vms-14f wave 1: census gates, CI diagnostics, sys$setuai privilege fix (10 items) - #158
Merged
Merged
Conversation
…erred cause rc!=77 (and rc!=0) for test_syssvc_* only means "77 was not reached" -- it has two distinct causes (a fabricated success, or an unrelated assertion failure), and the old message asserted the first as fact. Proven false on PR #46 (run 30725753152): both fabricated-success assertions passed, the real defect was DCL.EXE crashing. Now the message states the ambiguity and pastes the suite's own FAIL line(s) so the reader attributes from evidence already in the same output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… load Root cause (measured, rd vms-86a trail): the job ran all 58 manifest defects sequentially in ONE job -- 27m solo, 50m under moderate CI load, >60m and timeout-killed with three PRs in flight. Raising timeout-minutes was rejected (flaky-test rule): it hides the margin problem, it doesn't fix it. Splits the per-facility loop into 6 independent matrix shard jobs, each running ~1/6 of `facility_defects.sh list` (partitioned by NR%6, so it tracks the manifest as it grows/shrinks -- never a hand-maintained sublist). Each shard still runs the SAME positive control and the SAME per-defect equality check (red set EXACTLY require_fail+knock_on_fail, attribution, blind-suite gaps) the single job did, just over a subset. A new aggregate job (keeping the ORIGINAL job name for branch-protection/ doc continuity) unions every shard's emitted execution record and runs the full-manifest comparison against the committed tests/qemu/facility_negctl_observed.tsv in both directions -- the exact check the single-job driver ran on a full run, just over the union instead of one sequential execution. Verified: the 6-way NR%6 partition covers the manifest exactly (58/58, no gaps, no dupes); reconstructing the union from the real committed record and running fnr_compare against it passes; dropping one shard's rows from the union is correctly caught as a mismatch. Both existing static selftests (facility_defects.sh selftest, facility_record_negctl.sh) still pass unmodified. actionlint clean except pre-existing style-level shellcheck notes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ot text alone run_facility_negctl.sh's per-defect equality (check 6) compared bare assertion text against require_fail/knock_on_fail, discarding the suite attribution fail_map() already carries (`cut -f2-`). MEASURED: the text "child: a LOCAL flag set by the parent is NOT visible here (local clusters stay per-process)" -- named by bind-client-no-register, expected from test_syssvc_ef_mproc.c (in that defect's suites_red) -- is also printed verbatim by test_kmod_eflag_mproc.c, which is NOT in suites_red. Under the old equality, a red from either suite satisfied the requirement, so a red from the wrong suite could mask the right suite's own red going missing. Fix: tests/qemu/facility_negctl_equality.sh's fne_scope_map() scopes the observed (suite, text) rows to the defect's suites_red glob (or "(harness)") before the text comparison runs, so a same-text red from an out-of-scope suite can no longer stand in for the suite the manifest actually named. Swept the whole manifest at the same normalisation facility_defects.sh's own selftest uses: every require_fail/knock_on_fail text in every defect is still found within its own suites_red-scoped sources except this one already measured case -- the fix does not narrow any other defect's requirement. tests/qemu/facility_negctl_equality_negctl.sh is the negative control (no QEMU needed): it pins the real collision as still-grounded, proves a red from the right suite still satisfies the requirement, and proves a same-text red from the wrong suite (test_kmod_eflag_mproc) no longer does -- reproducing the driver's own comparison shape end to end. Registered as ctest facility_negctl_equality (label "harness", no container/QEMU).
