From 58ada98d2b430da28c46cf92eebdb6d45b8b1846 Mon Sep 17 00:00:00 2001 From: be-coder-05 Date: Thu, 6 Aug 2026 11:53:56 -0500 Subject: [PATCH] fix(installer): support BusyBox coverage inventory --- docs/PRD.md | 2 +- .../13-round7-busybox-portability.txt | 56 +++++++++++++++++++ .../documentation-checklist.md | 3 +- .../1050-install-state-machine-red-fixture.md | 8 +++ tools/verify-greenfield-execution-coverage.sh | 12 +++- 5 files changed, 77 insertions(+), 4 deletions(-) create mode 100644 docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt diff --git a/docs/PRD.md b/docs/PRD.md index 314688cb..2b38604f 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -1393,7 +1393,7 @@ A from-zero install can report success while leaving the target host unusable be 12. The expected-RED comparator SHALL validate the complete manifest before selecting a case: exact case population, one exit and P0–P9 disposition per case, pinned require/forbid classes, and no malformed, duplicate, or unknown rows. 13. The published installer contract SHALL reject failed fetches, HTTP-success empty bodies, and digest mismatch, then execute the exact digest-verified body. The remote CI arm SHALL enumerate every payload-acquisition path and report a bound/found denominator. It SHALL bind both the installer body and the downstream stack framework/source it consumes to the same immutable CI commit, while retaining `--next` as the lane selector. Source resolution/acquisition SHALL fail closed, and the arm SHALL verify the realised source commit and archive digest after installation. Any out-of-scope unpinned sibling SHALL be named and counted rather than silently included in a broader pinning claim. `ASSUMPTION:` the configured repository's authenticated exact-commit endpoint is trusted to map that commit ID to the returned archive bytes; independent signed provenance/authenticity against repository or TLS trust-root compromise remains excluded by canonical greenfield-install PRD v2 §3. 14. Phase diagnostics SHALL be redacted before terminal or durable-log output. A seeded positive-control canary SHALL remain absent from observed argv, output, command logs, npm configuration, generated files, and shell history. -15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED. +15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED. Coverage tooling SHALL execute under both the canonical Alpine/BusyBox CI image and the Debian greenfield image; a green result from either runtime alone is insufficient portability evidence. ### C1 acceptance criteria diff --git a/docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt b/docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt new file mode 100644 index 00000000..0a54cb6c --- /dev/null +++ b/docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt @@ -0,0 +1,56 @@ +# #1050 C1 fix round — Round 7 canonical Alpine/BusyBox portability + +BASE HEAD +- d66e91b1f22489b911eef982aec3faa62c5edeb3 +- Review 119 (rev-974) found tools/verify-greenfield-execution-coverage.sh used GNU-only find -printf. +- Pipeline 2246's canonical Alpine ci-base test failed while the Debian greenfield workflow passed; the stale pipeline is diagnostic evidence only and is not inherited as a ruling for the replacement head. + +RED +- Before remediation: + docker run --rm -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh + => canonical_alpine_red_rc=1 +- Independent review 119 captured BusyBox 1.37 rejecting `find: unrecognized: -printf`. +- Debian/GNU execution remained green, proving that one runtime's success did not establish portability. + +IMPLEMENTATION +- Removed the GNU find -printf inventory. +- Marker inventory now uses Bash nullglob/dotglob plus parameter expansion, all available in the script's declared Bash runtime. +- The checker verifies the run directory is readable/searchable before inventory and fails closed otherwise. +- Only direct regular, non-symlink `*.ran` files are included, preserving the prior find boundary; identities remain sorted and compared as exact sets. +- No production fixture disposition, expected-RED manifest, e2e installer, #869 wiring, or acquisition behavior changed. + +GREEN +- Local focused suite: greenfield execution coverage tests passed. +- Canonical Alpine/BusyBox focused suite: + docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh + => greenfield execution coverage tests passed. +- Existing Round-6 controls retained: + ignore-arms aggregation helper => rc=1 + ignore-cases aggregation helper => rc=1 + always-RED aggregation helper => rc=1 + delete production .mosaic-test-work archive exclusion => rc=1 +- Mutant workspace: /tmp/c1-round7-mutants.LocpBH + +FENCED FILES +- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical) +- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical) + +LOCAL BASELINES +- /home free before and after validation: 11G +- Bash syntax focused scripts: PASS +- ShellCheck focused scripts: PASS +- pnpm test:installer: PASS +- pnpm typecheck: PASS (45/45) +- pnpm lint: PASS (25/25) +- pnpm format:check: PASS +- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS +- git diff --check: PASS + +INDEPENDENT REVIEW +- Codex code review: APPROVE, confidence 0.96, zero findings. It confirmed hidden/empty/direct-regular/non-symlink semantics, exact sorting/comparison, dual-runtime execution, and PRD alignment. +- Codex security review: risk NONE, confidence 0.97, zero findings. It confirmed quoted paths, fail-closed exact-set behavior, and no new