Delete the dead Docker runtime: migrate its CI jobs, prove the QEMU UAT actually works (vms-71a) - #10
Merged
Merged
Conversation
…, delete it CLAUDE.md Rule 9 retired the Docker RUNTIME layer (operator ruling 2026-07-28). This finishes the migration blocking that ruling: - Delete the docker-build job outright. It built the retired glibc product container and ran a SHOW TIME smoke test + install-skip smoke test. SHOW TIME is already covered natively by tests/dcl/test_show_time.sh via the dcl-integration ctest target (build-and-test job); install-skip is covered on the real runtime by the persistent-boot job's Boot 2. No coverage lost. - conformance / corpus-conformance: these never ran the product image, only the root Dockerfile's disposable "builder" stage (cmake+gcc). Reproduced with a plain ubuntu:24.04 tooling container (repo bind-mounted at /src) instead -- Rule 9 permits Docker as build/test tooling, just not as a runtime. Verified locally with podman: conformance's 9/9 VMS programs compile and pass under the new job exactly as before. - uat-session: migrated from Docker+SSH (port 2222, the dead container) to distro/Dockerfile.bootable + QEMU console, using tests/uat/vms_session_qemu.sh (same 13 assertions, same command list as the SSH script -- adapted here to wait on the login prompt that already exists on this branch, since the boot-time executive marker vms-0ff added is not yet merged). Known, tracked coverage gap: SSH login itself has no CI coverage now that its only runtime is gone; tests/uat/vms_session_test.sh is retained for when SSH-on-QEMU exists (currently not planned -- vms-02d was cancelled). - Delete Dockerfile and docker-compose.yml. tests/integration/ test_runtime_target.sh (the Rule 9 gate) needed no edit -- it was written so file-absence is the pass state; confirmed via ctest (40/40 pass, 1 skip, runtime_target_gate passes). Coordinates with vms-a35 (PR #6 rebase): PR #6's docker-build smoke test was rewritten there into a boot-refusal witness for the (unmerged) executive-integral work. That step is deleted here along with the whole job, per operator ruling 2026-07-30 ("docker was cooked... pretty shit that you still have it around") -- it is not ported anywhere; the same property is proven on the real runtime by tests/qemu/test_executive_integral.sh. vms-71a
…rigor
Re-dispatch findings addressed (veracity adversary confirmed all four):
1. Actually ran the script (podman build -f distro/Dockerfile.bootable +
podman run --entrypoint bash .../test.sh) on this host, repeatedly.
13/13 assertions pass, ~11-14s end to end. It had never been executed
before -- bash -n is not coverage.
2. Disclosed provenance: this script is derived from
origin/vms-0ff-executive-fatal:tests/uat/vms_session_qemu.sh, with the
`wait_for '%STARTUP-I-EXEC'` wait deliberately dropped and the drop
explained in a comment at that exact spot (that marker only exists on
vms-0ff-executive-fatal's ovmx_init.c, not on main).
3. Fixed the three echo-satisfiable assertions (SYS$MANAGER, session_test_
passed, SYSTEM) plus a fourth found during rework (HELP SHOW): each
command's own response is now captured into CMD_OUTPUT[cmd] by tracking
byte offsets and stripping the guest tty's echo of the input line, and
check_response() asserts against that captured response instead of
grepping the whole console log (which also contains every command's own
echo). Proven to actually distinguish real failure from vacuous pass:
with the fix in place, the run genuinely caught a pre-existing DCL bug
(SET DEFAULT SYS$MANAGER, no colon, fails -- see vms-dd9) that the old
whole-log check could never have caught. Fixed by using the syntax
proven to work (SYS$MANAGER:) rather than papering over an unrelated,
out-of-scope defect.
4. Replaced the 16 fixed `sleep 0.4` calls with synchronisation on the
actual DCL prompt ('$ ') reappearing in the bytes appended since each
command was sent. Split BOOT_TIMEOUT/STEP_TIMEOUT/COMMAND_TIMEOUT/
SESSION_TIMEOUT so a slow boot can no longer silently consume the
command-loop budget (previously BOOT_TIMEOUT double-duty'd as both the
QEMU wall-clock kill switch and the login-wait budget).