The census credited any function prototyped in a header the build compiles as a root (rule 2, "exported API surface"), because the P-record reading never carried the static/extern qualifier. MEASURED exploit: a dead helper declared AND defined `static` in a multi-includer header (dcl_cmd.h, included by 9 TUs) bought a root exactly like the earlier two-edit recipes this gate already closed -- a `static` declaration can never be an exported entry point, since each includer gets its own private symbol. Fix: call_edges() now tags each P record static|extern, and root rule 2 only seeds from non-static declarations in non-TU files. Verified by hand against the prior recipe (now rc=1, naming vms_kif_chkpriv) and against the pristine tree (unchanged, rc=0). Added negative control 48 to pin it; all 42 controls in test_kif_caller_census_negctl.sh pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rule 2 of the census's call graph grants a root to "every product function prototyped in a header the build compiles" -- correct for a genuinely exported symbol, but the (origin file, name) tagging that tells a `.c` translation unit's private static from an extern definition only fired when the origin was itself one of the compiled TUs. A header never is, so a `static` function whose declaration AND body both lived directly in a compiled header (e.g. src/vmsdcl/include/dcl/dcl_cmd.h) fell through untagged and landed on the same bare-name node an actually-exported symbol gets -- granting root status, and therefore a product path, to a function with internal linkage that could never be called from outside its own translation unit. MEASURED before the fix: two edits (a static declaration+body in dcl_cmd.h, plus retiring vms_kif_chkpriv's OVMX-UNWIRED token) bought rc=0 at 44/32/12, one extra root (731 -> 732). Fixed by tracking header-resident static definitions independent of the per-TU tagging and excluding them from rule 2's grant. Pristine tree unaffected (731 roots, 1547 reached, 31/44 unchanged) because the loophole requires a function that additionally carries a standalone forward declaration -- a shape no existing static-inline header helper in the tree has. The same two-edit recipe is now rc=1, naming vms_kif_chkpriv. Captured as negative control 48 in test_kif_caller_census_negctl.sh (42 passed, 0 failed, no regressions across all pre-existing controls). This closes one purely-static loophole in vms-d33's "product path, not execution" question -- it does not close vms-d33 itself. A genuinely extern function declared in a header and defined in one .c file is still a root whether or not it is ever called at runtime, and is still indistinguishable here from a real caller nobody exercises -- that gap is execution, not linkage, and needs the per-assertion runtime-attribution instrument's groundwork (docs/design-runtime-attribution.md, residual R7) before it can close. Documented as a disclosed residual, not claimed closed, in both the gate's header comment and the design doc addendum. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…er's own PCB Round 5 of the Phase 3 security review, against origin/main c871334. sys$setuai -- the one service that rewrites SYSUAF.DAT, UAI$_PWD included -- guarded itself with: struct vms_pcb *pcb = vms_pcb_get(); if (pcb && !(pcb->cur_privs & PRV$M_SYSPRV)) return SS$_NOPRIV; Two ways through. vms_pcb_get() returns NULL for a process that never called vms_pcb_init(), so `pcb &&` made the condition false and NO privilege test ran at all. And where a PCB did exist the mask was pcb->cur_privs, which sys$setprv writes for the calling process with no validation -- the caller's own claim about itself. The test now reads the row the executive holds for the process (vms_kif_getjpi_self), the same source tools/vms_authorize.c uses since vms-b2e, and refuses when that read does not come back (Rule 9: no absent-executive branch). Also fixes the rewrite's UIC write-back base. parse_uaf_line() reads the two UIC fields with strtoul(..., 8) after vms-e60; this fprintf still printed them with %u, so rewriting any record whose UIC digits differ between the bases changed that account's UIC. USER1 ships 200|202 and would have been written 128|130. tests/qemu/test_syssvc_setuai.c drives all of it against a real /dev/vms: a caller with no PCB, a caller with an authenticated non-SYSPRV identity, a caller whose own PCB claims SYSPRV over an executive row that does not, and the SYSPRV positive that keeps the three refusals from being blanket. The SYSUAF.DAT evidence is read by the parent -- a process that neither authenticated nor wrote. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
