Conversation
…e receipt One executable harness (ADR §6 S7) running this repo's legs of the programme's acceptance line: rename, duplicate identity, repeated request, response loss, rollback — target/history identity preserved end to end. Vacuous-match guard: a -run pattern matching zero tests fails the leg. Receipt table recorded in AUDIT_OPEN.
…tion (flock + generation fencing + protocol outcomes) internal/targetguard: a POSIX helper (guard.sh, embedded) uploaded over SSH and invoked to run ONE protected effect under an OS-exclusive flock with generation fencing, plus the Go wrapper mapping its first-line protocol to typed outcomes (ErrBusy retryable; ErrFenced = stale plan, reconcile never blind-retry per D11; ErrTargetUnfit fail-closed). The helper self-tests the lock primitive once per app dir (marker under the lock) and refuses (GUARD_UNFIT) if the target's flock does not serialize — a falsely-held lock is worse than none. Outcome rides stdout's first line because the ssh Executor abstraction does not preserve exit codes. LIVE PROOF (podman, 2026-09-23, debian bookworm-slim + alpine 3.20): serialization timestamped ABAB (one full critical section then the other's — the investigation initially read ABAB as interleaving; the inverted harness evaluation was caught and corrected, the timestamped runs are the evidence); fencing refuses gen-7-committed vs plan-expects-3 with the effect untouched; killed helper auto-releases (post-death effect OK); current generation passes. The busybox util-linux FILE-form non-portability observations motivated the self-test hardening. Linux CI tests (guard_linux_test.go, gated) pin the same invariants with the corrected serialized signature; wrapper semantics pinned on every platform. NEXT SLICE (recorded in _internal): integrate guarded effects into the deploy path (state commit + predecessor retirement under the guard; .generation sidecar written by the state commit) and the acquisition-order doc for the shared-proxy commit lock.
…rness lesson + slice-2 remainder)
…rface (Close/Host/User/RunStream/RunInput) The linux-gated test file is invisible to macOS go vet, so the interface miss only surfaced in CI (sync PR #11). GOOS=linux go vet/build now part of the local pre-push check for this package.
…rness (VAR=x; cmd does not export in dash)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror sync of Forgejo main f833304: observation-envelope schema + dash goldens (corpus rev 2), X02 S7 acceptance sweep harness + receipts, C01-1 slice 1 (internal/targetguard — flock + generation fencing, live-proven), Executor interface completeness fix.