Experiment formal owner fixture final docs plan 02 - kmosoti/FabricO11y GitHub Wiki
Constructor final documentation re-pin
PROSPECTIVE NOT RUN. C063 source cells at cleanb16 finished0/stopped:5focused and22complete packaging/payload tests, with native transformation still not run. Those source/test bytes are exactly unchanged at clean 902b1ecbc0d4baaa554659b8c4083d7db0e03554. The only new commit902 moves the owned historical CURRENT result paragraph into the wiki and replaces it with prospective behavior/link; unrelated historical CURRENT lines untouched. The previous three docs commands were NOT RUN, not failures.
Main de77 is a verified ancestor; no rebase/history rewrite.
Default serial16/20GiB/swap0/1800s/full1GiB and fresh95GB complete namespace census each. Same pinned DATA-only Bun dependency view and inner PATH/cache env. Failure stop/post/no silent rerun. No native/package/Cargo/guest. Driver SHA256 f6c753b5f406ac47951853c44ab16a5983e6e66923f9b815762e253e93a00dd4.
python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/run-step-owner-fixture-final-docs-02.py owner-fixture-final-docs-check-02 1073741824 env PATH=/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0:/usr/local/bin:/usr/bin:/bin BUN_INSTALL_CACHE_DIR=/run/media/kmosoti/data/FabricO11y/tools/docs-bun-cache /run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0/bun tools/docs/check.mjs
python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/run-step-owner-fixture-final-docs-02.py owner-fixture-final-docs-tests-02 1073741824 env PATH=/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0:/usr/local/bin:/usr/bin:/bin BUN_INSTALL_CACHE_DIR=/run/media/kmosoti/data/FabricO11y/tools/docs-bun-cache /run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0/bun tools/docs/check.test.mjs
python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/run-step-owner-fixture-final-docs-02.py owner-fixture-final-docs-hooks-02 1073741824 env PATH=/run/media/kmosoti/data/FabricO11y/tools/bun-1.4.0:/usr/local/bin:/usr/bin:/bin BUN_INSTALL_CACHE_DIR=/run/media/kmosoti/data/FabricO11y/tools/docs-bun-cache python3 -B tools/docs/test_hooks.py
Doc-only diff:
diff --git a/docs/CURRENT.md b/docs/CURRENT.md
index 71095b4..9dfc50a 100644
--- a/docs/CURRENT.md
+++ b/docs/CURRENT.md
@@ -94,7 +94,7 @@ interrupted registry checks retain partial output without a completion receipt
These results belong to the candidates they name; none qualifies the release.
- **Console reproducibility.** Separate console builds of one commit differed in four files because ImageMagick stamped time metadata into the generated icons ([#55](https://github.com/kmosoti/FabricO11y/issues/55)). Icons are now generated with `-strip`, and console and package builds refuse a PNG with time or text metadata (`CX-CONSOLE-ICON-TIMESTAMP`). The owner chose to fix this before release, so the `a5dbda7` packages are superseded: a new candidate is frozen and rebuilt from two separate console builds, and its gates rerun. Results on `a5dbda7` packages remain recorded for that candidate only.
-- **Owner walkthrough tooling.** The [prospective protocol](experiments/formal/owner-walkthrough-protocol.md) uses exact candidate bytes with strictly older native fixture metadata. The original 22 failures on `f98a3bf` included four incorrect positive-mock setup refusals; those four did not reproduce archive escape. With only that mock corrected, `4e58b94` reproduced four escaped archive exceptions (exit 1, confirmed stop). Corrected focused controls (four methods) and broad packaging/payload controls (17 tests) on `ea7ba174` exited 0 with confirmed stop; the [constructor record](https://github.com/kmosoti/FabricO11y/wiki/Experiment-formal-owner-fixture-constructor-plan) retains the distinct receipts and raw log hashes. Descendant cleanup and parent-signal controls, native transformation and the fresh owner walkthrough remain pending. No deployment qualification follows from these unit controls.
+- **Owner walkthrough tooling.** The [prospective protocol](experiments/formal/owner-walkthrough-protocol.md) binds exact candidate bytes, strictly older native fixture metadata, complete payload/header/dependency identities, bounded owned command groups and explicit interrupted closeout receipts. Revision-bound source checks and retained counterexamples belong in the [constructor source record](https://github.com/kmosoti/FabricO11y/wiki/Experiment-formal-owner-fixture-source-results-01). Native fixture transformation, final merged guide pins and the fresh owner walkthrough remain pending.