vms-2b2 closed: all 16 wired vms_ioctl_* handlers are now MEASURED (25/33 total, 8 UNPROBED = the OVMX-UNWIRED exempt set). Re-measuring the register against that finds 8 of 10 OVMX-EXECUTIVE claims MEASURED, exactly 2 still UNMEASURED: sys$readef and sys$setef. Root cause is NOT unprobed handlers -- vms_ioctl_readef/setef are each measured-dependent elsewhere (test_syssvc_ef_ local, test_kmod_eflag, test_kmod_bind) -- it's a suite-scope mismatch: the defects that mutate their WASSET/WASCLR status word never redden an assertion in test_syssvc_ef_mproc.c, the suite cited as these two claims' own proof. Fixes landed: - test_userspace_service_register.sh: the UNMEASURED branch now distinguishes "handler measured elsewhere, suite mismatch" from "handler unprobed anywhere" instead of always citing the now-closed vms-2b2 as the reason. The stale "2 of 10 measured" / "9 of 33 handlers" comment block is replaced with a re-derivable description instead of a count that will drift again. - facility_attribution.sh selftest checks 3 & 5 hardcoded vms_ioctl_wflor as a "known unprobed" anchor. vms-2b2's own follow-up (vms-2ed) later gave it real coverage in that exact suite, which silently broke the selftest (a stale hardcoded fact, the same mistake class this file argues against). Now derives the anchor from `handlers` output each run. - facility_attribution_negctl.sh control B hit the same staleness (the recorded 2-edit sys$wflor buy no longer represents an unpaid claim, since wflor is now honestly measured in that suite). Control B now detects that organic graduation and falls through to a fresh, currently-live equivalent: one ignored call added to sys$readef's own already-declared EXECUTIVE proof does not flip its standing UNMEASURED to MEASURED -- the adversarial round this item required, run against current data instead of a resolved case. Not enforced: a pristine tree would still red 2 of 10 claims, so the register stays report-only per the item's done-condition. Verified: register (rc=0), register negctl (49/49), facility_attribution selftest (6/6), facility_ attribution_negctl (8/8), facility_defects selftest, facility_record_negctl (25/25). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The census's third definition reading (vms-e2b) namespaced its unrestricted region read to `vms_kif_` names, to tell an exfiltrated interface wrapper apart from vms_syscall.h's 47 static inline syscall stubs. That name filter left an escape: exfiltrate a wrapper's body into a .inc shared with a second product TU (defeating the private-origin rule) AND rename it out of the vms_kif_ namespace (defeating the name filter). MEASURED before this change: 7 edits, universe 44->43, rc=0, PASS -- a silent shrink. Fix: call_edges() now tracks the `inline` keyword alongside `static` and tags a defs-mode static definition "static-inline" when both are present. A new fourth definition-reading term reads the interface TU's full region with no name filter, excluding only "static-inline" definitions -- the tell that separates vms_syscall.h's generic stubs (all `static inline`, verified) from a real wrapper's body (plain `static`, verified against vms_kif.c's own kif_bind/kif_call/etc.). The recipe now reds naming the renamed entry point instead of silently leaving the universe. Added negative control 48 reproducing the full 7-edit recipe; all 42 existing controls stay green; pristine tree rc=0, universe unchanged at 44. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ing SYSUAF SYSUAF_PATH is a VMS filespec; vmsfs_to_linux_path() cannot resolve it until the system device is in this process's device table, which is what every shipped image does at startup. Without it the suite failed on a missing file instead of on $SETUAI's privilege test, so its refusals would have been explained by the wrong thing. The resolved path is printed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…e's logical-name bootstrap VMS_SYSUAF_PATH is "SYS$SYSTEM:SYSUAF.DAT", so resolving it needs the logical name table as well as the device table. MEASURED before this: the path resolved to /vms/sysuaf.dat and the suite failed on a missing file instead of on $SETUAI's privilege test. The control deletes the mask test and nothing else -- the state $SETUAI was in for every caller with no PCB. It names the three refusals in require_fail and the file-unchanged check in knock_on_fail, with the reason. facility_defects.sh selftest PASS; coverage PASS (59 defects >= floor 58, all anchored, 27 suites named). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…r rows
src/vmsscs/include/scs_mscp_srv.h:601 is a legitimate markdown-style
comment table ("header offset | size | field" / "---|------|---...") added
by vms-4e31 (ddce7ec) to document the SCA block-transfer header layout, not
a corrupted divider. The FUSED_RE detector was matching the dash run and
flagging the rest of the row as fused-onto-line text.
