[BUG] Ordinary development package cannot supply its startup profiling contract #69

New issue

Closed

opened 2026-09-21 21:05:02 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-21 21:05:02 +02:00

Owner

Summary

The maintained ordinary development package builds successfully but publishes no startup profiling contract. The required preflight rejects its image before QEMU starts, so the current coherent service graph cannot receive the maintained startup measurement. The refusal correctly preserves the source/feature boundary; it is not a reason to accept unproved images.

Reproduction

Use signed Integration dff878dd3545c4751b3c05d37b2bdd5e21cce548, its complete original catalog, selected Rust 1.97.1 tools and repository test signing fixtures. With the documented explicit native memory and filesystem tools selected, build a separate ordinary development package:

APPLIANCE_NAME=erix-terminal-startup scripts/package-dev-appliance.sh components.toml
scripts/build-disk-image.sh erix-terminal-startup
python3 -B -Werror scripts/startup_profile_contract.py preflight \
  --image out/appliance/erix-terminal-startup.img \
  --identity out/appliance/erix-terminal-startup.img.identity.json

Expected and actual behavior

Expected: the declared ordinary complete-service profiling configuration carries an original, artifact-bound feature/source contract, and preflight admits it before an unchanged bounded measurement. Unsupported faults, partial service selections and unproved metadata must still fail.

Actual: packaging reports startup profile contract: unavailable. The final media identity has no startup contract. Preflight exits 1 with admission failed (ValueError); process cleanup succeeds and no VM or observer starts.

Artifact inspection identifies two independent prerequisite gaps. Rootd includes rootd-integration-full-runtime-transition, automatically selected for runtime-fs by the maintained fixture builder, while ROOTD_FEATURES requires an exact set without it. The Kernel artifact has a feature_identity digest but no feature_set; its source_revision is integration-generated. The generic startup artifact intake therefore cannot establish its required effective feature/source evidence. A feature digest alone cannot replace the missing closure or original source proof.

Environment and identity

Original runner/catalog: Integration dff878dd3545c4751b3c05d37b2bdd5e21cce548.
Selected Rootd: 64c97b13c450003d9c2b6bd9ed2a627088684b46; Kernel: a9bdf6163813d378e0b4a164bceb839e24fbb6b7.
Ordinary development configuration, unchanged runtime service modes, selected Rust 1.97.1 on Linux x86-64; no authored fault or missing-service selection.
Image SHA-256: 6559dbcae35e3bf3c07cd489661e1ef012ab8d4ded1dff9e5b1a0f59fac42524.
Identity SHA-256: d962137f3c9a7d80a64778ff3c9d24092fffec76e06a9a920e7f809ae2fa8467.
Scope: private package and host preflight only. Last known working ordinary package with equivalent original provenance is not established.

Evidence and prior checks

Both original catalogs pass signed-source/manifest equality; all 169 maintained helper commands pass. The ordinary package and image build without warnings. Their original artifact metadata, identity bytes and actual failed preflight streams/status remain retained. The separate shell times, two-CPU inspection and out-of-session denial VMs pass under their existing limits, but those functional images intentionally lack the profiling contract and cannot substitute for this measurement.

Tracking

Reconcile the ordinary configuration only after reviewing its actual service-transition behavior. Produce and consume the Kernel's real effective feature and original source evidence, with malformed/mismatched and unsupported-profile controls. Do not remove a required transition, fabricate provenance, skip metadata checks or relax the 120/15/10 capture bounds or startup thresholds to obtain admission. Require a fresh actual admitted capture and preserve this rejected package and its original failure. Native external-toolchain rebuilding and both full EriX guest builds remain mandatory.

Signed startup source/feature correction — 21 September 2026:

Integration fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure.

All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; bug 71 retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices.

The technical manual update 76672dff8ff83 passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs 1001/1002 passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow.

A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under bug 69; no threshold or 120/15/10 capture limit changes. Original Integration 1705/1706 is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory.

Actual original-source startup capture — 21 September 2026:

Signed Integration fd8a5cf0dbcf builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance.

The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. The new canonical timing bug retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented.

The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded.

