Skip to content

fix(conformance): classify execution-root cleanup failures #309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BunsDev merged 4 commits into from
Sep 16, 2026
Merged

fix(conformance): classify execution-root cleanup failures #309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c0193a2
fix(conformance): classify execution-root cleanup operations
BunsDev Sep 16, 2026
0275843
chore(conformance): bind reviewed execution cleanup diagnostics
BunsDev Sep 16, 2026
7dda439
test(conformance): pin owned temp cleanup behavior explicitly
BunsDev Sep 16, 2026
7e05e72
chore(conformance): bind complete cleanup golden expectations
BunsDev Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/client-v1-conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1175,18 +1175,18 @@ jobs:
$trustedHarnessModules = @(
@('scripts\contract-canary.mjs', 40618, 'a4c2fe0a5eb6a5ff4653de5374c34c0fb46907c6806a5d23b86d8b37206ef958'),
@('scripts\executable-resolution.mjs', 9154, '31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430'),
@('scripts\owned-temp-directory.mjs', 6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095'),
@('scripts\owned-temp-directory.mjs', 7762, '95f546ef9ed614f2a0f55d356ddfc54c943fc53b595b4eebebfcbd4db68e5c0b'),
@('scripts\phase1-artifact-secret-scan.mjs', 21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a'),
@('scripts\phase1-conformance-lock.mjs', 48960, '92f981c43f75bc65c81e9e9ee16084aae658617b929d451a9db0d7c9e6bedbe2'),
@('scripts\phase1-conformance.mjs', 219211, 'daaa5fb660765b9d6c21bea4e4a3c9ebf1a92f14f052b7ed96593f579c7534ad'),
@('scripts\phase1-conformance.mjs', 219462, 'fd90e35308ea6b8dd0488cb874d00d7ad40aa16b33e38b46a9a76c3ea13d5056'),
@('scripts\phase1-evidence-contract.mjs', 15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f'),
@('scripts\phase1-evidence-runtime.mjs', 6572, 'b09a0d20abc7ebbc6289c57c985fd42b8a4b5d196895bc035b8fca40281d9315'),
@('scripts\phase1-linux-secret-service.mjs', 4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92'),
@('scripts\phase1-macos-keychain.mjs', 5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4'),
@('scripts\phase1-process-supervisor.mjs', 3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c'),
@('scripts\phase1-schema-v2-evidence.mjs', 52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8'),
@('scripts\phase1-schema-v2-producer.mjs', 232829, '9b2b295170d37f45b5d860fd8cd82c65ab6538caa7cd8d599ce19c8680643174'),
@('scripts\process-owned-artifact-root.mjs', 11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624'),
@('scripts\phase1-schema-v2-producer.mjs', 233186, '2e5fe8808230ad318aa86408bbad2004dbe4fd1c074f88de11fc581b227e0a51'),
@('scripts\process-owned-artifact-root.mjs', 13061, '103cc789f12a6bbde16b2414aecf05813d9d28a2c40c7d6eaa2073b86e8e5d77'),
@('scripts\supervised-exec.mjs', 2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b'),
@('scripts\supervisor-status.mjs', 854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e')
)
Expand Down Expand Up @@ -1910,7 +1910,7 @@ jobs:
- name: Prepare trusted Unix supervisor
if: matrix.platform != 'win32-x64'
shell: bash
run: "set -euo pipefail\nnode --input-type=module <<'EOF'\nimport { createHash } from 'node:crypto';\nimport { lstatSync, readFileSync } from 'node:fs';\nconst expected = new Map([\n ['scripts/contract-canary.mjs', [40618, 'a4c2fe0a5eb6a5ff4653de5374c34c0fb46907c6806a5d23b86d8b37206ef958']],\n ['scripts/executable-resolution.mjs', [9154, '31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430']],\n ['scripts/owned-temp-directory.mjs', [6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095']],\n ['scripts/phase1-artifact-secret-scan.mjs', [21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a']],\n ['scripts/phase1-conformance-lock.mjs', [48960, '92f981c43f75bc65c81e9e9ee16084aae658617b929d451a9db0d7c9e6bedbe2']],\n ['scripts/phase1-conformance.mjs', [219211, 'daaa5fb660765b9d6c21bea4e4a3c9ebf1a92f14f052b7ed96593f579c7534ad']],\n ['scripts/phase1-evidence-contract.mjs', [15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f']],\n ['scripts/phase1-evidence-runtime.mjs', [6572, 'b09a0d20abc7ebbc6289c57c985fd42b8a4b5d196895bc035b8fca40281d9315']],\n ['scripts/phase1-linux-secret-service.mjs', [4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92']],\n ['scripts/phase1-macos-keychain.mjs', [5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4']],\n ['scripts/phase1-process-supervisor.mjs', [3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c']],\n ['scripts/phase1-schema-v2-evidence.mjs', [52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8']],\n ['scripts/phase1-schema-v2-producer.mjs', [232829, '9b2b295170d37f45b5d860fd8cd82c65ab6538caa7cd8d599ce19c8680643174']],\n ['scripts/process-owned-artifact-root.mjs', [11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624']],\n ['scripts/supervised-exec.mjs', [2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b']],\n ['scripts/supervisor-status.mjs', [854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e']],\n ['scripts/phase1-linux-secret-service.sh', [5650, '83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476']],\n ['scripts/unix-artifact-handoff.c', [18704, '2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc']],\n ['scripts/unix-producer-command.sh', [3223, 'ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8']],\n ['scripts/unix-producer-supervisor.sh', [29424, 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff']],\n]);\nfor (const [path, [size, digest]] of expected) {\n const stats = lstatSync(path);\n const bytes = readFileSync(path);\n if (\n !stats.isFile() ||\n stats.isSymbolicLink() ||\n stats.nlink !== 1 ||\n bytes.byteLength !== size ||\n createHash('sha256').update(bytes).digest('hex') !== digest\n ) {\n throw new Error('Trusted Unix supervisor source bytes do not match');\n }\n}\nconsole.log('Frozen harness module graph verified.');\nEOF\nbroker_root=\"/tmp/opencoven-unix-broker\"\n(umask 077 && mkdir \"$broker_root\")\ncc -std=c11 -D_DARWIN_C_SOURCE -Wall -Wextra -Werror -O2 \\\n scripts/unix-artifact-handoff.c \\\n -o \"$broker_root/unix-artifact-handoff\"\nchmod 500 \"$broker_root/unix-artifact-handoff\"\n"
run: "set -euo pipefail\nnode --input-type=module <<'EOF'\nimport { createHash } from 'node:crypto';\nimport { lstatSync, readFileSync } from 'node:fs';\nconst expected = new Map([\n ['scripts/contract-canary.mjs', [40618, 'a4c2fe0a5eb6a5ff4653de5374c34c0fb46907c6806a5d23b86d8b37206ef958']],\n ['scripts/executable-resolution.mjs', [9154, '31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430']],\n ['scripts/owned-temp-directory.mjs', [7762, '95f546ef9ed614f2a0f55d356ddfc54c943fc53b595b4eebebfcbd4db68e5c0b']],\n ['scripts/phase1-artifact-secret-scan.mjs', [21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a']],\n ['scripts/phase1-conformance-lock.mjs', [48960, '92f981c43f75bc65c81e9e9ee16084aae658617b929d451a9db0d7c9e6bedbe2']],\n ['scripts/phase1-conformance.mjs', [219462, 'fd90e35308ea6b8dd0488cb874d00d7ad40aa16b33e38b46a9a76c3ea13d5056']],\n ['scripts/phase1-evidence-contract.mjs', [15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f']],\n ['scripts/phase1-evidence-runtime.mjs', [6572, 'b09a0d20abc7ebbc6289c57c985fd42b8a4b5d196895bc035b8fca40281d9315']],\n ['scripts/phase1-linux-secret-service.mjs', [4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92']],\n ['scripts/phase1-macos-keychain.mjs', [5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4']],\n ['scripts/phase1-process-supervisor.mjs', [3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c']],\n ['scripts/phase1-schema-v2-evidence.mjs', [52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8']],\n ['scripts/phase1-schema-v2-producer.mjs', [233186, '2e5fe8808230ad318aa86408bbad2004dbe4fd1c074f88de11fc581b227e0a51']],\n ['scripts/process-owned-artifact-root.mjs', [13061, '103cc789f12a6bbde16b2414aecf05813d9d28a2c40c7d6eaa2073b86e8e5d77']],\n ['scripts/supervised-exec.mjs', [2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b']],\n ['scripts/supervisor-status.mjs', [854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e']],\n ['scripts/phase1-linux-secret-service.sh', [5650, '83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476']],\n ['scripts/unix-artifact-handoff.c', [18704, '2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc']],\n ['scripts/unix-producer-command.sh', [3223, 'ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8']],\n ['scripts/unix-producer-supervisor.sh', [29424, 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff']],\n]);\nfor (const [path, [size, digest]] of expected) {\n const stats = lstatSync(path);\n const bytes = readFileSync(path);\n if (\n !stats.isFile() ||\n stats.isSymbolicLink() ||\n stats.nlink !== 1 ||\n bytes.byteLength !== size ||\n createHash('sha256').update(bytes).digest('hex') !== digest\n ) {\n throw new Error('Trusted Unix supervisor source bytes do not match');\n }\n}\nconsole.log('Frozen harness module graph verified.');\nEOF\nbroker_root=\"/tmp/opencoven-unix-broker\"\n(umask 077 && mkdir \"$broker_root\")\ncc -std=c11 -D_DARWIN_C_SOURCE -Wall -Wextra -Werror -O2 \\\n scripts/unix-artifact-handoff.c \\\n -o \"$broker_root/unix-artifact-handoff\"\nchmod 500 \"$broker_root/unix-artifact-handoff\"\n"
- name: Compute reviewed Unix tool path
id: unix-tool-path
if: matrix.platform != 'win32-x64'
Expand Down
42 changes: 35 additions & 7 deletions docs/phase1-conformance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,33 @@
# Phase 1 real-authority conformance

