feat(wake): W6 — off-host dead-man beacon + pluggable alarm-sink adapter #910

2026-07-26T02:20:59Z

jason.woltje commented

2026-07-26 02:20:59 +00:00

W6 — off-host dead-man beacon + pluggable alarm-sink adapter (A8)

Builds on merged W2/W3/W4/W5. Adds the independent liveness leg: liveness
SPLIT from work-triggering, alarming on beacon ABSENCE. Part of #892.

Each piece → CONVERGED-DESIGN

§1.3 — Independent liveness leg (off-host dead-man beacon)

Monotonic emitter (beacon.sh emit): strictly-increasing beacon_seq +
emit_ts each cycle, shipped OFF-HOST via the pluggable sink adapter. This is
the primitive the detector run-loop calls each poll.
Alarm on ABSENCE (beacon.sh check): an off-host monitor reads the last
received beacon; MISSING or STALE-past-SLO → alarm. Depends on NOTHING the
dying host actively does (a stopped emitter simply stops advancing the received
clock). beacon.sh record is the monitor-side receiver (monotonic: keeps the
highest seq; ignores stale/replayed).
Same-host sibling is NOT independent → WAKE_BEACON_INDEPENDENCE=same-host-sibling
is REJECTED (fail loud): shares user-manager/host/sender/socket/session.
Isolated host degrades, FLAGGED → different-supervision-root is accepted
but emitted with degraded:true + a loud stderr flag; never silently "healthy".
capture-pane = liveness HINT only → WAKE_BEACON_PANE_HINT is noted but
NEVER suppresses an absence; readiness is proven solely by RECEIVED/CONSUMED
acks (W2/W3), never a pane scrape.

§4 G1 — off-host dead-man response: the absence alarm is proven to FIRE and
ROUTE to a human/other-host via the alarm-sink adapter within its SLO (SLO is
REQUIRED — no invented default).

§4 G2a — fail-loud / fail-closed: an UNCONFIGURED (unset) or UNREACHABLE
(non-zero exit) beacon sink OR alarm target FAILS LOUD — no silent no-alarm host.

Framework / operator boundary (§1.4)

Framework ships: the emitter, the off-host receiver + absence-alarm, and a
pluggable alarm-sink / beacon-sink ADAPTER INTERFACE (WAKE_BEACON_SINK_CMD,
WAKE_ALARM_SINK_CMD).
Operator owns the TARGET ENDPOINT: the sink command resolves its
address/credential by name via load_credentials, NEVER inlined here.
W7 (out of scope) wires + install-validates the target; W6 provides the
emitter + adapter interface + absence-alarm + the fail-loud-on-unconfigured/
unreachable PRIMITIVE that W7's validation calls.

RED-FIRST evidence (`test-wake-beacon.sh`, 10 groups, wired into `test:framework-shell`)

Each invariant was proven to go RED before green:

B1 monotonic — _next_seq pinned constant → got 7,7,7 (red).
B2/B9 absence — forced ALIVE → alarm never fired/routed (red).
B3 fail-loud alarm — unconfigured sink returns 0 → red (must exit 3).
B4 degraded flag — different-supervision-root marked not-degraded → red.
B5 sibling reject — same-host-sibling accepted → red (and seq must not advance).
B7 fail-loud emit sink — unconfigured sink returns 0 → red (must exit 3).
B6 by-name target resolution, B8 required-SLO, B10 alive-within-SLO also covered.

Gates / firewall / format

shellcheck clean (beacon.sh, test, detector.sh).
Firewall grep -niE 'jason|woltje|jarvis' = 0; verify-sanitized.sh PASS.
pnpm format:check (prettier) PASS.
Full wake suite (store-ack, digest-hmac, detector, fn-oracle, reconcile,
beacon) all green.

detector.sh seam (noted explicitly)

A single, minimal, opt-in W6 emit call in the cmd_run poll loop: INERT unless
the operator wires WAKE_BEACON_SINK_CMD. A beacon emit failure NEVER kills the
detector loop (liveness is split from work-triggering) but is loud, not silent.
No store/ack/digest/sign code touched (public APIs only). manifest.txt
0.4.0 → 0.5.0 + inventory.

