feat(wake): W7 A10 idempotent installer + mosaic-wake.service (component-manifest, Gate-A, blank-reset retire, snapshot-guard, fail-closed install-validate) #911

Merged
Mos merged 4 commits from feat/wake-w7-installer into main 2026-07-26 04:19:10 +00:00
Owner

W7 — final wake-canon slice (A10 installer). Part of #892.

Component-manifest install (install.sh --component wake), Gate-A path-ownership stays framework-manifest.txt SSOT (parity tests extended, bash+TS), mosaic-wake.service (long-lived detector daemon, no timer), blank-reset reset→verify→retire on legacy mosaic-heartbeat@ timer drop-ins (retire-LAST on --vector-passed), snapshot-guard (fail-closed reap), fail-closed install-validate of by-name HMAC key + alarm-sink target, plus the two #910 W6 monitor-integration items (monitor-side ingested_ts staleness + beacon HMAC-verify) as a separate additive commit. Additive diff; #869 install-ordering-guard untouched (19 tests green). Red-first I1-I6 + B11-B12; test:framework-shell rc=0.

W7 — final wake-canon slice (A10 installer). Part of #892. Component-manifest install (`install.sh --component wake`), Gate-A path-ownership stays framework-manifest.txt SSOT (parity tests extended, bash+TS), mosaic-wake.service (long-lived detector daemon, no timer), blank-reset reset→verify→retire on legacy mosaic-heartbeat@ timer drop-ins (retire-LAST on --vector-passed), snapshot-guard (fail-closed reap), fail-closed install-validate of by-name HMAC key + alarm-sink target, plus the two #910 W6 monitor-integration items (monitor-side ingested_ts staleness + beacon HMAC-verify) as a separate additive commit. Additive diff; #869 install-ordering-guard untouched (19 tests green). Red-first I1-I6 + B11-B12; test:framework-shell rc=0.
jason.woltje added 2 commits 2026-07-26 03:14:59 +00:00
Framework install machinery for the wake component (EPIC #892 W7, the last
build slice). ADDITIVE per #869: adds an `install.sh --component wake` early
dispatch that never enters the full-framework sync, never alters
framework-manifest ownership behavior, and touches nothing the #869
install-ordering-guard covers (no runtime-asset linking, no lease-enforcement
hook wiring).

(i)   Idempotent component-manifest install + Gate A (wake-install.sh install):
      the wake manifest.txt is VERSION METADATA ONLY; the component file set is
      INTERSECTED-AND-VALIDATED against the single SSOT framework-manifest.txt.
      A candidate the SSOT does not own is REFUSED fail-closed with no partial
      write. Re-running writes zero files (no diff).
(ii)  systemd/user/mosaic-wake.service — the long-lived detector daemon
      (detector.sh run). Per-class SLO lives inside the daemon, not a systemd
      interval; it is a SERVICE not a timer, so blank-reset does not apply.
(iii) blank-reset idiom on the legacy mosaic-heartbeat@<agent>.timer cadence
      drop-in during the §5 overlap->retire lifecycle (empty OnUnitActiveSec=
      reset before the new value => exactly one OnUnitActiveUSec), with a
      reset->verify->retire acceptance path (retire LAST, only on §4-vector pass).
(iv)  snapshot-guard — a reap/clean-checkout of a deployed unit is REFUSED
      without a prior snapshot (the deployed-from-uncommitted failure class).
(v)   fail-closed alarm-target + HMAC-key install-validation (G1/G2a): the
      operator W6 alarm sink must be configured + reachable and the W3/W7 HMAC
      key must resolve BY NAME; missing/unreachable => FAIL LOUD. The installer
      ships/writes NO endpoint value and NO secret, and echoes neither.

Red-first harness test-wake-install.sh (6 groups) wired into test:framework-shell;
Gate-A parity extended to prove bash+TS both resolve the wake component paths
framework-owned. wake component manifest bumped 0.5.0 -> 0.6.0.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
feat(wake): W7 (vi) fold in W6 monitor-integration hardening in beacon.sh
Some checks failed
ci/woodpecker/pr/ci Pipeline failed
ce53b0e646
Separate, clearly-labeled commit for observation set (vi) from the #910 review.
The HMAC-verify half is a non-trivial blast radius (emit must sign, record must
verify-and-bind), so it is isolated here rather than expanding the installer diff.
Both changes are additive and backward-compatible (the legacy unsigned path and
emit_ts fallback are preserved when no key is configured).