- **Service-opening repair.** Frozen `ca84d982` failed Debian lifecycle `rel-deb-life-01`: required `RestrictSUIDSGID=yes` denied `openat2`, and the dedicated Spindle/server exited. The [failure record](https://github.com/kmosoti/FabricO11y/wiki/Experiment-formal-installation-release-run-02) retains exact packages and guest controls. A descriptor-relative `openat` walk replaces that syscall without relaxing hardening or link refusal. Its native child-filter regression failed before the repair (exit 101) and passed after; eleven Linux security tests passed, including pinned-parent replacement and exact error propagation. The [amendment](experiments/formal/service-log-opening-protocol.md) registers the checks. PR #53 merged with six commits preserved. Frozen `a5dbda7a4fd6465c94f6505b3214cbcbc2130c82` was rebuilt reproducibly with matching console assets; matching main Rust/security and identical-tree PR extended evidence passed. [Exact installation run 03](experiments/formal/installation-release-run-03.md) passed four fresh positive cells and detected all six package controls on Debian 13/Fedora 44. Old candidate failures remain failed; this does not qualify deployment or authenticated UI behavior.
- **Readiness continuation.** The [continuation](experiments/formal/readiness-continuation-results.md) completed the combined builder campaign, recovery/shutdown checks, dependency policy and finite [installation acceptance](experiments/formal/installation-acceptance-run-02.md). The [full companion-compatible R2 soak](experiments/benchmarks/soak-run-02.md) passed all ten gates. The [normal writer](experiments/formal/bounded-writer-default-run-01.md) passed 27 unflagged bounded tests, 13 kill cuts plus no-hit, and loaded-binary equivalence; all 17 final fast checks and three manual documentation checks passed on that revision.
Exact driver:
import datetime, hashlib, json, os, re, signal, subprocess, sys, time
from pathlib import Path
ROOT = Path('/run/media/kmosoti/data/FabricO11y')
REPO = ROOT / 'scratch/owner-walkthrough-harness'
OUT = ROOT / 'results/service-opening-candidate'
STORE = ROOT / 'scratch/service-opening-census'
FROZEN = '902b1ecbc0d4baaa554659b8c4083d7db0e03554'
def require(value, reason):
if not value:
raise ValueError(reason)
label, reserve_text, *command = sys.argv[1:]
reserve = int(reserve_text)
delegated = command[:1] == ['--delegate']
if delegated: command = command[1:]
require(re.fullmatch(r'[a-z0-9-]{1,80}', label) and reserve > 0 and command, 'ordinary workload admission guard')
record_path = OUT / (label + '.json')
require(not record_path.exists(), 'unique run label required')
def census():
# Rootless container files can belong to subordinate UIDs. Inspect all of
# them in the same user namespace; never skip unreadable directories.
require(not STORE.is_symlink(), 'ordinary workload admission guard')
require((STORE / '.owned-census-store').read_text() == 'service-opening-census-v1\n', 'ordinary workload admission guard')
args = ['podman', '--root', str(STORE/'graph'), '--runroot', str(STORE/'run'),
'--tmpdir', str(STORE/'tmp'), '--storage-driver', 'vfs',
'unshare', 'python3', '-B', str(OUT/'census.py')]
env = dict(os.environ, TMPDIR=str(STORE/'tmp'), TMP=str(STORE/'tmp'), TEMP=str(STORE/'tmp'))
result = subprocess.run(args, env=env, text=True, capture_output=True, timeout=25)
if result.returncode:
raise RuntimeError(f'strict namespace census failed ({result.returncode}): {result.stderr}')
observed = json.loads(result.stdout)
require(observed['uid'] == 0 and observed['gid'] == 0, 'ordinary workload admission guard')
require(type(observed['data_bytes']) is int and observed['data_bytes'] >= 0, 'ordinary workload admission guard')
return observed
def git(*args):
return subprocess.check_output(['git', *args], cwd=REPO, text=True).strip()
require(git('rev-parse', 'HEAD') == FROZEN and not git('status', '--porcelain'), 'clean frozen source required')
require(not subprocess.check_output(['systemctl', '--user', 'list-units', 'fabric-work-*', '--state=running', '--plain', '--no-legend'], text=True).strip(), 'another project workload is active')
initial = census()
used = initial['data_bytes']