Part of #892

## W6 — off-host dead-man beacon + pluggable alarm-sink adapter (A8) Builds on merged W2/W3/W4/W5. Adds the **independent liveness leg**: liveness SPLIT from work-triggering, alarming on beacon **ABSENCE**. `Part of #892`. ### Each piece → CONVERGED-DESIGN **§1.3 — Independent liveness leg (off-host dead-man beacon)** - **Monotonic emitter** (`beacon.sh emit`): strictly-increasing `beacon_seq` + `emit_ts` each cycle, shipped OFF-HOST via the pluggable sink adapter. This is the primitive the detector run-loop calls each poll. - **Alarm on ABSENCE** (`beacon.sh check`): an off-host monitor reads the last received beacon; MISSING or STALE-past-SLO → alarm. Depends on NOTHING the dying host actively does (a stopped emitter simply stops advancing the received clock). `beacon.sh record` is the monitor-side receiver (monotonic: keeps the highest seq; ignores stale/replayed). - **Same-host sibling is NOT independent** → `WAKE_BEACON_INDEPENDENCE=same-host-sibling` is REJECTED (fail loud): shares user-manager/host/sender/socket/session. - **Isolated host degrades, FLAGGED** → `different-supervision-root` is accepted but emitted with `degraded:true` + a loud stderr flag; never silently "healthy". - **capture-pane = liveness HINT only** → `WAKE_BEACON_PANE_HINT` is noted but NEVER suppresses an absence; readiness is proven solely by RECEIVED/CONSUMED acks (W2/W3), never a pane scrape. **§4 G1 — off-host dead-man response**: the absence alarm is proven to FIRE and ROUTE to a human/other-host via the alarm-sink adapter within its SLO (SLO is REQUIRED — no invented default). **§4 G2a — fail-loud / fail-closed**: an UNCONFIGURED (unset) or UNREACHABLE (non-zero exit) beacon sink OR alarm target FAILS LOUD — no silent no-alarm host. ### Framework / operator boundary (§1.4) - **Framework ships**: the emitter, the off-host receiver + absence-alarm, and a pluggable **alarm-sink / beacon-sink ADAPTER INTERFACE** (`WAKE_BEACON_SINK_CMD`, `WAKE_ALARM_SINK_CMD`). - **Operator owns** the TARGET ENDPOINT: the sink command resolves its address/credential **by name** via `load_credentials`, NEVER inlined here. - **W7 (out of scope)** wires + install-validates the target; W6 provides the emitter + adapter interface + absence-alarm + the fail-loud-on-unconfigured/ unreachable PRIMITIVE that W7's validation calls. ### RED-FIRST evidence (`test-wake-beacon.sh`, 10 groups, wired into `test:framework-shell`) Each invariant was proven to go RED before green: - **B1** monotonic — `_next_seq` pinned constant → `got 7,7,7` (red). - **B2/B9** absence — forced ALIVE → alarm never fired/routed (red). - **B3** fail-loud alarm — unconfigured sink returns 0 → red (must exit 3). - **B4** degraded flag — `different-supervision-root` marked not-degraded → red. - **B5** sibling reject — same-host-sibling accepted → red (and seq must not advance). - **B7** fail-loud emit sink — unconfigured sink returns 0 → red (must exit 3). - B6 by-name target resolution, B8 required-SLO, B10 alive-within-SLO also covered. ### Gates / firewall / format - `shellcheck` clean (beacon.sh, test, detector.sh). - Firewall `grep -niE 'jason|woltje|jarvis'` = **0**; `verify-sanitized.sh` PASS. - `pnpm format:check` (prettier) PASS. - Full wake suite (store-ack, digest-hmac, detector, fn-oracle, reconcile, beacon) all green. ### detector.sh seam (noted explicitly) A single, minimal, opt-in W6 emit call in the `cmd_run` poll loop: INERT unless the operator wires `WAKE_BEACON_SINK_CMD`. A beacon emit failure NEVER kills the detector loop (liveness is split from work-triggering) but is loud, not silent. No store/ack/digest/sign code touched (public APIs only). `manifest.txt` 0.4.0 → 0.5.0 + inventory. Part of #892

jason.woltje added 1 commit 2026-07-26 02:21:00 +00:00

feat(wake): W6 — off-host dead-man beacon + pluggable alarm-sink adapter

ci/woodpecker/pr/ci Pipeline was successful

Details

060977c732

A8 of the wake canon (EPIC #892, W6): the independent liveness leg.