(vi-a) Monitor-side ingested_ts: `record` stamps the monitor's own receive-time,
       and `check` computes staleness from ingested_ts (falling back to emit_ts
       only for a legacy record). A host shipping a far-future emit_ts to defer
       its own staleness can no longer fool the off-host dead-man clock.
(vi-b) Beacon HMAC-verify at record: when a key name is configured
       (WAKE_BEACON_HMAC_KEY_NAME / WAKE_HMAC_KEY_NAME), `emit` signs the beacon
       core via the existing sign.sh sign-digest path and `record` verifies via
       sign.sh verify AND binds the envelope to this beacon (content_hash ==
       sha256(core), seq/emit_ts match). A spoofed or unsigned beacon is REJECTED
       fail-loud and never advances the received clock. Key is by-name only —
       beacon.sh inlines no key material.

test-wake-beacon.sh extended with B11 (ingested_ts staleness) and B12 (HMAC-verify
+ spoof/unsigned rejection); test-wake-install.sh gains I7/I8 for the same
invariants. Both harnesses shown red-first under targeted mutation, then green.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
jason.woltje added 1 commit 2026-07-26 03:34:26 +00:00
Author
Owner

Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892)

VERDICT: APPROVE — GO on CI terminal-green. REVIEWED-HEAD (full-40): fe923a59775a541831fe4b24c1c357763f0f513a.

Review basis (substance carried + delta-re-review)

  • Substance review: independent subagent ac499d45 (opus, ≠ builder mosaic-coder) at prior head ce53b0e646fc231632187cf50a171ba764abff3aAPPROVE, all 9 criteria PASS, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + Gate A two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, no inlined secret/endpoint; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) #869 additive, install-ordering-guard untouched (19 green); (9) gates. 4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).
  • Delta-re-review (MS-LEAD, independent diff): ce53b0e..fe923a59 = exactly one commit, a 4-line change in test-wake-beacon.sh only — an if ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; fi guard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore the ac499d45 APPROVE carries. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); full test:framework-shell rc=0; shellcheck clean; firewall clean.

Trust-layer CI note (honest, tracked)

B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — consistent with the existing W3 digest-HMAC skip. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as issue #912 per Mos order.

Non-blocking follow-ups (reviewer)

(a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing SC2115 at install.sh:584 — untouched by this PR.

6-check — GO on CI terminal-green

  1. open/not-merged/mergeable base main ✓ · 2. CI terminal-green @ full-40 fe923a59775a541831fe4b24c1c357763f0f513a (pending — confirm green before stamp) · 3. reviewer(ac499d45)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all fe923a59 ✓ · 5. body Part of #892 (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.
    GO for id-11 + merge at FULL-40 fe923a59775a541831fe4b24c1c357763f0f513a on CI terminal-green. Non-executor.
# Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) **VERDICT: APPROVE** — GO on CI terminal-green. **REVIEWED-HEAD (full-40):** `fe923a59775a541831fe4b24c1c357763f0f513a`. ## Review basis (substance carried + delta-re-review) - **Substance review:** independent subagent `ac499d45` (opus, ≠ builder `mosaic-coder`) at prior head `ce53b0e646fc231632187cf50a171ba764abff3a` → **APPROVE, all 9 criteria PASS**, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + **Gate A** two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, **no inlined secret/endpoint**; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) **#869 additive, install-ordering-guard untouched (19 green)**; (9) gates. **4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).** - **Delta-re-review (MS-LEAD, independent diff):** `ce53b0e..fe923a59` = **exactly one commit, a 4-line change in `test-wake-beacon.sh` only** — an `if ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; fi` guard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore the `ac499d45` APPROVE **carries**. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); full `test:framework-shell` rc=0; shellcheck clean; firewall clean. ## Trust-layer CI note (honest, tracked) B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — **consistent with the existing W3 digest-HMAC skip**. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as **issue #912** per Mos order. ## Non-blocking follow-ups (reviewer) (a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing `SC2115` at install.sh:584 — untouched by this PR. ## 6-check — GO on CI terminal-green 1. open/not-merged/mergeable base main ✓ · 2. CI terminal-green @ full-40 `fe923a59775a541831fe4b24c1c357763f0f513a` **(pending — confirm green before stamp)** · 3. reviewer(`ac499d45`)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all `fe923a59` ✓ · 5. body `Part of #892` (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge. **GO for id-11 + merge at FULL-40 `fe923a59775a541831fe4b24c1c357763f0f513a` on CI terminal-green. Non-executor.**
Author
Owner

RoR #18986 SUPERSEDED — do NOT act on it. CI at fe923a59 FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain — test-wake-install.sh group I8 (signed beacon round-trip; shipped.json only materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO at fe923a59.