injection, traversal, authorization, secret, cryptographic, dependency, or data-integrity risk. +- The security-review sandbox could not execute the focused suite because its filesystem is read-only; the local and canonical-container measured runs above provide dynamic evidence. + +PENDING +- commit, queue guard, one lease-pinned push, provider attribution read-back +- replacement-head canonical CI; no manual pipeline trigger or polling diff --git a/docs/reports/verification/1050-c1-fix-round/documentation-checklist.md b/docs/reports/verification/1050-c1-fix-round/documentation-checklist.md index a70f60b8..0268093d 100644 --- a/docs/reports/verification/1050-c1-fix-round/documentation-checklist.md +++ b/docs/reports/verification/1050-c1-fix-round/documentation-checklist.md @@ -2,7 +2,7 @@ ## Required artifacts -- [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds pipeline-level exact case+arm execution coverage, executable aggregation, and production-bound archive purity. +- [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds pipeline-level exact case+arm execution coverage, executable aggregation, production-bound archive purity, and canonical Alpine/BusyBox plus Debian portability. - [x] User guide: not applicable; no user-facing production installer behavior changed. - [x] Admin guide: not applicable; no operator procedure or deployment behavior changed. - [x] Developer guide: existing `docs/guides/installer-state-machine.md` defines the fail-closed installer model; the C1-specific remote-arm contract and evidence live in the PRD, scratchpad, and scoped verification report. @@ -23,4 +23,5 @@ - [x] Round-4 review cycle closed: two blocking Codex findings (missing dependency ordering; production manifest comments misparsed) were accepted and fixed. Final code review APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.96, zero findings). - [x] Round-5 exact arm coverage and archive-purity controls reviewed: Codex code APPROVE (confidence 0.93, zero findings) and security risk NONE (confidence 0.96, zero findings). - [x] Round-6 executable aggregation and production archive-selector binding reviewed: Codex code APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.97, zero findings). +- [x] Round-7 BusyBox-safe marker inventory and dual-runtime evidence reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.97, zero findings). - [x] Canonical evidence remains in-repo. No external publishing action was requested or performed. diff --git a/docs/scratchpads/1050-install-state-machine-red-fixture.md b/docs/scratchpads/1050-install-state-machine-red-fixture.md index 16f67cbf..9a8eef6c 100644 --- a/docs/scratchpads/1050-install-state-machine-red-fixture.md +++ b/docs/scratchpads/1050-install-state-machine-red-fixture.md @@ -168,3 +168,11 @@ Denominator corrections were sent to and accepted by the lane lead before implem - Review `rev-974` separately proved that deleting only the production `e2e-install-test.sh` `.mosaic-test-work` tar exclusion left the copied-selector control green. The control now structurally binds its semantic archive test to the production checkout-archive command; the delete-production-binding mutant is RED. The fenced production installer remains byte-unchanged. - Final review: Codex code APPROVE confidence 0.94 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, focused truth-table and four mutant controls, and diff check pass with 11G free before validation. - Full evidence: `docs/reports/verification/1050-c1-fix-round/12-round6-caller-coupling-and-archive-binding.txt`. + +## Round 7 — canonical Alpine/BusyBox portability + +- Review 119 found the exact-head focused suite RED in the canonical Alpine `ci-base`: GNU `find -printf` is unsupported by BusyBox 1.37. The same script remained green in the Debian greenfield workflow, so greenfield success alone did not prove canonical runtime compatibility. +- Local canonical-image RED was reproduced at rc1 before remediation. Marker inventory now uses Bash nullglob/dotglob and parameter expansion, checks state-directory readability, preserves the prior regular-file/non-symlink boundary, and retains sorted exact-set comparison without GNU-only flags. +- The focused suite is green both locally and inside `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`. Canonical pipeline evidence remains pending the replacement frozen-head push; no stale pipeline is inherited. +- Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, dual-runtime focused tests, retained Round-6 mutants, and diff check pass with 11G free. +- Full evidence: `docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt`. diff --git a/tools/verify-greenfield-execution-coverage.sh b/tools/verify-greenfield-execution-coverage.sh index dccf3980..a0487803 100755 --- a/tools/verify-greenfield-execution-coverage.sh +++ b/tools/verify-greenfield-execution-coverage.sh @@ -69,8 +69,16 @@ case "$mode" in trap cleanup EXIT expected_names > "$expected_file" - find "$run_dir" -mindepth 1 -maxdepth 1 -type f -name '*.ran' -printf '%f\n' \ - | sed 's/\.ran$//' | LC_ALL=C sort -u > "$actual_file" + [[ -r "$run_dir" && -x "$run_dir" ]] \ + || { echo "[fixture-suite] coverage state is not readable: $run_dir" >&2; exit 1; } + ( + shopt -s nullglob dotglob + for marker in "$run_dir"/*.ran; do + [[ -f "$marker" && ! -L "$marker" ]] || continue + marker_name="${marker##*/}" + printf '%s\n' "${marker_name%.ran}" + done + ) | LC_ALL=C sort -u > "$actual_file" defined="$(wc -l < "$expected_file" | tr -d ' ')" executed="$(wc -l < "$actual_file" | tr -d ' ')"