beacon.sh:
- MONOTONIC EMITTER (emit): strictly-increasing seq + emit_ts each cycle,
  shipped off-host via a pluggable sink adapter. The primitive the detector
  run-loop calls each poll (§1.3).
- DEAD-MAN / ABSENCE alarm (record + check): the off-host monitor's receiver
  and absence check. A missing/stale-past-SLO beacon FIRES the alarm and ROUTES
  it to a human/other-host, depending on nothing the dying host does (§1.3/§4-G1).
- PLUGGABLE alarm-sink / beacon-sink ADAPTER INTERFACE: the framework ships the
  emitter + interface; the operator owns the target endpoint, resolved BY NAME
  (load_credentials), never inlined (§1.4). FAIL-CLOSED: unconfigured OR
  unreachable target FAILS LOUD — no silent no-alarm host (§4-G2a).
- DEGRADED MODES (honest, not silent): a same-host sibling is REJECTED as
  non-independent (shares user-manager/host/sender/socket/session); an isolated
  host degrades to a FLAGGED different-supervision-root beacon; capture-pane is
  a liveness HINT only (§1.3).

detector.sh: a single minimal, opt-in W6 emit seam in the run-loop (inert unless
the operator wires WAKE_BEACON_SINK_CMD; a beacon emit failure never kills the
loop but is loud). No store/ack/digest/sign code touched.

test-wake-beacon.sh: RED-FIRST harness (10 invariant groups), wired into
test:framework-shell. manifest.txt bumped 0.4.0 -> 0.5.0 + inventory.

Part of #892

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje commented

2026-07-26 02:28:08 +00:00

Record of Review — PR #910 W6 (off-host dead-man beacon + alarm-sink adapter; Part of #892)

VERDICT: APPROVE (GO on CI terminal-green). Reviewer: independent subagent a15a0359 (opus, per §1.3/§4-G1/§1.4) — ≠ builder (mosaic-coder). REVIEWED-HEAD (full-40): 060977c732e537c04e5376e950ea47ab743f672b.

Per-criterion (all 8 PASS; red-first B1/B2/B5/B7 reproduced)

Monotonic emit + off-host ship — strictly-increasing seq (atomic write) shipped via pluggable sink; B1 red (pinned seq).
★ Dead-man ABSENCE alarm host-independent (LOAD-BEARING) — check fires on stale-past-SLO AND never-received; verdict = now − last_emit_ts computed MONITOR-SIDE. Runtime demo: stopped emitter → ALARM FIRED+ROUTED, host INERT (host cannot prevent/delay/suppress). SLO required (no invented default). Forced-ALIVE mutation → B2 red.
Fail-closed adapter — unconfigured sink→exit 3 (no silent no-alarm host); unreachable→exit 1/3; both emit+alarm sinks. B7 silent-no-op mutation → red.
Degraded modes honest — same-host-sibling REJECTED (seq not advanced, rejection precedes bump); different-supervision-root emits degraded=true + FLAGGED; pane-hint never suppresses absence. B5 mutation → red.
By-name target never-inline — only --slo-seconds; no key/secret flag; no endpoint/secret in the framework file.
★ Detector seam minimal+loud — ONE opt-in call: if WAKE_BEACON_SINK_CMD set: beacon.sh emit || echo WARN. INERT by default; emit-failure non-fatal to poll loop (liveness split) yet LOUD on stderr; store/ack/digest/sign BYTE-UNCHANGED.
Red-first + wiring — B1-B10 wired into test:framework-shell; all 6 wake harnesses green.
Gates — shellcheck clean; firewall 0 + no operator hosts/paths; verify-sanitized pass; prettier clean; manifest 0.4→0.5; mergeable.

Non-blocking → carry into W7 monitor integration (NOT merge blockers)

(a) staleness uses host-supplied emit_ts not a monitor-side receive-ts (within the same-uid threat boundary; a stopped host cannot keep advancing it) → add a monitor-side ingested_ts in W7. (b) beacon is not HMAC-verified (design mandates HMAC for DIGESTS §2.5 only, not the beacon — within contract) → beacon authenticity deferred to W7 monitor integration.
GO for id-11 + merge at FULL-40 060977c732e537c04e5376e950ea47ab743f672b on CI terminal-green. Non-executor.

