122 lines
11 KiB
Plaintext
122 lines
11 KiB
Plaintext
#1050 C1 ROUND 3 — REMOTE-ARM DOWNSTREAM SOURCE BINDING
|
|
|
|
IDENTITY / SCOPE
|
|
- branch: feat/1050-install-state-machine-red-fixture
|
|
- predecessor/provider lease pin: ff3f0d29f1763bed44a60610d073036112e66b77
|
|
- status language: believed-fixed, pending jarvis validation
|
|
- in scope: remote arm's mosaicstack/stack framework/source archive (#7)
|
|
- unchanged/fenced: expected-RED manifest including P6=FAIL; #869; #1068 sequencing
|
|
- corrected reference citation: the container-image acquisition path in fa-install.sh only
|
|
|
|
ACQUISITION-PATH CENSUS (10/10 CODE-READ; COMPLETE RUNTIME PATH CENSUS NOT MEASURED)
|
|
1. Woodpecker checkout at CI commit — fully constrained by intended CI identity.
|
|
2. node:22-bookworm-slim image — unpinned sibling, out of scope.
|
|
3. apt package set — unpinned sibling, out of scope.
|
|
4. tools/install.sh at CI_COMMIT_SHA + verified SHA-256 — fully constrained.
|
|
5. @mosaicstack/mosaic@next — P2 CLI value is authoritative; realised disagreement is detected at P3 — fully constrained at the top-level package version.
|
|
6. @mosaicstack/gateway@next — later re-resolution wins and is verified against itself; drift from the first value can be silently accepted — partially constrained TOCTOU sibling, out of scope.
|
|
7. stack framework/source archive — pre-fix internally pinned to WRONG identity 4df478cdd150fdf8d52ea109f02ade5d85017acd; post-fix bound to intended CI commit.
|
|
8. unversioned sequential-thinking npx package — unpinned sibling, out of scope.
|
|
9. Excalidraw dependency graph — shipped lockfile exact versions + registry integrity hashes — fully constrained by lock/integrity.
|
|
10. agent-skills default-branch clone — unpinned sibling, out of scope.
|
|
|
|
Post-fix mechanism breakdown: fully constrained 5/10 (#1,#4,#5,#7,#9); partially constrained 1/10 (#6); unpinned 4/10 (#2,#3,#8,#10). Same-CI stack payload hops moved from 1/2 to 2/2. The fix does not increase the number of constrained paths; it corrects #7 from wrong identity to intended identity. This census is a LOWER BOUND on defects and an UPPER BOUND on assurance: questioning revised the claimed assurance downward each time (blended 6/10 -> mechanism split -> 5 full + 1 partial + 4 unpinned), never upward.
|
|
|
|
#5/#6 RESOLUTION-FAILURE / TOCTOU DISPOSITION (CODE-READ; DISAGREEMENT INJECTION NOT MEASURED)
|
|
- P1 metadata failure blocks before mutation.
|
|
- Failed package install falls back to the one immutable stack archive resolved in P2; source resolution/fetch failure is fatal.
|
|
- #5 CLI: P2 RESOLVED_CLI_VERSION is authoritative; a later installed CLI mismatch is detected by P3 and rolls back.
|
|
- #6 gateway: no authoritative P2 gateway value is persisted. The last resolution in install_next_cli_from_registry wins and is compared with itself, so successful same-suffix gateway drift can be silently accepted. Reported, not fixed.
|
|
|
|
RED-FIRST — STALE NEXT REJECTED BEFORE ACQUISITION FIX
|
|
Command shape: exact ff3f0d2 installer URL/digest + expected source commit/digest, remote next lane.
