Conversation
…e receipt One executable harness (ADR §6 S7) running this repo's legs of the programme's acceptance line: rename, duplicate identity, repeated request, response loss, rollback — target/history identity preserved end to end. Vacuous-match guard: a -run pattern matching zero tests fails the leg. Receipt table recorded in AUDIT_OPEN.
…tion (flock + generation fencing + protocol outcomes) internal/targetguard: a POSIX helper (guard.sh, embedded) uploaded over SSH and invoked to run ONE protected effect under an OS-exclusive flock with generation fencing, plus the Go wrapper mapping its first-line protocol to typed outcomes (ErrBusy retryable; ErrFenced = stale plan, reconcile never blind-retry per D11; ErrTargetUnfit fail-closed). The helper self-tests the lock primitive once per app dir (marker under the lock) and refuses (GUARD_UNFIT) if the target's flock does not serialize — a falsely-held lock is worse than none. Outcome rides stdout's first line because the ssh Executor abstraction does not preserve exit codes. LIVE PROOF (podman, 2026-09-23, debian bookworm-slim + alpine 3.20): serialization timestamped ABAB (one full critical section then the other's — the investigation initially read ABAB as interleaving; the inverted harness evaluation was caught and corrected, the timestamped runs are the evidence); fencing refuses gen-7-committed vs plan-expects-3 with the effect untouched; killed helper auto-releases (post-death effect OK); current generation passes. The busybox util-linux FILE-form non-portability observations motivated the self-test hardening. Linux CI tests (guard_linux_test.go, gated) pin the same invariants with the corrected serialized signature; wrapper semantics pinned on every platform. NEXT SLICE (recorded in _internal): integrate guarded effects into the deploy path (state commit + predecessor retirement under the guard; .generation sidecar written by the state commit) and the acquisition-order doc for the shared-proxy commit lock.
…rness lesson + slice-2 remainder)
…rface (Close/Host/User/RunStream/RunInput) The linux-gated test file is invisible to macOS go vet, so the interface miss only surfaced in CI (sync PR #11). GOOS=linux go vet/build now part of the local pre-push check for this package.
im-tyler
added a commit
that referenced
this pull request
Sep 23, 2026
* feat(scripts): X02 S7 — acceptance sweep harness + AUDIT_OPEN evidence receipt One executable harness (ADR §6 S7) running this repo's legs of the programme's acceptance line: rename, duplicate identity, repeated request, response loss, rollback — target/history identity preserved end to end. Vacuous-match guard: a -run pattern matching zero tests fails the leg. Receipt table recorded in AUDIT_OPEN. * feat(targetguard): C01-1 slice 1 — on-demand target-side critical section (flock + generation fencing + protocol outcomes) internal/targetguard: a POSIX helper (guard.sh, embedded) uploaded over SSH and invoked to run ONE protected effect under an OS-exclusive flock with generation fencing, plus the Go wrapper mapping its first-line protocol to typed outcomes (ErrBusy retryable; ErrFenced = stale plan, reconcile never blind-retry per D11; ErrTargetUnfit fail-closed). The helper self-tests the lock primitive once per app dir (marker under the lock) and refuses (GUARD_UNFIT) if the target's flock does not serialize — a falsely-held lock is worse than none. Outcome rides stdout's first line because the ssh Executor abstraction does not preserve exit codes. LIVE PROOF (podman, 2026-09-23, debian bookworm-slim + alpine 3.20): serialization timestamped ABAB (one full critical section then the other's — the investigation initially read ABAB as interleaving; the inverted harness evaluation was caught and corrected, the timestamped runs are the evidence); fencing refuses gen-7-committed vs plan-expects-3 with the effect untouched; killed helper auto-releases (post-death effect OK); current generation passes. The busybox util-linux FILE-form non-portability observations motivated the self-test hardening. Linux CI tests (guard_linux_test.go, gated) pin the same invariants with the corrected serialized signature; wrapper semantics pinned on every platform. NEXT SLICE (recorded in _internal): integrate guarded effects into the deploy path (state commit + predecessor retirement under the guard; .generation sidecar written by the state commit) and the acquisition-order doc for the shared-proxy commit lock. * docs: AUDIT_OPEN — C01-1 slice 1 receipt (live-proven invariants + harness lesson + slice-2 remainder) * fix(targetguard): localExecutor implements the full ssh.Executor interface (Close/Host/User/RunStream/RunInput) The linux-gated test file is invisible to macOS go vet, so the interface miss only surfaced in CI (sync PR #11). GOOS=linux go vet/build now part of the local pre-push check for this package. * fix(targetguard): export TEPLOY_DEPLOYMENTS_ROOT in the linux test harness (VAR=x; cmd does not export in dash) * fix(targetguard): CI-runner hardening — per-invocation harness scripts, once-only upload, GUARD_-scan protocol parse Two real CI findings: (1) concurrent goroutines raced the shared run.sh/ guard upload paths (unique per-invocation scripts + sync.Once upload); (2) bash job-control prints a 'Killed' notice to stdout before the protocol line when the effect is SIGKILLed — the wrapper now scans for the first GUARD_-prefixed line instead of trusting line 1. * fix(targetguard): quote the effect in the invocation — unquoted, cmd's shell syntax executed at invocation level, outside the guard
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror sync of Forgejo main 92d261c: observation-envelope schema + dash goldens (corpus rev 2, teploy-dash 7107773), the X02 S7 acceptance sweep harness + AUDIT_OPEN receipt, and C01-1 slice 1 (internal/targetguard — flock + generation fencing, live-proven on Debian/alpine).