[BUG] Startup collector accepts images without the required readiness and shell contract #34

New issue

Open

opened 2026-09-12 22:15:18 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 22:15:18 +02:00

Owner

Summary

Startup performance capture can accept an explicitly selected image whose compiled Rootd policy cannot provide the required startup contract. Image bytes and an identity sidecar are insufficient to establish that the image emits all completed-service barriers, final readiness and an initial shell.

A retained original-source audit confirms this incompatibility for a development-labelled image built with only rootd-runtime. The unchanged oracle correctly requires all 30 service barriers; it must not be weakened. The defect is accepting this unsupported image/observer pairing before launch.

Reproduction

This is a source-and-receipt finding, not a new VM reproduction. Inspect these selected original inputs:

Integration 381bccd87c5632e9d1af8aa9d0aca295cbc00e1f, tests/dev-image-startup-vm.sh: the optional source-image argument is accepted when the image and identity sidecar are readable. The wrapper hashes/copies those inputs and starts observation; it does not validate a source-bound shell/readiness contract.
The same revision's scripts/assert-startup-performance.py requires exactly one of every named Rootd service barrier in order, final ERIX_ROOTD:READY, an exact prompt, and successful native input.
Rootd ac3c1847af9915164d4a819f5f15e1827884e8b1 was actually compiled for x86_64-unknown-none with --cfg feature="rootd-runtime", without rootd-integration-policy or rootd-product-shell. The recorded compiler exited 0.
Its selected lib-bootstrap fc8c68556c9f347b1bf08232a27050875bce0bbb exposes a product marker selector containing only SERIALD and FBCOND. Rootd's selected product adapter also disables the final marker and compiles its post-ready initial-shell policy to a no-op.

The retained local capture used a separately reviewed bounded coordinator around the same original observer/runner/oracle recipe. Its preflight accepted the image and the guest was launched. The maintained startup wrapper itself was not replayed during this audit; its corresponding lack of semantic preflight is established by source inspection.

Expected and actual behavior

Expected: before starting a VM, the collector verifies an explicit, source-bound image contract covering all required completed-service barriers, final readiness and the selected shell/input route. An image without that contract is rejected as unsupported. The complete original oracle and all deadlines remain intact.

Actual source-selected behavior:

The oracle requires all 30 ERIX_ROOTD:READY:<service> records, in order between root launch and final readiness. The selected product marker function can return only the SERIALD/FBCOND pair; the other 28 barriers are absent from that normal path.
emit_terminal_ready_stamp_policy returns false in the selected product adapter, disabling final ERIX_ROOTD:READY.
With rootd-product-shell absent, product_shell.rs and initial_exsh.rs are excluded, and run_post_ready_shell_policy does not call the initial Exsh launcher. Merely passing orchestration metadata as --extern does not enable that cfg branch.
The reviewed Launchd startup initializes empty job/transaction state and enters its request dispatcher; the reviewed Procd runtime also receives requests. Those paths do not supply an automatic replacement for the excluded Rootd initial-shell launch.
The selected identity sidecar records development naming/profile and program-loader presence, but no full-barrier or initial-shell capability contract. The collector does not reject this mismatch before launching.

This is an unsupported measurement configuration, not an oracle false pass. The actual retained guest stopped earlier at a silence deadline, before the oracle ran. This static incompatibility does not explain that stall or establish how the guest would behave after it.

Environment and identity

Selected Integration build/capture tooling: 381bccd87c5632e9d1af8aa9d0aca295cbc00e1f.
Rootd: ac3c1847af9915164d4a819f5f15e1827884e8b1; lib-bootstrap: fc8c68556c9f347b1bf08232a27050875bce0bbb.
Original input image: 138,412,032 bytes, SHA-256 70f144f91b36536e4a9a9e7b2fe06272bb8aa47ea7a007664c0501d070878cd8. Its 73-node product manifest SHA-256 is 87fb22258a5ffa843dfa8a79c3348a4960d78742ef4f89c561a078989afdff0a; the separate product Integration node is 2efa2fc7122dc459649630b0baa736981e0a4bfc.
The selected build invoked scripts/package-appliance.sh directly with RUNTIME_CONFIG_PROFILE=dev, RUNTIME_IMAGE_TEST_HARNESS=0 and KERNEL_ROOTD_TEST=runtime. The recorded Rust compiler was rustc 1.93.0 (254b59607 2026-01-19); its Rootd invocation selected only rootd-runtime.
This is distinct from the maintained scripts/package-dev-appliance.sh route, which explicitly selects RUNTIME_IMAGE_TEST_HARNESS=1, initial Exsh launch and interactive escalation. The audit does not claim that every canonical development image lacks the required markers or shell.
No introducing commit, last-known-working image pairing, new guest run or frequency estimate is established by this source-only audit.