## Execution-root cleanup diagnostic checkpoint

Protected [run 35125287541](https://github.com/OpenCoven/chat/actions/runs/35125287541)
used Chat #305 (`1f69306293f8caf873e0a2d6459a5c402e77600a`) and SDK #291
(`404c2bf898330cff10e0402646e83e6e65d17869`). Linux and macOS records passed
independent identity, timing, privacy and all 197 ordered assertions each. Windows
failed at `phase1.stage.execution-root-cleanup.failed`, before isolation validation,
and emitted no record. Downstream validation, aggregation and attestation were
skipped. This result does not prove that the earlier isolation failure is repaired.

Cleanup diagnostics classify actual operation failures using private identity maps:
`child-terminate`, `supervisor-wait`, `child-kill`, `child-reap`,
`tracked-set-changed`, `root-precondition`, `root-rename`, `root-postrename`,
`entry-stat`, `leaf-remove`, `directory-enumerate`, `directory-remove`,
`multiple`, and `unknown`. Public IDs use the prefix
`phase1.stage.execution-root-cleanup.`. Native messages, paths and PIDs stay in
private errors; messages, public category properties and arbitrary aggregate causes
do not establish a category. Several cleanup failures report `multiple`.

The diagnostic change preserves original private errors, reverse child cleanup,
existing grace periods, supervisor tree ownership, primary infrastructure-failure
precedence, root ownership checks before and after rename, and missing-entry and
symlink behavior. It does not repair the underlying Windows failure. Reviewed
source and binding delivery, matching SDK rebinding, both scope rotations, and a
fresh protected run remain necessary to identify that failure and prove acceptance.

## Prior owner-cleanup investigation

Windows owner-cleanup follow-up: [CI 35095826197](https://github.com/OpenCoven/chat/actions/runs/35095826197)
passed ten jobs and failed in the second lifecycle child launch at
`operation=job-assignment`, `nativeCode=5` (access denied). The target job had
Expand Down Expand Up @@ -163,8 +191,8 @@ assignment, RPC decoder and primary/secondary exception pipeline. This fixture
correction does not establish the protected installation failure's cause or
relax the round-trip assertions.

The lock now selects reviewed source `ffa954c2678bd933d7057d526b5fc4ed67a16f32`,
tree `3d667c7d816fe3fac088b6865b46756a84581beb`, including all 25 governed files
The lock now selects reviewed source `7dda439daa59ee350ff12cd195ff169b52e1085c`,
tree `347c0b5300498d612f5411c1aee3372731ffc4f1`, including all 25 governed files
and ten production deltas. The checkout regression exercises all five labels
from that immutable revision. SDK rebinding, both scope rotations and fresh
protected validation remain required; this binding alone is not acceptance.
Expand Down Expand Up @@ -1969,21 +1997,21 @@ revision authorities can therefore have different workflow hashes:

