[BUG] Refused staged creation retains parent receipts #15

New issue

Closed

opened 2026-09-15 11:56:41 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-15 11:56:41 +02:00

Owner

Summary

A refused staged-process construction could leave newly copied endpoint and VSpace receipts in the parent's capability inventory. The child was destroyed, but the output custody was not fully rolled back. The caller already holds process-creation authority; this repair removes residual outputs on failure and adds no endpoint permission.

Reproduction

The actual constructor regression on signed Kernel b98156427362a468ae78195a3582901e2474fea5 requests an already occupied install-grant destination with fresh endpoint and VSpace outputs. For the host fixture, use grant slot 1, parent endpoint slot 41, child endpoint slot 4, parent VSpace slot 60 and child window [0, 4096). Compare the complete parent inventory before and after the refused request. The included late_staged_creation_failure_preserves_parent_inventory test exercises this path and seven other early, middle, late or overlapping-output refusals.

Expected and actual behavior

Expected: rejection preserves every original caller binding, adds no parent receipt and restores the native VSpace count. Before repair, the rejected constructor left the copied endpoint and VSpace in the parent inventory; the regression ran one test and failed with Cargo status 101. The corrected native occupied-output result is BUSY, distinct from DENIED for the mandatory-root collision.

Environment and identity

The regression uses actual Kernel objects and dispatch, original signed dependencies, Rust 1.97.1 and warning-denied host/native configurations. Corrected Kernel: b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b. The actual CPL3 scenario uses the existing Process route, checks late grant-output refusal, then successfully creates and disposes a child through that retained route. No third-party system or private data was exercised.

Evidence and prior checks

The repair tracks each successful parent copy, destroys the failed child and disposes only those new receipts in reverse order. Pre-existing or overlapping output bindings are preserved. Eight host refusal cases now preserve exact inventory and VSpace counts. All 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds pass; three existing host ignores remain explicit. Both the expanded lifetime VM and unchanged owned-invocation VM pass with empty QEMU stderr and clean owned teardown. The original failure and the corrected Clippy, Markdown and validation-cancellation records are retained. Matching Kernel CI 566/567 passes with four complete warning-free logs.

Native creation rollback acceptance — 15 September 2026: Kernel b853d51cfb passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e26025668fa2a171b2c80017fd2b8bcb1924f passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Tracking

Repair source and regression are in Kernel review 3; matching catalog and native evidence are in Integration review 12. This is separate from the now-closed bootstrap slot collision. Close after matching Kernel CI evidence is complete. Full realm startup, seal, retirement and both full guest build generations remain open.

## Summary A refused staged-process construction could leave newly copied endpoint and VSpace receipts in the parent's capability inventory. The child was destroyed, but the output custody was not fully rolled back. The caller already holds process-creation authority; this repair removes residual outputs on failure and adds no endpoint permission. ## Reproduction The actual constructor regression on signed Kernel `b98156427362a468ae78195a3582901e2474fea5` requests an already occupied install-grant destination with fresh endpoint and VSpace outputs. For the host fixture, use grant slot 1, parent endpoint slot 41, child endpoint slot 4, parent VSpace slot 60 and child window [0, 4096). Compare the complete parent inventory before and after the refused request. The included `late_staged_creation_failure_preserves_parent_inventory` test exercises this path and seven other early, middle, late or overlapping-output refusals. ## Expected and actual behavior Expected: rejection preserves every original caller binding, adds no parent receipt and restores the native VSpace count. Before repair, the rejected constructor left the copied endpoint and VSpace in the parent inventory; the regression ran one test and failed with Cargo status 101. The corrected native occupied-output result is BUSY, distinct from DENIED for the mandatory-root collision. ## Environment and identity The regression uses actual Kernel objects and dispatch, original signed dependencies, Rust 1.97.1 and warning-denied host/native configurations. Corrected Kernel: `b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b`. The actual CPL3 scenario uses the existing Process route, checks late grant-output refusal, then successfully creates and disposes a child through that retained route. No third-party system or private data was exercised. ## Evidence and prior checks The repair tracks each successful parent copy, destroys the failed child and disposes only those new receipts in reverse order. Pre-existing or overlapping output bindings are preserved. Eight host refusal cases now preserve exact inventory and VSpace counts. All 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds pass; three existing host ignores remain explicit. Both the expanded lifetime VM and unchanged owned-invocation VM pass with empty QEMU stderr and clean owned teardown. The original failure and the corrected Clippy, Markdown and validation-cancellation records are retained. Matching Kernel CI 566/567 passes with four complete warning-free logs. Native creation rollback acceptance — 15 September 2026: Kernel b853d51cfb36c2fbc81eb565b7d2fc3ab731de2b passes 649/673 default/all tests, strict host/native development/release Clippy, private rustdoc, formatting and ten native builds, with three existing ignores. Matching CI 566/567 passes with four complete warning-free logs. Integration 3c4e26025668fa2a171b2c80017fd2b8bcb1924f passes both actual native VMs with empty QEMU stderr and clean teardown. The lifetime fixture now includes seven creation/refusal/disposal calls alongside the thirteen installation calls; the existing owned-invocation oracle is preserved. Integration Rust/helper sources are unchanged and retain their completed 320/321-test strict matrix and all 162 helper results; changed native catalog inputs have fresh policy and VM checks. Full Integration CI 1627/1628 remains pending. Typed grant-return provisioning, independently constrained bootstrap authority before mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. The code inventory covers 76 repositories and 2959 files below 1000 lines; all 158 scanned Rust roots enforce missing_docs. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ## Tracking Repair source and regression are in [Kernel review 3](https://git.erikinkinen.fi/erix/kernel/pulls/3); matching catalog and native evidence are in [Integration review 12](https://git.erikinkinen.fi/erix/integration/pulls/12). This is separate from the now-closed [bootstrap slot collision](https://git.erikinkinen.fi/erix/lib-capabi/issues/3). Close after matching Kernel CI evidence is complete. Full realm startup, seal, retirement and both full guest build generations remain open.

erikinkinen

2026-09-15 11:56:41 +02:00