Fix by shape, not by allowlist: a tail made up of nothing but '|' and
divider characters (a table separator row's remaining cells) is exempted,
the same way a '*/' comment closer already is. Real fusion -- prose from
the next comment line -- still trips the check immediately, per new test
test_still_flags_fusion_immediately_after_a_table_style_run.
Proof suite: 14/14 pass (was 12; added the table-row true-negative and a
paired true-positive). Full-tree gate sweep: 777 files, 0 findings.
Found by the new suite, not by reading: test_syssvc_setuai read USER1's row back out of SYSUAF.DAT after a $SETUAI and got uic_group=202, uic_member=0 where 200 and 202 belong. parse_uaf_line() split the row with seven strtok_r(buf, "|") calls. strtok treats a RUN of delimiters as ONE, so every empty field was dropped and every field after it read one position early. Five of the six shipped rows have an empty field, so $GETUAI answered the wrong hash, the wrong UIC and the wrong privileges for those accounts, and $SETUAI wrote the misparse back. USER1||200|202|SYS$SYSDEVICE:[USERS.USER1]||TMPMBX,NETMBX -> password_hash="200", uic_group=202, uic_member=strtoul(defdir,8)=0 uic_member 0 is why this is more than a parsing bug: tools/vms_login.c does setuid(rec->uic_member), and setuid(0) is not a drop. What stops that on the shipped SYSUAF is that all four accounts this misparse gives member 0 carry no password hash and cannot authenticate (vms-08f) -- not anything here. The replacement split is the one src/libvms/rtl/sysuaf.c's sysuaf_scan() already uses, so the two readers of this file now agree by construction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes three of the five gaps test_userspace_service_register.sh disclosed (not claimed closed) after vms-c19: 1. A target declared under tests/, holding its own sys$ definition in a source under tests/, that is nevertheless installed. The tests/ exclusion only asked "is the compiling target declared outside tests/ AND does it compile a non-tests/ source"; a target failing both halves but shipped by install(TARGETS ...) was never asked about. Fixed by scanning every CMakeLists.txt for install(TARGETS ...) and treating a named target as a product target regardless of which directory declared it. 2. A source CMake compiles only under an option this configure leaves OFF, living outside src/ and tools/ (inside those two the glob still catches it, e.g. src/imgact/ under OVMX_IMGACT=OFF). Fixed with a mechanical scan (register_optguard.awk) for add_subdirectory() calls gated by an OFF option that resolve outside src/+tools/; the gate now REFUSES rather than silently certifying a hole, naming the option and path. 3. compile_commands.json was parsed by line shape with no defense against a PARTIAL parse (a "file" field that never reaches a matching object close would have silently dropped that entry). The parser is pulled out into tests/integration/lib/register_buildset.awk, which now counts "file" fields seen vs. objects closed and refuses on a mismatch instead of certifying a shrunk set. Each fix is measured before/after against the real gate on a sandboxed tree: the pre-fix gate PASSes while missing the minted service; the post-fix gate reds naming exactly it. register_buildset.awk's partial-parse path is also unit-tested directly against a hand-built malformed compile_commands.json, since no product-source mutation can perturb cmake's own JSON shape. Pristine tree: rc=0, universe unchanged at 88 services. Negative controls added to test_userspace_service_register_negctl.sh for all three; gate header's "WHAT REMAINS OPEN" disclosure updated to drop the two closed bullets (deleted, not reworded, per the standing prose ruling). Residuals #4 (assembly aliasing) and #5 (shared broken-build-set message prefix) are out of scope for this item and remain open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Conflicts with vms-05e7 resolved as a mechanical union (same resolution validated on merge/vms-14f-w1): vms-41b's 4-field P record carrying the static/extern qualifier plus vms-05e7's sawinline reset; vms-41b's negctl control renumbered 48 -> 49.
