[BUG] Process start must propagate grant census errors #18

New issue

Open

opened 2026-09-19 15:18:03 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-19 15:18:03 +02:00

Owner

Summary

The process-start dispatcher treated a failed install-grant census as an empty
census. This is a defensive failure-policy defect demonstrated by a hosted
control. Normal bootstrap initializes tracking fallibly before admitting root
services; production reachability or an observed native authority escape is
not established. The correction requires a successful absence result before
starting a staged child and preserves existing error precedence.

Reproduction

The regression controls in Kernel
b762e19d0c16acd605d0f6123994a586cc6fcde1 exercise actual native object tables
and the real dispatcher with the shared serial test guard:

cargo test --locked --lib unavailable_grant_census
cargo test --locked --lib process_start_requires_actual_install_grant_disposal

These controls pass on the correction. The new unavailable-census control was
also run once against the unchanged dispatcher from
bd127228f62cd5320e87642e79aa7c1cd8212e24; it failed with Cargo status 101.
That comparison adds hosted fault setup and is not an unchanged production
checkout or native runtime reproduction. No runtime fault-injection entry
point is added.

Expected and actual behavior

Expected: an unavailable census returns the existing RETRY response and leaves
the entire staged child, startup registers and grant ownership unchanged.
A definite live grant still returns DENIED. Actual grant disposal permits
ordinary start; malformed target validation retains its earlier precedence.

Original hosted observation: the start request returned OK instead of RETRY.
The narrow correction propagates the existing census error. A separate initial
test assertion mistakenly expected INVALID_ARGUMENT for an absent but valid-width
target; that test failure is retained. Existing product error mapping stays
unchanged, and the reconciled control uses a malformed target width.

Environment and identity

Original Kernel: bd127228f62cd5320e87642e79aa7c1cd8212e24.
Signed correction: b762e19d0c16acd605d0f6123994a586cc6fcde1.
Linux x86_64 hosted controls, Rust 1.97.1, original pinned dependencies.
The test caller already holds native process-control authority.
Matching signed Integration: b65183ddb93eb4396d4140a002c3727fec42ff87.
Native scenario: appliance-disk-image-realm-preparation-positive, unchanged
120-second hard deadline and 45-second progress watchdog.
Earliest affected revision and a prior working revision are not established.

Evidence and prior checks

Four strict development/release, default/all-feature matrices pass 704/728
library tests and two standalone controls each. Three existing ignored tests
remain ignored. Formatting, strict host/native Clippy, private rustdoc and
thirteen native build/Clippy profiles pass without warnings.
Original Kernel CI 606
and 607 pass; all four
complete hashed logs total 739,843 bytes with no warnings.

The matching guarded-preparation VM passes without build warnings. All 106
appliance artifacts and the complete 55,776-byte serial log are retained;
all 73 original component revisions and the actual signed image are verified.
This VM validates normal staging and retirement, not the hosted unavailable
census condition. Integration's original full CI remains under observation.

Tracking

Owning audit #2,
Kernel PR #3,
Integration PR #12 and
phase completion.
Keep this bounded defect distinct from complete mediator execution, full frame
proof, upstream toolchain rebuilding and both full EriX builds inside EriX.
The correction and focused checks pass; original consumer regression CI remains
required before closing the tracking issue.

## Summary The process-start dispatcher treated a failed install-grant census as an empty census. This is a defensive failure-policy defect demonstrated by a hosted control. Normal bootstrap initializes tracking fallibly before admitting root services; production reachability or an observed native authority escape is not established. The correction requires a successful absence result before starting a staged child and preserves existing error precedence. ## Reproduction The regression controls in Kernel `b762e19d0c16acd605d0f6123994a586cc6fcde1` exercise actual native object tables and the real dispatcher with the shared serial test guard: ```sh cargo test --locked --lib unavailable_grant_census cargo test --locked --lib process_start_requires_actual_install_grant_disposal ``` These controls pass on the correction. The new unavailable-census control was also run once against the unchanged dispatcher from `bd127228f62cd5320e87642e79aa7c1cd8212e24`; it failed with Cargo status 101. That comparison adds hosted fault setup and is not an unchanged production checkout or native runtime reproduction. No runtime fault-injection entry point is added. ## Expected and actual behavior Expected: an unavailable census returns the existing RETRY response and leaves the entire staged child, startup registers and grant ownership unchanged. A definite live grant still returns DENIED. Actual grant disposal permits ordinary start; malformed target validation retains its earlier precedence. Original hosted observation: the start request returned OK instead of RETRY. The narrow correction propagates the existing census error. A separate initial test assertion mistakenly expected INVALID_ARGUMENT for an absent but valid-width target; that test failure is retained. Existing product error mapping stays unchanged, and the reconciled control uses a malformed target width. ## Environment and identity - Original Kernel: `bd127228f62cd5320e87642e79aa7c1cd8212e24`. - Signed correction: `b762e19d0c16acd605d0f6123994a586cc6fcde1`. - Linux x86_64 hosted controls, Rust 1.97.1, original pinned dependencies. - The test caller already holds native process-control authority. - Matching signed Integration: `b65183ddb93eb4396d4140a002c3727fec42ff87`. - Native scenario: `appliance-disk-image-realm-preparation-positive`, unchanged 120-second hard deadline and 45-second progress watchdog. - Earliest affected revision and a prior working revision are not established. ## Evidence and prior checks Four strict development/release, default/all-feature matrices pass 704/728 library tests and two standalone controls each. Three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original [Kernel CI 606](https://git.erikinkinen.fi/erix/kernel/actions/runs/606) and [607](https://git.erikinkinen.fi/erix/kernel/actions/runs/607) pass; all four complete hashed logs total 739,843 bytes with no warnings. The matching guarded-preparation VM passes without build warnings. All 106 appliance artifacts and the complete 55,776-byte serial log are retained; all 73 original component revisions and the actual signed image are verified. This VM validates normal staging and retirement, not the hosted unavailable census condition. Integration's original full CI remains under observation. ## Tracking Owning [audit #2](https://git.erikinkinen.fi/erix/kernel/issues/2), [Kernel PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration PR #12](https://git.erikinkinen.fi/erix/integration/pulls/12) and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Keep this bounded defect distinct from complete mediator execution, full frame proof, upstream toolchain rebuilding and both full EriX builds inside EriX. The correction and focused checks pass; original consumer regression CI remains required before closing the tracking issue.

erikinkinen added the

security

bug

phase-6

labels

2026-09-19 15:18:03 +02:00

erikinkinen referenced this issue

2026-09-19 15:19:30 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue

2026-09-19 15:19:31 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2