**RoR #18986 SUPERSEDED — do NOT act on it.** CI at `fe923a59` FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain — `test-wake-install.sh` group **I8** (signed beacon round-trip; `shipped.json` only materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO at fe923a59.
jason.woltje added 1 commit 2026-07-26 03:59:43 +00:00
Author
Owner

Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) — FINAL, CI-GREEN

VERDICT: APPROVE — GO. REVIEWED-HEAD (full-40): a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. CI: TERMINAL-GREEN at this exact head.

Review basis (substance carried + cumulative delta-re-review)

  • Substance: independent subagent ac499d05ac499d45 (opus, ≠ builder mosaic-coder) at ce53b0e646fc231632187cf50a171ba764abff3aAPPROVE, 9/9 criteria verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); #869 additive, install-ordering-guard untouched (19 green); 4 red-first reproduced RED→GREEN (I2/I4/B11/B12).
  • Cumulative delta-re-review (MS-LEAD, independent diff ce53b0e..a1bb73ca): exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern — fe923a59 (4 lines, test-wake-beacon.sh B12) + a1bb73ca (4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. The ac499d45 APPROVE carries.
  • Convergence proof: builder swept the whole wake suite — exactly 3 openssl/sign-dependent groups exist (digest-HMAC already guarded, B12, I8), ALL now guarded, no 4th. Builder ran the openssl-MASKED FULL-SUITE (1446 bins masked, command -v openssl verified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: terminal-green at a1bb73ca.

Trust-layer CI note (honest, tracked)

Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as issue #912 (pre-vector for §4 G6).

Non-blocking follow-ups

(a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks.

6-check — GO

  1. open/not-merged/mergeable base main ✓ · 2. CI TERMINAL-GREEN @ full-40 a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29 ✓ · 3. reviewer(ac499d45)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all a1bb73ca ✓ · 5. body Part of #892 (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.
    GO for id-11 + squash-merge at FULL-40 a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.
# Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) — FINAL, CI-GREEN **VERDICT: APPROVE — GO.** **REVIEWED-HEAD (full-40):** `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`. **CI: TERMINAL-GREEN** at this exact head. ## Review basis (substance carried + cumulative delta-re-review) - **Substance:** independent subagent `ac499d05`→`ac499d45` (opus, ≠ builder `mosaic-coder`) at `ce53b0e646fc231632187cf50a171ba764abff3a` → **APPROVE, 9/9 criteria** verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); **#869 additive, install-ordering-guard untouched (19 green)**; 4 red-first reproduced RED→GREEN (I2/I4/B11/B12). - **Cumulative delta-re-review (MS-LEAD, independent diff `ce53b0e..a1bb73ca`):** exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern — `fe923a59` (4 lines, test-wake-beacon.sh B12) + `a1bb73ca` (4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. **The `ac499d45` APPROVE carries.** - **Convergence proof:** builder swept the whole wake suite — exactly 3 openssl/sign-dependent groups exist (digest-HMAC already guarded, B12, I8), ALL now guarded, no 4th. Builder ran the **openssl-MASKED FULL-SUITE** (1446 bins masked, `command -v openssl` verified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: **terminal-green at a1bb73ca.** ## Trust-layer CI note (honest, tracked) Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as **issue #912** (pre-vector for §4 G6). ## Non-blocking follow-ups (a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks. ## 6-check — GO 1. open/not-merged/mergeable base main ✓ · 2. **CI TERMINAL-GREEN @ full-40 `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`** ✓ · 3. reviewer(`ac499d45`)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all `a1bb73ca` ✓ · 5. body `Part of #892` (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge. **GO for id-11 + squash-merge at FULL-40 `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.**
Mos approved these changes 2026-07-26 04:19:08 +00:00
Mos left a comment
First-time contributor

GO — Gate-16 id-11 stamp, pinned to exact FULL head a1bb73cab0.
Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.

GO — Gate-16 id-11 stamp, pinned to exact FULL head a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.
Mos merged commit 2378665eaf into main 2026-07-26 04:19:10 +00:00
Mos deleted branch feat/wake-w7-installer 2026-07-26 04:19:10 +00:00
Sign in to join this conversation.
No Reviewers
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#911