Conflicts with vms-41b/vms-05e7 resolved as a mechanical union (same resolution validated on merge/vms-14f-w1): the two fixes close adjacent shapes of the static-in-header hole and compose; vms-d33's negctl control renumbered 48 -> 50; DCLCMH aliased to DCLCMDH.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+643
to
+698
| name: Kernel Executive — Per-Facility Negative Controls (shard ${{ matrix.shard }}/${{ strategy.job-total }}) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 60 | ||
| # Budget per shard: ~58/6 defects plus the fixed image-build + positive- | ||
| # control cost every shard pays independently. Measured solo full run was | ||
| # 27m for 58 defects; a ~10-defect shard's sequential work is a fraction of | ||
| # that, so 30m leaves headroom for the SAME per-shard variance the full job | ||
| # saw (50m/60m at moderate/heavy load) without resurrecting a 60m+ job. | ||
| timeout-minutes: 30 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| shard: [0, 1, 2, 3, 4, 5] | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # This job is the ONLY place the executive is actually exercised, and | ||
| # rd vms-b1f means it does not run on a dev host at all. It therefore | ||
| # also EMITS the execution-sourced attribution record (rd vms-d894, | ||
| # rd vms-659) that tests/qemu/facility_defects.sh's static `coverage` | ||
| # reads for its observed count floor and its PROVEN-able-to-go-red suite | ||
| # population. | ||
| # | ||
| # THE COMPARISON IS THE POINT. The driver compares what it just observed | ||
| # with tests/qemu/facility_negctl_observed.tsv committed in the tree and | ||
| # fails on ANY disagreement in either direction, so the committed record | ||
| # cannot be fabricated upward and cannot go stale quietly. That check is | ||
| # the half a deleter does not own; the committed file alone is a | ||
| # snapshot, but unlike the citation ledger this replaced (rd vms-dc7), | ||
| # it is re-verified against a fresh QEMU run every time it matters, not | ||
| # just believed on its own say-so. | ||
| # | ||
| # FACILITY_NEGCTL_REQUIRE_RECORD: 1 makes a MISSING committed record red. | ||
| # It was 0 only while the tree had none -- the first record can only be | ||
| # produced here. That record is now committed | ||
| # (tests/qemu/facility_negctl_observed.tsv, emitted by run | ||
| # 30940272725 at tree-commit 6ffde90, positive-control pass, 42 RUN rows | ||
| # and 272 observed failing assertions), so this is 1 and deleting the | ||
| # record is red rather than a loud NOT MEASURED. | ||
| - name: Every executive facility has a control that turns CI red and NAMES it | ||
| # This job (across its shards) is the ONLY place the executive is | ||
| # actually exercised, and rd vms-b1f means it does not run on a dev host | ||
| # at all. Each shard EMITS its slice of the execution-sourced | ||
| # attribution record (rd vms-d894, rd vms-659); the aggregate job below | ||
| # unions the slices and is where the full-manifest comparison against | ||
| # the committed record happens (FACILITY_NEGCTL_REQUIRE_RECORD is a | ||
| # FULL_RUN-only check in the driver, so it is not meaningful per-shard -- | ||
| # see run_facility_negctl.sh's own "ONLY ON A FULL RUN" note). | ||
| - name: Every executive facility has a control that turns CI red and NAMES it (this shard's slice) | ||
| env: | ||
| CONTAINER_ENGINE: docker | ||
| FACILITY_NEGCTL_RECORD_OUT: ${{ runner.temp }}/facility_negctl_observed.tsv | ||
| FACILITY_NEGCTL_REQUIRE_RECORD: 1 | ||
| run: tests/qemu/run_facility_negctl.sh | ||
| run: | | ||
| set -eu | ||
| DEFECTS=$(sh tests/qemu/facility_defects.sh list \ | ||
