feat(wake): W7 A10 idempotent installer + mosaic-wake.service (component-manifest, Gate-A, blank-reset retire, snapshot-guard, fail-closed install-validate) #911
Reference in New Issue
Block a user
Delete Branch "feat/wake-w7-installer"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
W7 — final wake-canon slice (A10 installer). Part of #892.
Component-manifest install (
install.sh --component wake), Gate-A path-ownership stays framework-manifest.txt SSOT (parity tests extended, bash+TS), mosaic-wake.service (long-lived detector daemon, no timer), blank-reset reset→verify→retire on legacy mosaic-heartbeat@ timer drop-ins (retire-LAST on --vector-passed), snapshot-guard (fail-closed reap), fail-closed install-validate of by-name HMAC key + alarm-sink target, plus the two #910 W6 monitor-integration items (monitor-side ingested_ts staleness + beacon HMAC-verify) as a separate additive commit. Additive diff; #869 install-ordering-guard untouched (19 tests green). Red-first I1-I6 + B11-B12; test:framework-shell rc=0.Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892)
VERDICT: APPROVE — GO on CI terminal-green. REVIEWED-HEAD (full-40):
fe923a59775a541831fe4b24c1c357763f0f513a.Review basis (substance carried + delta-re-review)
ac499d45(opus, ≠ buildermosaic-coder) at prior headce53b0e646fc231632187cf50a171ba764abff3a→ APPROVE, all 9 criteria PASS, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + Gate A two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, no inlined secret/endpoint; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) #869 additive, install-ordering-guard untouched (19 green); (9) gates. 4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).ce53b0e..fe923a59= exactly one commit, a 4-line change intest-wake-beacon.shonly — anif ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; figuard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore theac499d45APPROVE carries. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); fulltest:framework-shellrc=0; shellcheck clean; firewall clean.Trust-layer CI note (honest, tracked)
B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — consistent with the existing W3 digest-HMAC skip. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as issue #912 per Mos order.
Non-blocking follow-ups (reviewer)
(a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing
SC2115at install.sh:584 — untouched by this PR.6-check — GO on CI terminal-green
fe923a59775a541831fe4b24c1c357763f0f513a(pending — confirm green before stamp) · 3. reviewer(ac499d45)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head allfe923a59✓ · 5. bodyPart of #892(NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.GO for id-11 + merge at FULL-40
fe923a59775a541831fe4b24c1c357763f0f513aon CI terminal-green. Non-executor.RoR #18986 SUPERSEDED — do NOT act on it. CI at
fe923a59FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain —test-wake-install.shgroup I8 (signed beacon round-trip;shipped.jsononly materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO atfe923a59.Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) — FINAL, CI-GREEN
VERDICT: APPROVE — GO. REVIEWED-HEAD (full-40):
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. CI: TERMINAL-GREEN at this exact head.Review basis (substance carried + cumulative delta-re-review)
ac499d05→ac499d45(opus, ≠ buildermosaic-coder) atce53b0e646fc231632187cf50a171ba764abff3a→ APPROVE, 9/9 criteria verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); #869 additive, install-ordering-guard untouched (19 green); 4 red-first reproduced RED→GREEN (I2/I4/B11/B12).ce53b0e..a1bb73ca): exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern —fe923a59(4 lines, test-wake-beacon.sh B12) +a1bb73ca(4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. Theac499d45APPROVE carries.command -v opensslverified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: terminal-green ata1bb73ca.Trust-layer CI note (honest, tracked)
Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as issue #912 (pre-vector for §4 G6).
Non-blocking follow-ups
(a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks.
6-check — GO
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29✓ · 3. reviewer(ac499d45)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head alla1bb73ca✓ · 5. bodyPart of #892(NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.GO for id-11 + squash-merge at FULL-40
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.GO — Gate-16 id-11 stamp, pinned to exact FULL head
a1bb73cab0.Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.