mosaicstack/stack
1
0
Fork 1
Code Issues 246 Pull Requests 7 Actions Packages Projects Releases 15 Wiki Activity

invariant-r: host Pi drift and hardcoded-version coupling produce unrelated red #1191

New Issue
Open
opened 2026-08-13 01:41:01 +00:00 by be-coder-06 · 0 comments
be-coder-06 commented 2026-08-13 01:41:01 +00:00
Collaborator
Copy Link
Copy Source

Defect

packages/mosaic/src/lease-broker/invariant_r_unittest.py is red on web1 before any #1182 changes:

Pi runtime changed from measured 0.84.1 to '0.80.7'; remeasure its registry before updating Invariant R

1. Immediate host drift

A clean archive of origin/next@216cd72226cd9ee17eea461cfe7cd0e010a22f02 reproduces the same single failure (1 failed / 5 passed), so this is not caused by #1182.

The base test hardcodes PI_VERSION = "0.84.1" as the W-B measured registry version at line 44. Its probe resolves pi with shutil.which("pi") at line 105 and executes [pi, "--version"] at line 110.

On web1:

command -v pi -> /home/hermes/.npm-global/bin/pi
readlink -f   -> /home/hermes/.npm-global/lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js
pi --version  -> 0.80.7
global package version -> 0.80.7

There is one matching PATH entry and no shadowing. The host's runtime owner must decide whether to upgrade the global runtime or correct the expected pin. Do not upgrade Pi underneath live seats merely to clear this test.

Issue #1184 separately tracks pinning and approving the native Pi 0.84.1 artifact for P3 Task 8.

2. Design defect

The invariant test compares a hardcoded version literal against a dynamically resolved global binary. Those values have separate lifecycles, so the test is guaranteed to rot whenever either the measured release or host install changes. In this case it reports environment/version drift before it can test the property named by Invariant R (that the read-only carve-out remains real, unshadowed built-ins).

A security invariant check that repeatedly fails for unrelated version skew trains maintainers to ignore it. The runtime/version source should be explicit and lifecycle-coupled to the tested artifact, while registry drift should remain a distinct fail-closed assertion.

Acceptance criteria

  • Define one authoritative, lifecycle-coupled Pi artifact/version source for this test.
  • Fail distinctly for missing/wrong artifact versus actual registry/provenance drift.
  • Preserve the fail-closed requirement that a new Pi registry needs remeasurement and classification.
  • Add a control proving host PATH drift cannot masquerade as an Invariant R registry violation.
  • Coordinate with #1184 rather than modifying live global Pi during active sessions.
## Defect `packages/mosaic/src/lease-broker/invariant_r_unittest.py` is red on web1 before any #1182 changes: ```text Pi runtime changed from measured 0.84.1 to '0.80.7'; remeasure its registry before updating Invariant R ``` ### 1. Immediate host drift A clean archive of `origin/next@216cd72226cd9ee17eea461cfe7cd0e010a22f02` reproduces the same single failure (1 failed / 5 passed), so this is not caused by #1182. The base test hardcodes `PI_VERSION = "0.84.1"` as the W-B measured registry version at line 44. Its probe resolves `pi` with `shutil.which("pi")` at line 105 and executes `[pi, "--version"]` at line 110. On web1: ```text command -v pi -> /home/hermes/.npm-global/bin/pi readlink -f -> /home/hermes/.npm-global/lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js pi --version -> 0.80.7 global package version -> 0.80.7 ``` There is one matching PATH entry and no shadowing. The host's runtime owner must decide whether to upgrade the global runtime or correct the expected pin. Do not upgrade Pi underneath live seats merely to clear this test. Issue #1184 separately tracks pinning and approving the native Pi 0.84.1 artifact for P3 Task 8. ### 2. Design defect The invariant test compares a hardcoded version literal against a dynamically resolved global binary. Those values have separate lifecycles, so the test is guaranteed to rot whenever either the measured release or host install changes. In this case it reports environment/version drift before it can test the property named by Invariant R (that the read-only carve-out remains real, unshadowed built-ins). A security invariant check that repeatedly fails for unrelated version skew trains maintainers to ignore it. The runtime/version source should be explicit and lifecycle-coupled to the tested artifact, while registry drift should remain a distinct fail-closed assertion. ## Acceptance criteria - Define one authoritative, lifecycle-coupled Pi artifact/version source for this test. - Fail distinctly for missing/wrong artifact versus actual registry/provenance drift. - Preserve the fail-closed requirement that a new Pi registry needs remeasurement and classification. - Add a control proving host PATH drift cannot masquerade as an Invariant R registry violation. - Coordinate with #1184 rather than modifying live global Pi during active sessions.
be-coder-06 added the bug label 2026-08-13 01:41:01 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 coder2 coder3 f10-coder fred happy jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 rev0 sanity scooby (Scooby) scrappy shaggy tess velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1191