record = {'label': label, 'command': command, 'delegated': delegated, 'frozen': None, 'scope': 'harness controls only; no candidate acceptance evidence', 'harness_revision': FROZEN, 'source_status_before': git('status', '--porcelain'), 'storage_root': str(ROOT), 'admission_bytes': used, 'admission_observation': initial, 'reserved_bytes': reserve, 'observations': [], 'started_utc': datetime.datetime.now(datetime.timezone.utc).isoformat()}
if used + reserve > 95_000_000_000:
record.update(state='not_run', reason='95 GB storage admission threshold')
record_path.write_text(json.dumps(record, indent=2)+'\n')
raise SystemExit('storage admission denied; project command not launched')
receipts = REPO / 'target/resource-containment/runs'
before = set(receipts.glob('*.json'))
env = dict(os.environ, FABRIC_STORAGE_ROOT=str(ROOT), CARGO_HOME=str(ROOT/'toolchain-cache/cargo'), RUSTUP_HOME=str(ROOT/'toolchain-cache/rustup'), CARGO_BUILD_JOBS='2')
env['PATH'] = str(ROOT/'tools/candidate-dpkg/bin') + ':' + env['PATH']
log_path = OUT / (label + '.log')
record.update(state='running', log=str(log_path))
record_path.write_text(json.dumps(record, indent=2)+'\n')
def find_unit():
with log_path.open() as stream:
prefix = stream.read(65536)
match = re.search(r'Running as unit: (fabric-work-[0-9a-f]+)\.service', prefix)
return match.group(1) if match else None
def stop_owned(process):
unit = find_unit()
if unit:
stopped = subprocess.run(['systemctl', '--user', 'stop', unit],
text=True, capture_output=True, timeout=25)
record['stop'] = {'unit': unit, 'exit': stopped.returncode, 'stderr': stopped.stderr}
if stopped.returncode:
# Interrupt the launcher too; its finally block independently
# confirms that this exact service has no surviving descendants.
process.send_signal(signal.SIGINT)
else:
process.send_signal(signal.SIGINT)
record['stop'] = {'unit': None, 'launcher_interrupted': True}
with log_path.open('wb') as log:
launcher = ['python3', '-B', 'tools/resource_group.py', *(['--delegate'] if delegated else []), '--', *command]
process = subprocess.Popen(launcher, cwd=REPO, env=env, stdout=log, stderr=subprocess.STDOUT)
next_census = time.monotonic() + 30
try:
while process.poll() is None:
time.sleep(1)
if time.monotonic() >= next_census:
observed = census()
record['observations'].append({'unix':time.time(), **observed})
record_path.write_text(json.dumps(record, indent=2)+'\n')
if observed['data_bytes'] >= 95_000_000_000:
record['interruption'] = '95 GB threshold reached'
break
next_census = time.monotonic() + 30
except BaseException as error:
record['interruption'] = f'{type(error).__name__}: {error}'
finally:
if record.get('interruption') and process.poll() is None:
try:
stop_owned(process)
except BaseException as error:
record['stop_error'] = f'{type(error).__name__}: {error}'
process.send_signal(signal.SIGINT)
status = process.wait()
record['launcher_exit'] = status
if record.get('interruption'): status = 2
with log_path.open('rb') as stream:
log_digest = hashlib.file_digest(stream, 'sha256').hexdigest()
record.update(state='interrupted' if record.get('interruption') else 'completed', exit=status, source_status_after=git('status', '--porcelain'), finished_utc=datetime.datetime.now(datetime.timezone.utc).isoformat(), log_sha256=log_digest, resource_receipts=[])
archive = OUT/'resource-containment'; archive.mkdir(exist_ok=True)
for p in sorted(set(receipts.glob('*.json')) - before):
value=json.loads(p.read_text())
if value['command'] != command: continue
q=archive/p.name; q.write_bytes(p.read_bytes())
record['resource_receipts'].append({'path':str(q),'sha256':hashlib.sha256(q.read_bytes()).hexdigest(),'exit':value['exit'],'stop_confirmed':value['stop_confirmed'],'retained_failure_evidence':value['retained_failure_evidence']})
if not record['resource_receipts'] or any(not r['stop_confirmed'] or r['exit'] != status for r in record['resource_receipts']):
record['receipt_error'] = 'missing or inconsistent outer resource receipt'
status = 2
record['exit'] = status
record_path.write_text(json.dumps(record, indent=2)+'\n')
print(json.dumps(record, indent=2))
if status: print(log_path.read_text()[-8000:])
raise SystemExit(status)