Evidence and prior checks

The exact Rootd compiler receipt has SHA-256 6926e0ac9af17282143f936abf37fc49c7f979abdbc38c82e55cd39fa1bc1f5d; its selected source and cfg arguments were inspected alongside original Git objects.

Relevant source boundaries are Integration's startup wrapper and complete oracle; Rootd src/main.rs, src/bootstrap_authority/product_adapter.rs and src/bootstrap.rs; and lib-bootstrap src/readiness.rs. These show the selector mismatch independently of transient guest progress. No source was changed, no test or compiler was run, and no guest or failed capture was replayed for this audit.

A future compatible profiling image needs an explicit barrier contract and a supported initial-shell route whose source/configuration is bound to the image identity. Enabling broad scenario behavior solely to obtain marker strings is not evidence of an equivalent product workload. Preserve the 30-barrier ordering and current limits: 5 seconds root-to-final, 1 second per completed-service gap, 1 second final-to-full-caret, and 2 seconds total for all four native commands.

Signed 2604971484facb4910d8f030818dc01f83e57816 now implements the host-side correction in PR #12. A separate package receipt binds actual expanded features, encoded/effective runtime configuration and selected original Rootd/policy/bootstrap source. Final image identity binds that receipt to disk size/hash. The wrapper validates the source image before evidence/observer/runner startup and rechecks the private writable copy. Unsupported admission does not prohibit an ordinary custom package build. The receipt is a local configuration assertion, not publisher authentication, complete compiler provenance or a boot guarantee.

The final source-correlated host cohort passes 102 distinct warning-denied Python cases plus existing cache/media shell fixtures, syntax/workflow checks and the selected Markdown set. An original-source omission control fails as expected. The first proxy-fixture error and timer-error precedence corrections remain retained with their affected passing continuations. Tests cover missing/inconsistent contracts, actual package identity, original-source selection and failure/cleanup behavior. The full 30-barrier ordering, final readiness, exact caret/native-command endpoint and existing 5/1/1/2-total-second limits remain unchanged.

Push CI 1585 and PR CI 1586 are pending. No current package/image compiler cohort or VM capture has been replayed locally. Keep this issue open until the actual coordinated image path and complete regression results validate the correction; the earlier silence failure remains separately unresolved.

The matching manual/API checkpoint is signed and pushed as Docs 8c61739fae1b1dc14939f54c2d66fe66a8846f05 in Docs PR #4. It includes five public memory API routes from the original signed lib-cstd Rustdoc JSON and documents the packaged startup contract. All 44 documentation tests, 55 Markdown files and the complete 2321-page local manual pass, with zero final warnings and all 419417 word boxes within page bounds; eight pages pass actual visual review. Both Docs push CI 825 and PR CI 826 pass at the exact signed revision: each completes 44 documentation tests, 55 Markdown files and a 2321-page manual with zero final-pass warnings. All four complete logs (747776 bytes) are source-correlated. Thirty diagnostics per manual belong to earlier convergence passes; CI PDF bytes and geometry were not independently inspected. This documentation result does not establish native-image or full self-hosted build acceptance.

Tracking

Coordinate with startup profiling work (#3) and Integration PR #12. The separate observed pre-shell silence failure is #33; this report does not assign its cause or close it.

Host admission and negative oracle coverage now pass as recorded above. Actual compatible-image build/capture and current CI remain required before closure.