## Summary The maintained ordinary development package builds successfully but publishes no startup profiling contract. The required preflight rejects its image before QEMU starts, so the current coherent service graph cannot receive the maintained startup measurement. The refusal correctly preserves the source/feature boundary; it is not a reason to accept unproved images. ## Reproduction Use signed Integration `dff878dd3545c4751b3c05d37b2bdd5e21cce548`, its complete original catalog, selected Rust 1.97.1 tools and repository test signing fixtures. With the documented explicit native memory and filesystem tools selected, build a separate ordinary development package: ```sh APPLIANCE_NAME=erix-terminal-startup scripts/package-dev-appliance.sh components.toml scripts/build-disk-image.sh erix-terminal-startup python3 -B -Werror scripts/startup_profile_contract.py preflight \ --image out/appliance/erix-terminal-startup.img \ --identity out/appliance/erix-terminal-startup.img.identity.json ``` ## Expected and actual behavior Expected: the declared ordinary complete-service profiling configuration carries an original, artifact-bound feature/source contract, and preflight admits it before an unchanged bounded measurement. Unsupported faults, partial service selections and unproved metadata must still fail. Actual: packaging reports `startup profile contract: unavailable`. The final media identity has no startup contract. Preflight exits 1 with `admission failed (ValueError)`; process cleanup succeeds and no VM or observer starts. Artifact inspection identifies two independent prerequisite gaps. Rootd includes `rootd-integration-full-runtime-transition`, automatically selected for runtime-fs by the maintained fixture builder, while `ROOTD_FEATURES` requires an exact set without it. The Kernel artifact has a `feature_identity` digest but no `feature_set`; its `source_revision` is `integration-generated`. The generic startup artifact intake therefore cannot establish its required effective feature/source evidence. A feature digest alone cannot replace the missing closure or original source proof. ## Environment and identity - Original runner/catalog: Integration `dff878dd3545c4751b3c05d37b2bdd5e21cce548`. - Selected Rootd: `64c97b13c450003d9c2b6bd9ed2a627088684b46`; Kernel: `a9bdf6163813d378e0b4a164bceb839e24fbb6b7`. - Ordinary development configuration, unchanged runtime service modes, selected Rust 1.97.1 on Linux x86-64; no authored fault or missing-service selection. - Image SHA-256: `6559dbcae35e3bf3c07cd489661e1ef012ab8d4ded1dff9e5b1a0f59fac42524`. - Identity SHA-256: `d962137f3c9a7d80a64778ff3c9d24092fffec76e06a9a920e7f809ae2fa8467`. - Scope: private package and host preflight only. Last known working ordinary package with equivalent original provenance is not established. ## Evidence and prior checks Both original catalogs pass signed-source/manifest equality; all 169 maintained helper commands pass. The ordinary package and image build without warnings. Their original artifact metadata, identity bytes and actual failed preflight streams/status remain retained. The separate shell times, two-CPU inspection and out-of-session denial VMs pass under their existing limits, but those functional images intentionally lack the profiling contract and cannot substitute for this measurement. ## Tracking Related: [profiling implementation](https://git.erikinkinen.fi/erix/integration/issues/3), [required contract boundary](https://git.erikinkinen.fi/erix/integration/issues/34), [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), and [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Reconcile the ordinary configuration only after reviewing its actual service-transition behavior. Produce and consume the Kernel's real effective feature and original source evidence, with malformed/mismatched and unsupported-profile controls. Do not remove a required transition, fabricate provenance, skip metadata checks or relax the 120/15/10 capture bounds or startup thresholds to obtain admission. Require a fresh actual admitted capture and preserve this rejected package and its original failure. Native external-toolchain rebuilding and both full EriX guest builds remain mandatory. Signed startup source/feature correction — 21 September 2026: Integration [fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure. All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; [bug 71](https://git.erikinkinen.fi/erix/integration/issues/71) retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices. The technical manual update [76672dff8ff83](https://git.erikinkinen.fi/erix/docs/commit/76672dff8ff83b04914abe3c8f4b08b13835144f) passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs [1001](https://git.erikinkinen.fi/erix/docs/actions/runs/1001)/[1002](https://git.erikinkinen.fi/erix/docs/actions/runs/1002) passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow. A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under [bug 69](https://git.erikinkinen.fi/erix/integration/issues/69); no threshold or 120/15/10 capture limit changes. Original Integration [1705](https://git.erikinkinen.fi/erix/integration/actions/runs/1705)/[1706](https://git.erikinkinen.fi/erix/integration/actions/runs/1706) is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory. Actual original-source startup capture — 21 September 2026: Signed Integration [fd8a5cf0dbcf](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance. The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. [The new canonical timing bug](https://git.erikinkinen.fi/erix/integration/issues/72) retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented. The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded.

erikinkinen added the

labels

2026-09-21 21:05:02 +02:00

erikinkinen referenced this issue

2026-09-21 21:12:57 +02:00

[FEATURE] Freeze the complete source, build, ABI and self-hosting inventory #1

erikinkinen referenced this issue

2026-09-21 21:12:57 +02:00