[FEATURE] Audit authority, code quality and documentation in logd #1

New issue

Open

opened 2026-09-12 07:57:56 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:57:56 +02:00

Owner

Problem and motivation

This issue tracks continuous Phase 6 audit closure for logd. Validate log startup/IPC, retain records and enforce console-mirror policy through explicit endpoints.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Current inventory: 1 Cargo target (1 bin); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Original coherent realm runtime prerequisites — 18 September 2026: Signed a3cc7a06beefdb604d1b372ec7fdeb9def0356ec selects original shared dependency revisions. All 20 host/native output-policy configurations pass 43/45/59/62/133/138 tests per configuration and 20 native builds, including separate release logging, serial and framebuffer combinations. Formatting, strict host/native Clippy, private rustdoc and Markdown pass with zero warnings. Direct Rust implementation bytes are unchanged. Original CI is under observation. Matching catalogs, source-bound consumer VMs, complete realm operation and both full guest builds remain required.

Original coherent realm source CI acceptance — 18 September 2026: Signed a3cc7a06beefdb604d1b372ec7fdeb9def0356ec passes CI 236 and CI 235. All four terminal logs are complete (631,831 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Tracking and rollout

Production output configuration validation — 15 September 2026

Signed bc15238f25f818a28fe51b249e2db33f667c4599 passes the complete warning-denied host/native matrix: default and runtime/logging configurations each pass 43 tests, serial-only 59, framebuffer/all-feature 133, release-only/release+logging 45, release+serial 62, and release+framebuffer 138, in both development and release profiles. All twenty native builds, strict host/native Clippy, formatting, private host/native rustdoc and documentation checks pass. Earlier failures are retained. Push/review CI 233/234 passes with complete classified logs and no final warnings. Product catalog and runtime-image adoption remain separate. Review: #4.

Parent work: erix/integration#2 and erix/docs#1.
Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
Baseline revision: a543fe17624a5fada001851706821ad82ebf27f1; refresh component/dependency heads and their own CI evidence as implementation advances.
Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

Coherent dependency checkpoint — 20 September 2026: signed/pushed commit e54d56ee3de36ea9d4490fd93558abfdf4c1f4de aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 43/133-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 237/238 passes with four complete hashed logs (631,829 bytes), zero warning candidates.

Full catalog equality and actual consumer-image validation remain required under Integration regression 68. The broader work remains tracked by phase completion, including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance.

Original CI observation — 21 September 2026: run 239 passes. Run 240 has now failed at original source 651024dd6956012697af1d1cafaf28950dacfa82; Forgejo returns HTTP 500 for both terminal test and Markdown job logs. The original failure and unavailable responses are retained. Cause, complete logs and warning classification remain unresolved; no restart or passing-regression claim is made.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `logd`. Validate log startup/IPC, retain records and enforce console-mirror policy through explicit endpoints. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope Current inventory: 1 Cargo target (1 bin); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Original coherent realm runtime prerequisites — 18 September 2026: Signed `a3cc7a06beefdb604d1b372ec7fdeb9def0356ec` selects original shared dependency revisions. All 20 host/native output-policy configurations pass 43/45/59/62/133/138 tests per configuration and 20 native builds, including separate release logging, serial and framebuffer combinations. Formatting, strict host/native Clippy, private rustdoc and Markdown pass with zero warnings. Direct Rust implementation bytes are unchanged. Original CI is under observation. Matching catalogs, source-bound consumer VMs, complete realm operation and both full guest builds remain required. Original coherent realm source CI acceptance — 18 September 2026: Signed `a3cc7a06beefdb604d1b372ec7fdeb9def0356ec` passes [CI 236](https://git.erikinkinen.fi/erix/logd/actions/runs/236) and [CI 235](https://git.erikinkinen.fi/erix/logd/actions/runs/235). All four terminal logs are complete (631,831 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. ## Tracking and rollout ### Production output configuration validation — 15 September 2026 Signed `bc15238f25f818a28fe51b249e2db33f667c4599` passes the complete warning-denied host/native matrix: default and runtime/logging configurations each pass 43 tests, serial-only 59, framebuffer/all-feature 133, release-only/release+logging 45, release+serial 62, and release+framebuffer 138, in both development and release profiles. All twenty native builds, strict host/native Clippy, formatting, private host/native rustdoc and documentation checks pass. Earlier failures are retained. Push/review CI 233/234 passes with complete classified logs and no final warnings. Product catalog and runtime-image adoption remain separate. Review: https://git.erikinkinen.fi/erix/logd/pulls/4. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `a543fe17624a5fada001851706821ad82ebf27f1`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images. Coherent dependency checkpoint — 20 September 2026: signed/pushed commit [e54d56ee3de36ea9d4490fd93558abfdf4c1f4de](https://git.erikinkinen.fi/erix/logd/commit/e54d56ee3de36ea9d4490fd93558abfdf4c1f4de) aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 43/133-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 237/238 passes with four complete hashed logs (631,829 bytes), zero warning candidates. Full catalog equality and actual consumer-image validation remain required under [Integration regression 68](https://git.erikinkinen.fi/erix/integration/issues/68). The broader work remains tracked by [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65), including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance. Original CI observation — 21 September 2026: [run 239](https://git.erikinkinen.fi/erix/logd/actions/runs/239) passes. [Run 240](https://git.erikinkinen.fi/erix/logd/actions/runs/240) has now failed at original source `651024dd6956012697af1d1cafaf28950dacfa82`; Forgejo returns HTTP 500 for both terminal test and Markdown job logs. The original failure and unavailable responses are retained. Cause, complete logs and warning classification remain unresolved; no restart or passing-regression claim is made.

erikinkinen added the

labels

2026-09-12 07:57:56 +02:00

erikinkinen referenced this issue from erix/integration

2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from ~~[FEATURE] [P02.R58] Audit authority, code quality and documentation in logd~~ to [FEATURE] Audit authority, code quality and documentation in logd

2026-09-12 08:02:34 +02:00

erikinkinen referenced this issue

2026-09-15 18:16:36 +02:00

[BUG] Release-image retry test uses a suppressed record #2

erikinkinen referenced this issue

2026-09-15 18:28:53 +02:00

[BUG] Production output configurations fail strict builds #3

erikinkinen referenced this issue

2026-09-15 18:45:10 +02:00

WIP: Validate production logging configurations #4

erikinkinen referenced this issue from erix/integration

2026-09-19 11:36:52 +02:00