 size fails: stripped static x86_64 19,587,184 B (no PT_INTERP). Core-only cargo check passes. The real owner-socket regression refuses unknown/partial targets without forwarding to embedded leg B. Tracer: 111 tests / 10,150 assertions, compiler and unchanged transfer budgets pass.

Strict addressing regressions: positional target arrays were accepted by Serde structs; red test then explicit nested-object guard passes. A second red test shows JSON-map normalization drops duplicate inner plugin fields. Fix underway: retain the original inner bytes using the existing serde_json raw_value feature, so each plugin keeps its frozen validation/duplicate policy. No new library or version. Parser smoke executed 10,000 inputs; it was not coverage-instrumented, so this is not a coverage claim.

The earlier browser/native overlap hit two overall browser deadlines; that run is retained, not waived. It will be repeated without this job compiling concurrently. Two overlapping native attempts also shared a log path; their mixed log is discarded as gate evidence. The independent clean checkpoint above is logs/node-target-clean-fast.log. Runtime plugin lifecycle integration and final real-server/browser/migration/artifact gates remain outstanding. No deploy.

Node-addressing checkpoint (uncommitted): a clean scripts/verify fast run passed 562 tests / 59 ignored, fmt, native fmt, clippy and dependency policy. Only D205 size fails: stripped static x86_64 19,587,184 B (no PT_INTERP). Core-only cargo check passes. The real owner-socket regression refuses unknown/partial targets without forwarding to embedded leg B. Tracer: 111 tests / 10,150 assertions, compiler and unchanged transfer budgets pass. Strict addressing regressions: positional target arrays were accepted by Serde structs; red test then explicit nested-object guard passes. A second red test shows JSON-map normalization drops duplicate inner plugin fields. Fix underway: retain the original inner bytes using the existing serde_json raw_value feature, so each plugin keeps its frozen validation/duplicate policy. No new library or version. Parser smoke executed 10,000 inputs; it was not coverage-instrumented, so this is not a coverage claim. The earlier browser/native overlap hit two overall browser deadlines; that run is retained, not waived. It will be repeated without this job compiling concurrently. Two overlapping native attempts also shared a log path; their mixed log is discarded as gate evidence. The independent clean checkpoint above is logs/node-target-clean-fast.log. Runtime plugin lifecycle integration and final real-server/browser/migration/artifact gates remain outstanding. No deploy.