Negative checks now scan a strictly wider surface (whole console log,
including boot log) which can only catch more real Unix leaks, never
manufacture false ones (none of the leak strings are ones this script
sends). Positive checks now scan post-login-only session output where
still using a broad grep, narrowing the surface relative to before.
…OVMX Rule 9 says do not document Docker as an OVMX runtime; these files still told readers to run the container this branch deletes: - README.md:54-63 documented `docker compose up --build` + SSH on 2222 as a way to run OVMX, naming a compose file that no longer exists. - docs/building.md:19 installed docker-compose-v2 for it; :63-73 gave full "Docker Container ... Full runtime" instructions. - docs/architecture.md:19-20 listed [Dockerfile, docker-compose.yml] as the System Integration layer; the Boot Sequence had a full "Docker Mode" section walking through `docker compose up --build`. - .claude/profiles/implementer.md:32-38 told every future implementer their build+test and compile-only-check commands were `docker compose --profile dev run` and `docker build -t ovmx-test:latest .` -- both now impossible since there is no root Dockerfile. - CLAUDE.md:178-179 listed the two files as present-and-pending-removal in the repo tree (they're gone); :236-239 described them as "retained because CI still depends on them" (it no longer does). Left untouched (out of scope): the pre-existing `docker build -f Dockerfile.bootable -o dist .` path in README.md/CLAUDE.md, which should read `distro/Dockerfile.bootable` -- a pre-existing typo unrelated to this migration, flagged in findings.
Round-2 fixed the two assertions the round-1 adversary named, but left
two vacuous check_regex whole-log scans in place with inline comments
falsely certifying them as "not echo-satisfiable". Applying the binding
mutation method (prefix each driven command with a bogus verb so DCL
returns %DCL-E-IVVERB and no real output can appear; confirm the
assertion then fails; restore and confirm it passes) to every positive
assertion, not just the two named:
- SHOW PROCESS /PRIVILEGES: check_regex('...|PRIV') was satisfied by the
echo of the command itself (PRIV is a substring of "PRIVILEGES").
Replaced with check_response anchored to the command's own captured
response, dropping the PRIV alternative.
- SHOW TERMINAL: check_regex('...|_[A-Z]') was doubly satisfied by the
echo alone -- case-insensitive grep matched 'Terminal' in the echoed
command text, and '_[A-Z]' matched UAT_TEST/_OPA0: echoes elsewhere in
the log. Replaced with an anchored check_response, dropping _[A-Z].
- SHOW TIME (found by re-deriving the property, not named in either
challenge round): the whole-log date-format regex was satisfied by
LOGOUT's own "logged out at 1-JAN-1970 ..." message even when SHOW
TIME was rejected outright. Replaced with an anchored check_response.
Removed check_contains()/check_regex(), the two whole-log positive-
assertion helpers now with zero call sites -- they were the mechanism
behind every vacuous check found this round, and leaving them in place
is a footgun for the next edit. check_not_contains() (negative/leak
checks) is untouched: those patterns are never typed by this script, so
a whole-log scan cannot manufacture a false pass.
All 7 positive assertions were mutation-tested individually against the
real QEMU runtime (podman + qemu-system-aarch64, TCG, no /dev/kvm) and
each was confirmed to flip PASS->FAIL when its driving command is broken
by DCL, then confirmed to pass again unmutated. Unmutated run: 13/13,
stable across 4 repeated runs.
Also fixes the residual doc straggler from the round-3 ruling:
.claude/agents/implementer.md:16 told every future implementer to run
`docker-compose up`, a file this branch deletes.