|
|
- expected source commit: ff3f0d29f1763bed44a60610d073036112e66b77
|
|
- expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
|
|
- fixture rc: 1
|
|
- realised source commit: 4df478cdd150fdf8d52ea109f02ade5d85017acd
|
|
- realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
|
|
- source control: FAIL (realised != expected)
|
|
- P6 final fixture value: PASS (false pass from stale framework)
|
|
- forbidden evidence: CLI not found on PATH present
|
|
- comparator rc: 1; failures=8/checks=19
|
|
|
|
IMPLEMENTED PATH #7
|
|
- .woodpecker/greenfield-install.yml supplies MOSAIC_FIXTURE_SOURCE_COMMIT=${CI_COMMIT_SHA} while still invoking --lane next and --source remote.
|
|
- tools/e2e-install-test.sh validates 40-hex commit input, derives the exact commit archive URL, rejects failed/empty fetch, computes SHA-256 over that exact body, and passes the body/commit/digest through MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256}.
|
|
- The existing installer local-source seam re-hashes the body and rejects mismatch.
|
|
- The fixture verifies realised .install-manifest.json sourceCommit and sourceSha256 against the exact fetched body after installation. Mismatch exits before the phase comparator; there is no fallback to next.
|
|
|
|
EXACT-SOURCE REPRODUCIBILITY RESULT — N=5 IDENTICAL FINAL-TREE EXECUTIONS
|
|
Invariant inputs on every run:
|
|
- fixture mode: --lane next --source remote --git present
|
|
- installer/source commit: ff3f0d29f1763bed44a60610d073036112e66b77
|
|
- installer SHA-256: e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096
|
|
- realised source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
|
|
- resolved/realised CLI: @mosaicstack/mosaic@next = 0.0.50-next.2207
|
|
- fixture rc=1, P3 PASS, SOURCE-CONTROL PASS, installer_exit=1, done_claims=0, P6 FAIL, P9 FAIL
|
|
|
|
Per-run outcomes:
|
|
run 1: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
|
|
run 2: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
|
|
run 3: comparator rc=1; checks=18/19; dead_hooks=2; P6 reason=broker absent but dead enforcement hooks are active (count=2); elapsed=912s; load before=7.79 7.51 8.93; load after=12.28 14.82 11.79
|
|
run 4: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=938s; load before=12.28 14.82 11.79; load after=9.84 15.18 13.83
|
|
run 5: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=954s; load before=9.84 15.18 13.83; load after=3.94 4.76 8.18
|
|
|
|
Rate, not verdict:
|
|
- comparator rc=0: 4/5
|
|
- comparator rc=1: 1/5
|
|
- action-failure P6 reason: 4/5
|
|
- dead-hooks-active count=2 P6 reason: 1/5
|
|
- source commit/digest property: PASS 5/5
|
|
- P6 outcome property: FAIL 5/5
|
|
No comparator verdict is claimed. Identical source, digest, and package version produced different comparator values; this gate is nondeterministic on the #869 probe path. Load does not explain the small sample monotonically: run 4 had the highest observed 5/15-minute load but produced rc=0. The 2000ms capability-probe timeout remains a code-read hypothesis, NOT MEASURED as causal.
|
|
|
|
CHECKOUT CONTROL (EXECUTED, NOT PART OF REMOTE N=5)
|
|
The checkout-source arm independently produced: fixture rc=1; @next CLI 0.0.50-next.2207; P3 PASS; P6 FAIL with dead hooks active count=2; comparator rc=1 with the same 1/19 required-reason miss. This showed that outcome can occur independently of the remote #7 binding; its reproducibility was not separately measured.
|
|
|
|
PROPERTY / SIGNAL FINDING (MANIFEST UNCHANGED)
|
|
P6=FAIL remains the correct property and is unchanged. The comparator additionally pins one reason signal: "runtime linking/activation action reported a required failure". Exact-source P6 failed on all 5/5 runs, while the reason signal varied. The reason assertion was not widened to fit either observation.
