T9 (burn-before-enqueue, #908 arrow #1) forced the durable pending-write
failure via `chmod 500 "$STATE_DIR"`. That works only as a non-root user:
DAC permission checks (including a read-only directory) are bypassed
entirely by root, and Woodpecker CI containers run as root — so the write
silently succeeded, observed_seq advanced, and all three "failed-write"
assertions went spuriously green. The chmod also blocked the cursor's
(observed_seq) own mktemp in the same directory, so even under a non-root
run T9 could never have caught a premature cursor commit — narrower
coverage than its comment claimed. The product code (store.sh) was already
correct: the durable pending write is textually first and the cursor write
is gated on its success (verified independently, unchanged here).
Fix: bind-mount a throwaway file over $STATE_DIR/pending.jsonl (the exact
_atomic_write rename TARGET for the durable write) so the atomic write's
`mv -f tmp target` hits EBUSY — the kernel refuses to rename any file onto
an ACTIVE MOUNT POINT. That is a structural VFS constraint, not a DAC
check: no uid, root included, can bypass it short of an explicit umount.
observed_seq is left an ordinary writable file, untouched by the mount, so
a regression that commits the cursor before/independent of the durable
write is now genuinely caught. The mount + forced enqueue run inside a
private `unshare --mount --user --map-root-user` namespace so the same
mechanism applies whether the harness runs unprivileged (dev) or as root
(CI); the bind mount is private to that namespace and vanishes the instant
it exits, so no manual cleanup step is needed afterward.
sweep: grep chmod/chattr across all packages/mosaic/framework/tools/wake/test-*.sh
-> T9's `chmod 500 "$STATE_DIR"` (fixed here) was the ONLY permission-based
fault-injection use. Every other chmod hit is `chmod +x` making a mock/
fixture script executable (benign setup, not failure injection, unaffected
by root): test-wake-reconcile.sh:68, test-wake-detector.sh:110,
test-wake-digest-hmac.sh:164, test-wake-beacon.sh:70/79/88/103/311,
test-wake-store-ack.sh:246 (mock curl/wget/nc/ssh binaries).
Verified: enqueue under the injection exits non-zero as the current
non-root user, with the process reporting uid 0 INSIDE the namespace
(genuine kernel-mapped root) and still failing EBUSY — a direct proof the
mechanism is root-proof, not just an argument. fakeroot was tried per
request but only fakes stat/chown (no real mount capability), so it is not
a meaningful vehicle for this injection and was not used as the proof.
Coverage-RED reproduction: temporarily moved the observed_seq cursor write
in store.sh to before the durable pending write (premature commit) -> T9
went RED (observed_seq wrongly advanced to 2, post-failure allocation
wrongly resumed at 3); reverted -> GREEN again, diff-clean against origin.
Full `pnpm run test:framework-shell` rc=0 (all harnesses, T9 included,
11/11 wake store/ack groups green); re-run with openssl masked from PATH
(command -v openssl confirmed empty) rc=0, wake store/ack harness
unaffected (an unrelated harness, test-wake-digest-hmac.sh, gracefully
SKIPs without openssl -- pre-existing, orthogonal, HMAC is W3/A5 not W2).
shellcheck 0.11 clean (one deliberate SC2016 on nested-shell variable
expansion, disabled inline per this repo's existing convention).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
store.sh enqueue becomes the SOLE allocator of observed_seq: under an exclusive
enqueue lock it reads its own cursor, sets next=observed_seq+1, writes the
pending record + observed.set + the cursor as ONE transaction (cursor committed
IFF the durable write succeeds), and prints the allocated seq. The detector's
private observed_seq_counter and its --seq hand-off are deleted; the reconciler
enumerates via the same store allocator and its dual-allocator fail-closed guard
is retired. This dissolves the three defects rooted in the private-counter seam:
burn-before-enqueue, W5 co-feed aliasing, and the migration-restart silent-swallow.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @b6f36564 (8/8, verified vs real production settings template), author id2 != approver id11, clean mosaic-coder author, CI green wp1988.
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @75235ef8 (9/9, no live host mutation), author id2 != approver id11, CI green wp1971.
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
Part of #869
Mos (id-11) Gate-16 merge: independent 3-round APPROVE @c5a2bcc5, author id2 != approver id11, CI green wp1973.
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
GLPI helpdesk workflow skills written against the portable
tools/glpi/ tooling (session-init.sh, ticket-list.sh, ticket-create.sh),
cross-linked via [[glpi-*]]:
- glpi-solve — close a ticket by setting status Solved (5); GLPI auto-closes
- glpi-followup — add a followup via the top-level /ITILFollowup endpoint
- glpi-sweep — read-only hunt for done-but-open tickets needing Solve
- glpi-list — query tickets by status/recency
- glpi-create — open a new ticket
Core rule encoded: completing work means setting status Solved, not just
posting a resolution followup (a followup documents; only Solved auto-closes).
Note: illustrative examples in the bodies are USC-flavored (M2M / helpdesk
ticket numbers) and can be genericized in review if preferred.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GjBgrb9tHgvq414Fqj37c