This was referenced Jul 30, 2026
baron-3dl
added a commit
that referenced
this pull request
Aug 27, 2026
The combine missed one CTest assertion. tests/integration/test_ovmx_module_home.sh (registered as ctest ovmx_module_home_gate) still required the scaffold to carry BOTH baseline modules (vms + vmsfs) with `real_mods -ge 2`; with drivers-ovmx/vmsfs deleted, only vms remains. Lowered to `-ge 1` and scrubbed the paired two-module prose here + in test_kernel_taint.sh + the CMakeLists gate comment. Verified under ctest: ovmx_module_home_gate (#10) 22/22 PASS; vmsfs_master_roundtrip (#19) PASS (confirms the vmsfs_ondisk.h relocation still builds INITIALIZE.EXE + vmsfs_master). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
baron-3dl
added a commit
that referenced
this pull request
Aug 27, 2026
…D + shared core), ~16k lines (#803) * vms-165 (VAX, WIP): delete dead kernel-netbsd/vmsfs/ VFS tree + its sole test/build consumers The NetBSD vmsfs.kmod VFS driver is fully superseded by the shared executive Files-11 ACP (vms-329/vms-d5d): the VAX runtime reads SYS$DISK via vmsfs_acp.c + vms_blockdev_netbsd.c's bread(9) seam, never this tree. Verified dead (no mount('vmsfs'), load_module only ever 'vms', vmsfs.kmod staged-but-never-loaded). Deletes the VFS tree + its only compilers/proofs. Build-script/CI/parity edits follow in the next commit (WIP checkpoint). [ci skip] Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * vms-165 (VAX, WIP): drop vmsfs.kmod cross-build+staging from run-boot.sh + drive_boot_vax.py [ci skip] * vms-165 (VAX, WIP): delete the 4 NetBSD vmsfs CI jobs + changes-filter path (yaml-validated) netbsd-amd64-vmsfs-crosscompile, netbsd-amd64-vmsfs-mount, netbsd-vax-vmsfs-crosscompile, netbsd-vax-vmsfs-mount all build/mount the deleted NetBSD vmsfs module; their scripts (crosscompile-vmsfs.sh, build-vmsfs-mount-vax.sh, run-vmsfs.sh, run_vmsfs.sh) are gone. No other job needs: them. YAML validates. [ci skip] Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * vms-165 (VAX, WIP): drop the dead vmsfs-module staging from tests/netbsd/Dockerfile + delete orphan run_vmsfs.sh The netbsd vmsfs.kmod VFS module + its in-guest mount/read proof are retired; the Dockerfile no longer COPYs the deleted src/kernel-netbsd/vmsfs/ files (which would fail the SHARED executive Docker build) nor stages run_vmsfs.sh/ drive_netbsd_vmsfs.py. The kept executive + qemu harnesses do not touch the guest-vmsfs/vmsfs-master staging (verified). [ci skip] Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * vms-165: retire the legacy ODS-2 VFS driver (Linux + core) atomically Completes the combined VFS-driver retirement on top of the VAX/NetBSD side (work/vms-165-vax). The runtime SYS$DISK path is the executive Files-11 ACP (in vms.ko / vms.kmod.o) exclusively; the per-substrate vmsfs VFS driver and the shared VFS core it fed are dead and are removed here as ONE change so the tree can never half-flip. Deleted (Linux + shared core): - src/kernel/vmsfs/ (Linux vmsfs.ko: blkdev/inode/super/ods2ro/file/dir + headers) - src/kernel-core/vmsfs/ (shared substrate-agnostic ODS-2 VFS core — consumed only by the two now-deleted VFS drivers) - distro/kernel/drivers-ovmx/vmsfs/ (Kbuild/Kconfig/sources.conf) + CONFIG_OVMX_VMSFS - Linux tests: test_kmod_vmsfs* + test_kmod_ods2_codec + mkimage_vmsfs.c + run_mount_e2e.sh/test_mount_e2e.sh; tools/cross-vax/build-vmsfs-core-vax.sh Relocated (NOT deleted — shared host-tool format header, still live): - vmsfs_ondisk.h -> src/vmsfs/include/vmsfs_ondisk.h (consumed by INITIALIZE.EXE, ANALYZE, vmsfs_master, vms_mount_helper). All -I/path-filter references repointed. Executive codec is unaffected: vms.ko still links src/vmsfs/ods2/ods2_reader.o + ods2_edit.o (the ACP's pure parse/validate/edit surface), independent of the deleted VFS core. Verified: `make -C src/kernel` builds vms.ko clean and it carries ods2_home_parse + ods2_dir_insert_blocks. Reworked, not silently dropped: - distro/Dockerfile.bootable harvest