|
|
|
|
#869 FINDING (BEHAVIOR EXECUTED; ROOT-CAUSE ATTRIBUTION CODE-READ)
|
|
Current @next now carries the lease capability. defaultSupervisorProbe treats bundled launcher+daemon file presence plus a nonempty resolved socket PATH as supervisor presence; it does not require the socket itself to exist. One of five identical clean broker-absent runs wired two dead hooks and let the linker exit zero; four reported the action failure. The 2000ms defaultCapabilityProbe subprocess timeout is a code-read candidate for the variance, NOT MEASURED as causal. Fixing this is #869 scope and was not performed.
|
|
|
|
TRUST BOUNDARY / INDEPENDENT PROVENANCE
|
|
The exact-commit archive URL binds source identity under the configured repository provider's authenticated mapping of commit ID to response bytes. The computed SHA-256 proves that the bytes executed are the bytes that exact URL served and that they did not change between fetch, installer consumption, and manifest verify-after. That is the measured control against stale-next substitution: SOURCE-CONTROL passed 5/5 exact-source runs and failed when R7 deleted the binding. The digest does NOT prove that those bytes are what the repository's authors published if the repository service or TLS trust root is compromised. Provider + TLS are the trust root by design. Independent signed provenance/authenticity remains an inherited deferral explicitly sourced to canonical greenfield-install PRD v2 §3, matching the already documented install.sh sidecar boundary. No stronger supply-chain claim is made. Codex security review's initial HIGH/CWE-494 finding is retained as the named trust-root deferral rather than bypassed or silently reclassified.
|
|
|
|
R7 DELETE-THE-SUBJECT MUTANT (EXECUTED)
|
|
Deleted the three MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256} binding exports from tools/e2e-install-test.sh temporarily while retaining the realised source assertion.
|
|
- fixture rc: 1
|
|
- realised source commit reverted to 4df478cdd150fdf8d52ea109f02ade5d85017acd
|
|
- expected source commit remained ff3f0d29f1763bed44a60610d073036112e66b77
|
|
- realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
|
|
- expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
|
|
- SOURCE-CONTROL: FAIL
|
|
- comparator rc: 1; failures=8/checks=19
|
|
- elapsed: 171s; load before=4.13 4.71 8.05; load after=4.94 4.58 7.42
|
|
- subject file SHA-256 before mutant: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
|
|
- subject file SHA-256 after restoration: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
|
|
|
|
EVIDENCE LOGS (LOCAL, NOT COMMITTED RAW TRANSCRIPTS)
|
|
- /tmp/c1-round3-red.log and /tmp/c1-round3-red-summary.txt
|
|
- /tmp/c1-round3-green.log and /tmp/c1-round3-green-summary.txt
|
|
- /tmp/c1-round3-green-comparator.log
|
|
- /tmp/c1-round3-checkout-control.log and /tmp/c1-round3-checkout-summary.txt
|
|
- /tmp/c1-round3-repro-n5.tsv and /tmp/c1-round3-repro-{3,4,5}.log
|
|
- /tmp/c1-round3-final-r7.log and /tmp/c1-round3-final-r7-summary.txt
|
|
|
|
BASELINES / INDEPENDENT REVIEW
|
|
- bash -n tools/e2e-install-test.sh: PASS
|
|
- shellcheck tools/e2e-install-test.sh: PASS
|
|
- invalid remote source commit control: rc=2, named 40-hex requirement
|
|
- pnpm test:installer: PASS
|
|
- pnpm typecheck: PASS, 45/45 tasks
|
|
- pnpm lint: PASS, 25/25 tasks
|
|
- pnpm format:check: PASS
|
|
- git diff --check: PASS
|
|
- Codex code review: APPROVE, confidence 0.92, 6 files, zero findings
|
|
- Initial Codex security review: HIGH/CWE-494 on independent provider-compromise provenance; retained and bounded explicitly in PRD/report as the canonical v2 §3 deferral
|
|
- Codex security re-review after trust-boundary documentation: risk NONE, confidence 0.96, 6 files, zero findings
|
|
|
|
PUSH / CI
|
|
Not yet recorded in this artifact. No CI polling is authorised after the single push.
|