| File | Bytes | SHA-256 |
| --- | ---: | --- |
| `.github/workflows/client-v1-conformance.yml` | 177,934 | `5a43c25032b4eb040c1f3e378dc6456b1ef4e5bdeb36d5c58f71d8ec9d43c3d9` |
| `.github/workflows/client-v1-conformance.yml` | 177,934 | `73f665797b6d21de149949ca532bb814ac114a3682cff14c004919d95e3be2bb` |
| `scripts/contract-canary.mjs` | 40,618 | `a4c2fe0a5eb6a5ff4653de5374c34c0fb46907c6806a5d23b86d8b37206ef958` |
| `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` |
| `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` |
| `scripts/owned-temp-directory.mjs` | 7,762 | `95f546ef9ed614f2a0f55d356ddfc54c943fc53b595b4eebebfcbd4db68e5c0b` |
| `scripts/phase1-artifact-secret-scan.mjs` | 21,183 | `be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a` |
| `scripts/phase1-conformance-lock.mjs` | 48,960 | `92f981c43f75bc65c81e9e9ee16084aae658617b929d451a9db0d7c9e6bedbe2` |
| `scripts/phase1-conformance.mjs` | 219,211 | `daaa5fb660765b9d6c21bea4e4a3c9ebf1a92f14f052b7ed96593f579c7534ad` |
| `scripts/phase1-conformance.mjs` | 219,462 | `fd90e35308ea6b8dd0488cb874d00d7ad40aa16b33e38b46a9a76c3ea13d5056` |
| `scripts/phase1-evidence-contract.mjs` | 15,088 | `24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f` |
| `scripts/phase1-evidence-runtime.mjs` | 6,572 | `b09a0d20abc7ebbc6289c57c985fd42b8a4b5d196895bc035b8fca40281d9315` |
| `scripts/phase1-linux-secret-service.mjs` | 4,270 | `ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92` |
| `scripts/phase1-macos-keychain.mjs` | 5,091 | `ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4` |
| `scripts/phase1-process-supervisor.mjs` | 3,820 | `16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c` |
| `scripts/phase1-schema-v2-evidence.mjs` | 52,505 | `0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8` |
| `scripts/phase1-schema-v2-producer.mjs` | 232,829 | `9b2b295170d37f45b5d860fd8cd82c65ab6538caa7cd8d599ce19c8680643174` |
| `scripts/process-owned-artifact-root.mjs` | 11,788 | `426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624` |
| `scripts/phase1-schema-v2-producer.mjs` | 233,186 | `2e5fe8808230ad318aa86408bbad2004dbe4fd1c074f88de11fc581b227e0a51` |
| `scripts/process-owned-artifact-root.mjs` | 13,061 | `103cc789f12a6bbde16b2414aecf05813d9d28a2c40c7d6eaa2073b86e8e5d77` |
| `scripts/supervised-exec.mjs` | 2,875 | `a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b` |
| `scripts/supervisor-status.mjs` | 854 | `ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e` |
| `scripts/phase1-linux-secret-service.sh` | 5,650 | `83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476` |
Expand Down
40 changes: 39 additions & 1 deletion docs/roadmap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,44 @@
# Delivery roadmap and consolidation audit

## Current delivery and consolidation checkpoint, 2026-09-16
## Current delivery and consolidation checkpoint, 2026-09-16 (Chat #305)

Chat [#305](https://github.com/OpenCoven/chat/pull/305) landed at
`1f69306293f8caf873e0a2d6459a5c402e77600a`, followed by SDK
[#291](https://github.com/OpenCoven/sdk/pull/291) at
`404c2bf898330cff10e0402646e83e6e65d17869`. Both validator scopes were
rotated and read back at that SDK merge. Protected
[run 35125287541](https://github.com/OpenCoven/chat/actions/runs/35125287541)
failed on Windows at `phase1.stage.execution-root-cleanup.failed`. Linux and
macOS records independently passed identity, timing, privacy and all 197 ordered
assertions each. Windows emitted no record; downstream validation, aggregation
and attestation were skipped. Cleanup failure prevents later isolation validation,
so this result does not establish that the preceding isolation failure is repaired.

The cleanup diagnostic follow-up distinguishes fourteen fixed categories at the
actual operation boundaries. It retains private causes, primary-failure precedence,
child termination order and grace periods, root identity/stamp checks, and symlink
and missing-entry behavior. It does not change permissions, limits, dependencies,
or acceptance criteria. Signed source binding, reviewed delivery, SDK rebinding,
scope rotation and fresh protected validation remain required.

Chat [#308](https://github.com/OpenCoven/chat/pull/308) addresses superseded
Windows CI. Its old running Windows job was cancelled after the replacement push;
the replacement released the queue and is awaiting terminal success in
[run 35127584766](https://github.com/OpenCoven/chat/actions/runs/35127584766).
Issue [#306](https://github.com/OpenCoven/chat/issues/306) remains open until
that exact head passes and lands. Concurrent custody-diagnostic PR #307 requires
sequential integration and a refreshed binding; its older binding must not land.

The worktree inventory currently contains eleven Chat and three SDK trees.
Preserve active, dirty, locked and ownership-uncertain trees, including the running
Chat #297 app. No retirement follows from age, cleanliness or a merged PR alone.
Chat #86 remains a parked draft requiring feature and vendor-artifact reconciliation;
WorkOS #303 remains active. The managed HPKE iterator authority gap and Project 9
tracking refresh remain open. Candidate and counterpart identities remain frozen,
publication remains disabled, and no accepted aggregate exists. Consolidation is
incomplete; preserve this chat and active worktrees.

## Historical delivery and consolidation checkpoint, 2026-09-16 (Chat #297)

GitHub issues and repository roadmaps hold current ownership, blockers, and evidence. Original acceptance criteria and historical records below remain preserved.

Expand Down
Loading
Loading