| | awk -v n="${{ strategy.job-total }}" -v i="${{ matrix.shard }}" 'NR % n == i') | ||
| echo "This shard (${{ matrix.shard }}/${{ strategy.job-total }}) runs:" | ||
| echo "$DEFECTS" | sed 's/^/ /' | ||
| # shellcheck disable=SC2086 | ||
| tests/qemu/run_facility_negctl.sh $DEFECTS | ||
|
|
||
| # Uploaded even on failure: a run that went red is exactly when someone | ||
| # needs to see what it observed, and reading 42 defects' worth of rows | ||
| # out of a job log is how a record gets transcribed wrong. | ||
| - name: Upload the execution record this run observed | ||
| # needs to see what it observed, and reading a shard's rows out of a job | ||
| # log is how a record gets transcribed wrong. | ||
| - name: Upload this shard's observed record slice | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: facility-negctl-observed-record | ||
| name: facility-negctl-observed-record-shard-${{ matrix.shard }} | ||
| path: ${{ runner.temp }}/facility_negctl_observed.tsv | ||
| if-no-files-found: warn | ||
|
|
||
| # Aggregate job: keeps the ORIGINAL job name (branch protection / docs may | ||
| # cite it, e.g. docs/VERDICT-vms-b33-phase2-*.md) and does the ONE check that | ||
| # is only meaningful over the FULL manifest -- comparing the union of every | ||
| # shard's observations against the committed | ||
| # tests/qemu/facility_negctl_observed.tsv, in both directions, exactly as | ||
| # the single-job driver did on a full run. | ||
| kernel-executive-facility-negative-controls: |
This was referenced Aug 7, 2026
baron-3dl
added a commit
that referenced
this pull request
Aug 8, 2026
…86a) (#185) Main-push run on d2d76fc failed on THREE "Kernel Executive — Per-Facility Negative Controls" shards AT ONCE (0/6, 1/6, 5/6). Each shard boots QEMU plus runs fork/pipe/multi-process tests; with all 6 unbounded (GitHub's default matrix concurrency) they compete for runner resources alongside the rest of the CI suite and balloon — resource starvation/timeouts, not a per-defect logic bug. Add max-parallel: 3 to the shard matrix strategy so at most 3 shards run simultaneously. All 6 shards still execute (coverage unchanged, per CLAUDE.md rule 7/#158's sharding) — this only caps how many run at once, sequencing the remaining 3 into a second batch. Co-authored-by: alice <alice@workspace.local> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
baron-3dl
added a commit
that referenced
this pull request
Aug 14, 2026
…er negctl (#519) VERACITY-OVERTURN (blocks vms-14f). PR #158's $GETUAI/SYSUAF parser fix was real, but three claims shipped alongside it were hand-recited, not measured, and are measurably false. Each correction below is DERIVED by running the relevant parse/format over the shipped SYSUAF.DAT, not re-typed. 1. src/libvms/rtl/sysuaf.c (strtok comment): was "five of the six rows OVMX ships have an empty field". MEASURED 6 of 6: every shipped row carries an empty FLAGS field, so the strtok split dropped PRIVILEGES on ALL SIX rows and $GETUAI(UAI$_PRIV) returned mask 0 for every account (SYSTEM's "ALL" and GUEST's "TMPMBX" alike), not "nearly the whole" file. 2. src/libvms/rtl/sysuaf.c + test_syssvc_setuai.c (both-bases comment): implied SYSTEM's 1|4 is the unique row that reads the same octal and decimal. MEASURED: TWO rows do -- SYSTEM (1|4) and OPERATOR (1|6) -- because both UIC components are single octal digits; the four [200,20x] rows discriminate. Corrected in both spots and in the radix negctl's `why` (Rule 10 consistency). 