[BUG] Bootstrap authority audit omits terminal acknowledgement call #7
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/rootd#7
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
The production bootstrap authority audit still expects one fallible native control call in the cleanup adapter. Separate terminal acknowledgement adds a second legitimate call there, so both original CI runs fail the exact source-consumer inventory despite the Rust suites passing.
Reproduction
At Rootd
e6c0e23171f6cd862925877da15454c20052b57b, runpython3 -B -Werror -m unittest discover -s tests -p '*_test.py'with the CI-selected immutable Integration boundary helpers. Original CI 1039 and CI 1040 each reproduce the failure; neither has been rerun.Expected and actual behavior
Expected: the source audit accounts for native destruction and separate terminal acknowledgement, while still allowing temporary Process custody only in the declared bootstrap cleanup consumers.
Actual:
test_temporary_process_transport_consumers_are_source_exactobserves twokernel_process_control_call_allow_resultoccurrences insrc/kernel_control_ipc/process_cleanup.rs, but its expected count remains one. Each Python suite passes 63 of 64 tests and exits 1 before the later production-boundary and semantic audit steps. The native route restriction itself remains enforced by the runtime and Rust controls.Environment and identity
e6c0e23171f6cd862925877da15454c20052b57b, feature branch, original push and pull-request runs 1039/1040.Evidence and prior checks
All four complete original logs are retained with verified lengths and SHA256 hashes, totaling 205,180 bytes with zero warning candidates. Four local Rust configurations pass 430/429 tests, native builds, strict Clippy and private rustdoc. The local matrix omitted the separate Python source-audit suite; the corrected validation must include the entire CI boundary and semantic audit sequence.
Tracking
Related: terminal-accounting design, Rootd WIP PR, and Phase 6 completion.
Update the exact expected cleanup call count and independently assert the complete acknowledgement consumer set. Preserve temporary-route denial, run all 64 Python controls and subsequent production/semantic gates, and monitor new original corrected-source CI before closing this regression. Do not weaken the authority boundary or retry the unchanged failing runs.
Committed terminal-accounting consumers — 21 September 2026:
Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.
Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.
Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.
The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.
No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.