[BUG] Attenuated installer handoff changes the managed return slot #4
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/procd#4
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
The attenuated installer handoff changes its source slot, but later TTY provisioning still requires the managed installer slot. Initial shell launches stop with uncertain disposition after service readiness.
Reproduction
Run the maintained
appliance-disk-image-initial-exsh-start-exit-positivescenario with Integrationf9681efc30f1c48989def7f0e7db939974a30e27and its original selected sources. The same initial-shell disposition marker occurs in 57 scenarios in each original CI run 1695 and 1696.Expected and actual behavior
Expected: the final GRANT-only installer passes through Loaderd and Launchd and returns to the exact managed slot expected by Procd's TTY receipt checks; the staged child starts and exits normally.
Actual: staged materialization derives the final installer into the disposed VSpace receipt slot and forwards that source slot. TTY receipt validation and provisioning both require
grant_slot_for_managed_slot. The selected source therefore has a concrete slot-contract mismatch. Both CI runs emitERIX_ROOTD:INITIAL_EXSH:DISPOSITION_UNCERTAIN; 23 affected scenarios per run also retain Launchd exit status0xB1, whose source mapping isPeerCallError::InvalidWire. The slot mismatch is established from source; corrected full VM evidence is still required to establish the runtime fix.Environment and identity
1c80383afe1460f8d250472284225670f893937c.f9681efc30f1c48989def7f0e7db939974a30e27, original full catalogs.Evidence and prior checks
Integration CI 1695 passes 431/489 scenarios; CI 1696 passes 430/489. All six complete logs were retained and hashed: 32,723,390 bytes, zero warning candidates. Rust and Markdown jobs and full dependency equality pass. Other failures remain separately classified; no unchanged CI rerun or relaxed watchdog is used.
The prior Procd unit fixture checked that the transfer matched its own response but did not assert agreement with the later managed-slot receipt contract. Add that regression plus unique relocation and partial-failure custody checks, then validate the maintained full-service scenario.
Tracking
Phase 6 completion, Procd feature issue, installer authority design. Catalog equality correction is tracked separately in Integration issue 68.
Installer return-slot regression — 21 September 2026:
Both original corrected-catalog runs are now classified: 1695 passes 431/489 VM scenarios and 1696 passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch issue 68 is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in issue 20.
Procd bug 4 records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce in WIP PR 2 derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open.
Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required.
Verified managed installer recovery — 21 September 2026:
Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.
Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.
The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd
10d972b652; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.
Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.