## Summary Startup performance capture can accept an explicitly selected image whose compiled Rootd policy cannot provide the required startup contract. Image bytes and an identity sidecar are insufficient to establish that the image emits all completed-service barriers, final readiness and an initial shell. A retained original-source audit confirms this incompatibility for a development-labelled image built with only `rootd-runtime`. The unchanged oracle correctly requires all 30 service barriers; it must not be weakened. The defect is accepting this unsupported image/observer pairing before launch. ## Reproduction This is a source-and-receipt finding, not a new VM reproduction. Inspect these selected original inputs: 1. Integration `381bccd87c5632e9d1af8aa9d0aca295cbc00e1f`, `tests/dev-image-startup-vm.sh`: the optional source-image argument is accepted when the image and identity sidecar are readable. The wrapper hashes/copies those inputs and starts observation; it does not validate a source-bound shell/readiness contract. 2. The same revision's `scripts/assert-startup-performance.py` requires exactly one of every named Rootd service barrier in order, final `ERIX_ROOTD:READY`, an exact prompt, and successful native input. 3. Rootd `ac3c1847af9915164d4a819f5f15e1827884e8b1` was actually compiled for `x86_64-unknown-none` with `--cfg feature="rootd-runtime"`, without `rootd-integration-policy` or `rootd-product-shell`. The recorded compiler exited 0. 4. Its selected lib-bootstrap `fc8c68556c9f347b1bf08232a27050875bce0bbb` exposes a product marker selector containing only SERIALD and FBCOND. Rootd's selected product adapter also disables the final marker and compiles its post-ready initial-shell policy to a no-op. The retained local capture used a separately reviewed bounded coordinator around the same original observer/runner/oracle recipe. Its preflight accepted the image and the guest was launched. The maintained startup wrapper itself was not replayed during this audit; its corresponding lack of semantic preflight is established by source inspection. ## Expected and actual behavior Expected: before starting a VM, the collector verifies an explicit, source-bound image contract covering all required completed-service barriers, final readiness and the selected shell/input route. An image without that contract is rejected as unsupported. The complete original oracle and all deadlines remain intact. Actual source-selected behavior: - The oracle requires all 30 `ERIX_ROOTD:READY:<service>` records, in order between root launch and final readiness. The selected product marker function can return only the SERIALD/FBCOND pair; the other 28 barriers are absent from that normal path. - `emit_terminal_ready_stamp_policy` returns false in the selected product adapter, disabling final `ERIX_ROOTD:READY`. - With `rootd-product-shell` absent, `product_shell.rs` and `initial_exsh.rs` are excluded, and `run_post_ready_shell_policy` does not call the initial Exsh launcher. Merely passing orchestration metadata as `--extern` does not enable that cfg branch. - The reviewed Launchd startup initializes empty job/transaction state and enters its request dispatcher; the reviewed Procd runtime also receives requests. Those paths do not supply an automatic replacement for the excluded Rootd initial-shell launch. - The selected identity sidecar records development naming/profile and program-loader presence, but no full-barrier or initial-shell capability contract. The collector does not reject this mismatch before launching. This is an unsupported measurement configuration, not an oracle false pass. The actual retained guest stopped earlier at a silence deadline, before the oracle ran. This static incompatibility does not explain that stall or establish how the guest would behave after it. ## Environment and identity - Selected Integration build/capture tooling: `381bccd87c5632e9d1af8aa9d0aca295cbc00e1f`. - Rootd: `ac3c1847af9915164d4a819f5f15e1827884e8b1`; lib-bootstrap: `fc8c68556c9f347b1bf08232a27050875bce0bbb`. - Original input image: 138,412,032 bytes, SHA-256 `70f144f91b36536e4a9a9e7b2fe06272bb8aa47ea7a007664c0501d070878cd8`. Its 73-node product manifest SHA-256 is `87fb22258a5ffa843dfa8a79c3348a4960d78742ef4f89c561a078989afdff0a`; the separate product Integration node is `2efa2fc7122dc459649630b0baa736981e0a4bfc`. - The selected build invoked `scripts/package-appliance.sh` directly with `RUNTIME_CONFIG_PROFILE=dev`, `RUNTIME_IMAGE_TEST_HARNESS=0` and `KERNEL_ROOTD_TEST=runtime`. The recorded Rust compiler was `rustc 1.93.0 (254b59607 2026-01-19)`; its Rootd invocation selected only `rootd-runtime`. - This is distinct from the maintained `scripts/package-dev-appliance.sh` route, which explicitly selects `RUNTIME_IMAGE_TEST_HARNESS=1`, initial Exsh launch and interactive escalation. The audit does not claim that every canonical development image lacks the required