jason.woltje
068d868a99
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
8.7 KiB
Row 178 round 2
Dewey comment 29374 / rev 2145 and Sage sage-1194 govern this round.
Reopened with rocko-178-start-2, rev 2146. R1 packet stays unchanged in the
parent directory, candidate e8f7a258. Tests were prepared on a757f8fe6 and rebased onto 931651f2d after row 181 landed.
C1: render guard coverage
The existing service refusal test adds five independent cases, each requiring exit 1 and empty stdout:
- Y8 header grammar: bad_header with a valid owned mode-0600 fixture.
- Y3 auth collision: X-User proof header against x-user auth, other-case match.
- Y4 absolute path: relative(process.cwd(), file) points to that same existing outside-repository fixture. Removing only the absolute check can render it.
- Y5 charset: a real owned fixture with a space in its outside-repository path.
- Y2 owner: an id stand-in at the front of the child's PATH prints uid+1 for -u and execs /usr/bin/id otherwise. Actual ownership never changes. The stub is removed in finally before the original unsafe-mode case, so the owner check cannot mask that case.
All other metadata is valid for each new guard case. No product change is needed. The original 18 mutants plus Y2/Y3/Y4/Y5/Y8 and Y6 are prepared (24 total), each with its focused killing pattern. All 24 were killed in the final r2 run below.
N2: empty header presence
proof.test.mjs adds a loopback request with the configured proof header present but empty, no auth header, and asserts 403. Y6 makes the wrong-Host fence test the first value's truthiness; only that new case catches the empty value bypass.
N1: activation and rollback order
The separately approved activation window must re-pin the stack to a copy that contains row 178 before the Console unit receives either proof flag. Traefik's proof middleware must also be in place before those flags are enabled. Drop the proof flags before any stack rollback. stack-release preserves P_CONSOLE, so the operator's window plan owns keeping pointer and effective unit flags consistent during those steps. This packet changes no live pointer, unit, proof slot or middleware, and does not run any activation step. Same-uid readers remain outside the partial fix; Jason owns service-uid separation.
Verification scope
Sage granted the r2 slot in sage-1203: all four touched test files singly, the original mutants plus the five C1 sites and the N2 site, and the two fixture baselines. Sage owns the full landing gate. The initial busy filter matched long-running seat/service nodes and stopped the && chain before any runner. sage-1205 authorized counting node --test runners and gate/mutant scripts only; the narrowed check returned CLEAR before the first run. Other seats and live processes were untouched. TMPDIR stays in scratch; DOCKER_HOST is the dead unix:///nonexistent.sock. No Docker or live configuration action.
Rebase onto row 181 (sage-1197)
Base: 931651f2d, containing row 181 landing ef48597d0. The only conflict was
both rows appending packages/cli/tests/stack-release.test.mjs: preserved all
row-181 COUNTED and STORE_JS/count tests unchanged, then appended T178's two
proof flag lifecycle tests. scripts/stack-release.sh and docs/TOOLS.md applied
cleanly. The source diff against the new base adds only row 178's two-line
proof preservation comment; COUNTED, count/heldcount, total/text parsing,
in-run recount and rollback refusal logic stay byte-identical to row 181.
TOOLS.md keeps row 181's restore-count instructions and appends the unchanged
row-178 proof notes. No product behavior differs from r1 except the new base.
Pre-run candidate manifest: 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6 (regenerated after verification if needed). Stable patch-id: 88e56a8a3afd2a6638e448ac99f7b7fd2f87e15e. All final runs below use this rebased tree.
Final run table
Granted by sage-1203 and narrowed busy filter approved by sage-1205. Exact
date -u span: 2026-10-20T05:04:01Z through 2026-10-20T05:08:46Z.
Each file ran singly, exit 0; no package or shell suite run is claimed here.
| Run | Passed | Failed | Skipped | Evidence |
|---|---|---|---|---|
| proof.test.mjs | 4 | 0 | 0 | proof.log |
| proof-cli.test.mjs | 3 | 0 | 0 | proof-cli.log |
| service.test.mjs | 31 | 0 | 0 | service.log |
| stack-release.test.mjs, including row 181 | 118 | 0 | 0 | stack-release.log |
| awk sum | 156 | 0 | 0 | focused-counts.txt |
The inotify render-no-open probe passed (no open/read events); the fixture-only
sandbox probe passed for pi and claude-code, with the container mount source
check. Neither probe reads the real config or a real proof file, and no Docker
runtime proof is claimed. process-sweep.json is empty. No runner remained at
slot return. No infrastructure flake, timeout, cancelled test or survivor.
Review checks and killers
- C1 / Y8: service.test.mjs:782, bad_header; exit 1 and empty stdout.
- C1 / Y3: service.test.mjs:783, X-User against x-user; same assertions.
- C1 / Y4: service.test.mjs:784, existing fixture by relative path; same assertions.
- C1 / Y5: service.test.mjs:785, real outside fixture with a space; same assertions.
- C1 / Y2: service.test.mjs:789-795, fixture id reports another uid; same assertions.
- N2 / Y6: proof.test.mjs:68, empty proof on loopback gives 403.
The original 18 sites and all six additions were re-preflighted exact-once and
run individually, with isolated process groups and whole-group timeout cleanup.
Each failed with exit 1; no invalid or timed-out mutant counts as a kill.
mutant-sites.json names each exact edit and killing test pattern.
| Mutant | Status | Killing file / pattern |
|---|---|---|
| M01-auth-before-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / refuses missing wrong short |
| M02-wrong-equal-length | killed (exit 1) | packages/webui/tests/proof.test.mjs / refuses missing wrong short |
| M03-missing-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / refuses missing wrong short |
| M04-loopback-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / header is refused on other Hosts |
| M05-mode-0644 | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / startup refuses |
| M06-log-refusal | killed (exit 1) | packages/webui/tests/proof.test.mjs / refuses missing wrong short |
| M07-no-follow | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / startup refuses |
| M08-owner | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / startup refuses |
| M09-line-bytes | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / startup refuses |
| M10-duplicate-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / refuses missing wrong short |
| M11-tester-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / header is refused on other Hosts |
| M12-main-wiring | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / CLI applies proof |
| M13-tester-wiring | killed (exit 1) | packages/webui/tests/proof-cli.test.mjs / CLI applies proof |
| M14-service-location | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| M15-service-propagation | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render carries |
| M16-release-preservation | killed (exit 1) | packages/cli/tests/stack-release.test.mjs / T178 proxy proof header |
| M17-render-no-open | killed (exit 1) | render-no-open.py / |
| M18-proof-send-status | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof status |
| Y2-render-owner | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| Y3-render-auth-collision | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| Y4-render-absolute-path | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| Y5-render-path-charset | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| Y8-render-header-grammar | killed (exit 1) | packages/webui/tests/service.test.mjs / proxy proof render refuses |
| Y6-empty-loopback-proof | killed (exit 1) | packages/webui/tests/proof.test.mjs / header is refused on other Hosts |
Final candidate manifest SHA-256:
9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6.
Stable patch-id: 88e56a8a3afd2a6638e448ac99f7b7fd2f87e15e.
All 11 manifest paths reconstruct from base plus build.patch. The row-164
human/channel proof files and pins are byte-identical to the base.
The path/basename and base/candidate 64-hex searches cover 308 package test and
shell reader files; see reader-and-pin-search.json and rg-64hex-pins.txt.
origin/refactor advanced to d1272e714 during the run; only SESSIONS, a plans
brief, chat.mjs and chat.test.mjs changed since the required base, none of the
11 candidate paths. No rebase of the reviewed shared paths is pending.