# Record of Review — PR #910 W6 (off-host dead-man beacon + alarm-sink adapter; Part of #892) **VERDICT: APPROVE** (GO on CI terminal-green). **Reviewer:** independent subagent `a15a0359` (opus, per §1.3/§4-G1/§1.4) — ≠ builder (`mosaic-coder`). **REVIEWED-HEAD (full-40):** `060977c732e537c04e5376e950ea47ab743f672b`. ## Per-criterion (all 8 PASS; red-first B1/B2/B5/B7 reproduced) 1. **Monotonic emit + off-host ship** — strictly-increasing seq (atomic write) shipped via pluggable sink; B1 red (pinned seq). 2. **★ Dead-man ABSENCE alarm host-independent (LOAD-BEARING)** — `check` fires on stale-past-SLO AND never-received; verdict = `now − last_emit_ts` computed MONITOR-SIDE. Runtime demo: stopped emitter → ALARM FIRED+ROUTED, host INERT (host cannot prevent/delay/suppress). SLO required (no invented default). Forced-ALIVE mutation → B2 red. 3. **Fail-closed adapter** — unconfigured sink→exit 3 (no silent no-alarm host); unreachable→exit 1/3; both emit+alarm sinks. B7 silent-no-op mutation → red. 4. **Degraded modes honest** — same-host-sibling REJECTED (seq not advanced, rejection precedes bump); different-supervision-root emits degraded=true + FLAGGED; pane-hint never suppresses absence. B5 mutation → red. 5. **By-name target never-inline** — only --slo-seconds; no key/secret flag; no endpoint/secret in the framework file. 6. **★ Detector seam minimal+loud** — ONE opt-in call: `if WAKE_BEACON_SINK_CMD set: beacon.sh emit || echo WARN`. INERT by default; emit-failure non-fatal to poll loop (liveness split) yet LOUD on stderr; store/ack/digest/sign BYTE-UNCHANGED. 7. **Red-first + wiring** — B1-B10 wired into test:framework-shell; all 6 wake harnesses green. 8. **Gates** — shellcheck clean; firewall 0 + no operator hosts/paths; verify-sanitized pass; prettier clean; manifest 0.4→0.5; mergeable. ## Non-blocking → carry into W7 monitor integration (NOT merge blockers) (a) staleness uses host-supplied emit_ts not a monitor-side receive-ts (within the same-uid threat boundary; a stopped host cannot keep advancing it) → add a monitor-side `ingested_ts` in W7. (b) beacon is not HMAC-verified (design mandates HMAC for DIGESTS §2.5 only, not the beacon — within contract) → beacon authenticity deferred to W7 monitor integration. **GO for id-11 + merge at FULL-40 `060977c732e537c04e5376e950ea47ab743f672b` on CI terminal-green. Non-executor.**

Ghost approved these changes 2026-07-26 02:30:28 +00:00

Ghost left a comment

GO — Gate-16 id-11 stamp, pinned to exact FULL head 060977c732.
Basis: verbatim RoR (comment 18966) — independent review APPROVE, all 8 criteria; the load-bearing property verified by RUNTIME DEMO: a host that stops emitting is inert against the alarm (verdict computed monitor-side from now−last_emit_ts; forced-ALIVE red proves harness teeth). Pluggable sink fail-closed (unconfigured/unreachable → exit-3), degraded modes honest per the ratified concessions, detector seam opt-in inert-by-default, prior layers byte-unchanged. Two within-contract observations (monitor-side ingested_ts; beacon authenticity) folded into the W7 brief. CI terminal-green. W6 of EPIC #892. Named executor: Mos (id-11), squash pinned.

GO — Gate-16 id-11 stamp, pinned to exact FULL head 060977c732e537c04e5376e950ea47ab743f672b. Basis: verbatim RoR (comment 18966) — independent review APPROVE, all 8 criteria; the load-bearing property verified by RUNTIME DEMO: a host that stops emitting is inert against the alarm (verdict computed monitor-side from now−last_emit_ts; forced-ALIVE red proves harness teeth). Pluggable sink fail-closed (unconfigured/unreachable → exit-3), degraded modes honest per the ratified concessions, detector seam opt-in inert-by-default, prior layers byte-unchanged. Two within-contract observations (monitor-side ingested_ts; beacon authenticity) folded into the W7 brief. CI terminal-green. W6 of EPIC #892. Named executor: Mos (id-11), squash pinned.

Ghost merged commit 003cdaa1a6 into main

2026-07-26 02:30:29 +00:00

Ghost deleted branch feat/wake-beacon

2026-07-26 02:30:30 +00:00

Ghost referenced this issue from a commit

2026-07-26 02:30:31 +00:00

feat(wake): W6 — off-host dead-man beacon + pluggable alarm-sink adapter (#910)

jason.woltje referenced this pull request

2026-07-26 02:39:54 +00:00

EPIC: Wake/Heartbeat Efficiency — canon framework component (§6 category-A) #892

jason.woltje referenced this issue from a commit

2026-07-26 03:12:17 +00:00