3. test_syssvc_setuai.c (write-back comment): claimed a %u write of USER1's 128|130 "reads back as octal 88|88". MEASURED 10|88: '8' is not an octal digit, so strtoul("128",8) stops at "12" (=10); strtoul("130",8)=88. Unexecuted negative control: the WRITER's octal UIC formatting (sysuaf_format_record's %o) had no dedicated control -- sysuaf-uic-radix-decimal mutates the READER radix, and the manifest itself noted "a WRITE alone is not reached". Scenario 4's two write-back assertions were the exact subject of the false claim #3 yet nothing injected a writer defect to prove they have teeth. Added sysuaf-uic-writeback-decimal: flips both %o->%u in the writer so a rewritten record whose UIC digits differ between bases is written decimal. Scenario 4 rewrites USER1 (200|202 -> struct 128|130) and reads the row text back, so %u reddens exactly the two "still reads 200/202" assertions (measured host-side: %o of 128/130 = "200"/"202", %u = "128"/"130"). No other qemu suite writes via sysuaf_format_record and reads a UIC field back, so nothing else reddens. Anchored both assertions, added the manifest entry + inject, raised the derived floor 97->98. manifest selftest + coverage: the new defect injects with teeth, require_fail texts exist literally, 98>=floor 98. (The 3 remaining selftest/ coverage FAILs -- test_kmod_vmsfs_mountvis/sysgroup, test_syssvc_initialize unanchored -- pre-exist identically on origin/main; unrelated to this item.) No security fix or test was weakened; source changes are comment-only + a new injected-defect control. INV-6. Co-authored-by: alice <alice@workspace.local> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration branch for the vms-14f swarm, wave 1. Ten item branches, each merged with
--no-ffto preserve per-item attribution and revertability.Supersedes #157, which carried an eleventh item (vms-215) that reddened the QEMU cluster. #157's diagnosis is below; vms-215 is held back for re-dispatch.
Heals main's 3 red tests
divider_integrity_gatefacility_attribution_selftestfacility_attribution_negctlItems
tools/check_divider_integrity.py+ selftest)Why vms-215 is not here
On #157 the QEMU cluster went red:
Kernel Executive (QEMU)plus all six per-facility negctl shards. The six shards were a correct knock-on — each refused to certify because its pristine positive control was red (refusing to run the negative controls: their verdicts would be unfounded), which is the intended vms-ecf property, not a shard bug. vms-86a is exonerated.The single real failure was one assertion out of 799, in
test_syssvc_authorize:AUTHORIZE behaved correctly throughout —
%UAF-F-NOAUTHwas emitted and the process exited 1, both asserted and both green. The banner text reachedoutBby a different route. The dumped transcript shows the test's own stdout arriving out of order (B's dump header printed before A's block), which is the signature of a fork-without-flush bug intests/qemu/test_syssvc_authorize.c:run_authorize()forks with an unflushed parent stdout buffer, the child inherits it, and the child'sfflush(stdout)afterdup2(out_pipe[1], STDOUT_FILENO)pushes the parent's buffered copy of A's transcript —%UAF-I-AUTHVERSIONincluded — into B's capture pipe.That bug is latent on main only because
init.shran each suite straight to the console, where stdout is line-buffered. vms-215 changed it to"$test" >"$SUITE_OUT" 2>&1so the assertion tally could be derived from lines actually printed rather than from suite self-reports — a sound change, and the reason it is worth landing. Redirecting to a file makes stdout fully buffered and turns the latent bug live.vms-215 is not wrong; it is blocked. Landing it needs
fflush(NULL)before thefork()inrun_authorize(), in a file no item in this batch owns. That is new work, not a merge resolution, so it is held back rather than fixed here. No control was weakened, narrowed, or allowlisted.🤖 Generated with Claude Code