markers or shell. - No introducing commit, last-known-working image pairing, new guest run or frequency estimate is established by this source-only audit. ## Evidence and prior checks The exact Rootd compiler receipt has SHA-256 `6926e0ac9af17282143f936abf37fc49c7f979abdbc38c82e55cd39fa1bc1f5d`; its selected source and cfg arguments were inspected alongside original Git objects. Relevant source boundaries are Integration's startup wrapper and complete oracle; Rootd `src/main.rs`, `src/bootstrap_authority/product_adapter.rs` and `src/bootstrap.rs`; and lib-bootstrap `src/readiness.rs`. These show the selector mismatch independently of transient guest progress. No source was changed, no test or compiler was run, and no guest or failed capture was replayed for this audit. A future compatible profiling image needs an explicit barrier contract and a supported initial-shell route whose source/configuration is bound to the image identity. Enabling broad scenario behavior solely to obtain marker strings is not evidence of an equivalent product workload. Preserve the 30-barrier ordering and current limits: 5 seconds root-to-final, 1 second per completed-service gap, 1 second final-to-full-caret, and 2 seconds total for all four native commands. Signed `2604971484facb4910d8f030818dc01f83e57816` now implements the host-side correction in PR #12. A separate package receipt binds actual expanded features, encoded/effective runtime configuration and selected original Rootd/policy/bootstrap source. Final image identity binds that receipt to disk size/hash. The wrapper validates the source image before evidence/observer/runner startup and rechecks the private writable copy. Unsupported admission does not prohibit an ordinary custom package build. The receipt is a local configuration assertion, not publisher authentication, complete compiler provenance or a boot guarantee. The final source-correlated host cohort passes 102 distinct warning-denied Python cases plus existing cache/media shell fixtures, syntax/workflow checks and the selected Markdown set. An original-source omission control fails as expected. The first proxy-fixture error and timer-error precedence corrections remain retained with their affected passing continuations. Tests cover missing/inconsistent contracts, actual package identity, original-source selection and failure/cleanup behavior. The full 30-barrier ordering, final readiness, exact caret/native-command endpoint and existing 5/1/1/2-total-second limits remain unchanged. [Push CI 1585](https://git.erikinkinen.fi/erix/integration/actions/runs/1585) and [PR CI 1586](https://git.erikinkinen.fi/erix/integration/actions/runs/1586) are pending. No current package/image compiler cohort or VM capture has been replayed locally. Keep this issue open until the actual coordinated image path and complete regression results validate the correction; the earlier silence failure remains separately unresolved. The matching manual/API checkpoint is signed and pushed as Docs `8c61739fae1b1dc14939f54c2d66fe66a8846f05` in [Docs PR #4](https://git.erikinkinen.fi/erix/docs/pulls/4). It includes five public memory API routes from the original signed lib-cstd Rustdoc JSON and documents the packaged startup contract. All 44 documentation tests, 55 Markdown files and the complete 2321-page local manual pass, with zero final warnings and all 419417 word boxes within page bounds; eight pages pass actual visual review. Both Docs [push CI 825](https://git.erikinkinen.fi/erix/docs/actions/runs/825) and [PR CI 826](https://git.erikinkinen.fi/erix/docs/actions/runs/826) pass at the exact signed revision: each completes 44 documentation tests, 55 Markdown files and a 2321-page manual with zero final-pass warnings. All four complete logs (747776 bytes) are source-correlated. Thirty diagnostics per manual belong to earlier convergence passes; CI PDF bytes and geometry were not independently inspected. This documentation result does not establish native-image or full self-hosted build acceptance. ## Tracking Coordinate with [startup profiling work (#3)](https://git.erikinkinen.fi/erix/integration/issues/3) and [Integration PR #12](https://git.erikinkinen.fi/erix/integration/pulls/12). The separate observed pre-shell silence failure is [#33](https://git.erikinkinen.fi/erix/integration/issues/33); this report does not assign its cause or close it. Host admission and negative oracle coverage now pass as recorded above. Actual compatible-image build/capture and current CI remain required before closure.

erikinkinen added the

performance

bug

phase-6

labels

2026-09-12 22:15:18 +02:00

~~erikinkinen referenced this issue 2026-09-12 22:17:56 +02:00~~

WIP: Coordinate native authority, shell workspace and source transport #12

~~erikinkinen referenced this issue from erix/docs 2026-09-13 00:15:30 +02:00~~

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue

2026-09-21 21:05:02 +02:00