gate now expects vms.ko only and asserts the ODS-2 codec via vms.ko's ods2_* symbols; NODEV negative control (Boot C) now harvests a dependency-free stock module as its "loads-but-no-/dev/vms" fixture (was vmsfs.ko's binary). - ci.yml kernel-executive-negative-control: the vmsfs positive control lost its subject (test_kmod_vmsfs* deleted); its "harness-not-indiscriminate" value is preserved by the surviving test_syssvc_* honest-skip-77 requirement (documented). - facility_defects.sh: removed the two defects whose anchor suites were deleted (vmsfs-mountvis, ods2-read-content-vbn); emptied the now-subjectless scope-out sets. - Joint parity group-set (allowlist + image_parity.py + gate test + cut-release-vax manifest) dropped the 3 vmsfs groups together; parity gate stays green. - docs/compat register: repointed evidence off deleted files onto the ACP and re-rendered docs/compatibility-surface.md (drift-check clean); flagged the SOGW/SYSPRV entries for a compat-refresh re-census. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * vms-165: fix ovmx_module_home_gate baseline to one module (vms) The combine missed one CTest assertion. tests/integration/test_ovmx_module_home.sh (registered as ctest ovmx_module_home_gate) still required the scaffold to carry BOTH baseline modules (vms + vmsfs) with `real_mods -ge 2`; with drivers-ovmx/vmsfs deleted, only vms remains. Lowered to `-ge 1` and scrubbed the paired two-module prose here + in test_kernel_taint.sh + the CMakeLists gate comment. Verified under ctest: ovmx_module_home_gate (#10) 22/22 PASS; vmsfs_master_roundtrip (#19) PASS (confirms the vmsfs_ondisk.h relocation still builds INITIALIZE.EXE + vmsfs_master). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishes the Rule 9 operator ruling — the Docker runtime layer is dead. Gates all of Phase 1 of
vms-14f(vms-a35→ PR #6,vms-0e9,vms-4b0,vms-fa2).What changed
Dockerfileanddocker-compose.yml, and thedocker-buildCI job that builtovmx-test:latest.conformanceandcorpus-conformanceoff that file'sbuilderstage to a plain tooling container (Rule 9 explicitly permits Docker as build/test tooling). Conformance still runs its real 9/9 programs.README.md,docs/building.md,docs/architecture.md,CLAUDE.md,.claude/profiles/implementer.mdand.claude/agents/implementer.mdall still instructed readers todocker compose up --build, SSH to port 2222, ordocker build -t ovmx-test:latest .. Rule 9 forbids documenting Docker as a way to run OVMX.The UAT, which is the real content here
tests/uat/vms_session_qemu.shis now the only coverage for an interactive VMS session. It had never been executed once — it was validated withbash -n. Three rounds of adversarial review found its assertions were largely vacuous: it grepped the entire console log, which contains the guest tty's echo of every command sent, sosend 'SYSTEM'alone satisfied theSYSTEMcheck. Mutating a command so DCL rejected it with%DCL-E-IVVERBstill producedPassed: 13 Failed: 0.Now:
check_response().check_contains()/check_regex()— the whole-log helpers behind every vacuity found — are deleted, so the footgun cannot be reached for again.sleep 0.4calls replaced with synchronisation on the DCL prompt; boot/step/command/session timeouts split so a slow boot can't silently consume the command budget.Mutation-proven, independently re-run by a reviewer from a clean
git archive: all 7 positive assertions flip PASS→FAIL when their command is broken, each killing exactly one assertion. Unmutated: 13/13, 5 runs, no flakiness.The anchoring immediately caught a real pre-existing DCL bug —
SET DEFAULT SYS$MANAGERwithout a trailing colon fails%DCL-E-DIRECT— filed asvms-dd9rather than papered over.Provenance
The UAT derives from
origin/vms-0ff-executive-fatal:tests/uat/vms_session_qemu.shwith the%STARTUP-I-EXECwait removed (that marker exists only on that branch'sovmx_init.c). Disclosed inline so thevms-a35rebase takes PR #6's fuller version rather than silently keeping this one.🤖 Generated with Claude Code