release: install->UPGRADE->boot e2e gate proves the upgrade-safety gap (vms-f05) - #280
Merged
Merged
Conversation
Adds tests/qemu/test_upgrade_e2e.sh + run_upgrade_e2e.sh, registered as ctest's upgrade_e2e (opt-in, real docker+QEMU boot). This commit is intentionally the BASELINE half of the vms-f05 upgrade proof: the next commit bumps OVMX_PRODUCT_VERSION and wires the CI job that cuts a release from each commit and proves the upgrade between them. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…->boot CI gate (vms-f05) Constructs the two releases the vms-f05 upgrade proof needs via tools/cut-release.sh itself (never hand-faked "0.N"/"0.N+1"): BASELINE is cut from the previous commit (28a929b, V0.1), UPGRADE from this one (V0.2). Wires tests/qemu/run_upgrade_e2e.sh into .github/workflows/ci.yml as a new upgrade-e2e job. Bumping the identity SSOT breaks two tests that hardcoded the boot banner literal "OVMX V0.1" (test_executive_integral.sh, test_docker_persistent_ disk.sh) -- updated to V0.2 so they keep asserting the real value INV-1 (ovmx_identity.h) now emits, not a stale literal. THE FINDING (measured building this gate, see test_upgrade_e2e.sh's header for full detail): PRODUCT INSTALL's do_install() overwrites every kit-listed file unconditionally on upgrade, including SYS$MANAGER:SYSTARTUP_VMS.COM (shipped by the kit) -- a site customization there does not survive an upgrade. User data outside the kit's file list and the version bump DO survive, and the machine still boots. A correct fix needs kit-entry-level "seed once, never replace" metadata (a kit format change, its own design-change cascade) -- larger than this item; filed as a separate follow-up rather than weakening the test. The CI step is continue-on-error with that citation so the finding stays visible without blocking unrelated merges. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… (vms-df9 gap, found by vms-f05) do_show()'s real (non-fallback) path printed pr_name alone -- the product database's own pr_version field was tracked at install time but never displayed, so PRODUCT SHOW PRODUCT against an actually-installed system could never show WHICH version was installed, or whether an upgrade changed it. Found building tests/qemu/test_upgrade_e2e.sh (vms-f05), which needs exactly that to assert an upgrade advanced the version. Fix: print "name version" as the PRODUCT column, matching real PCSI's own identifier shape (e.g. "VSI I64VMS OPENVMS V8.4-2L1") and matching this same file's synthesize_fallback path, which already embedded ovmx_product_version() this way. Pure display fix using data already in the database -- no kit format change, no DCL syntax change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
baron-3dl
added a commit
that referenced
this pull request
Aug 10, 2026
…de (vms-2c9) (#281) PRODUCT INSTALL's do_install() O_TRUNC-overwrote every kit-listed file unconditionally, including SYS$MANAGER:SYSTARTUP_VMS.COM (shipped by the kit itself), so a site customization to that file was lost on every upgrade -- the failure vms-f05's upgrade-e2e gate (#280) measured and left red under continue-on-error rather than weakened. Fix: kit-format "seed once" metadata. - ovmx_kit_format.h: ke_reserved -> ke_flags with OVMX_KIT_ENTRY_FLAG_SEED_ONCE (Rule 8, OVMX-invented). Same offset/size (160-byte entry unchanged, no format version bump); every kit built before this flag existed has these bytes zeroed via ovmx_kit_pack's calloc(), so a pre-vms-2c9 kit installs exactly as before (API-compat). - ovmx_kit_pack.c: is_seed_once_filename() flags SYSTARTUP_VMS.COM, SYCONFIG.COM, SYLOGICALS.COM by basename -- never product/system files like DCL.EXE, which must keep overwriting on upgrade. - product.c do_install(): a seed-once entry is written only if the target does not already exist; if present (an upgrade over an already- populated destination), it is preserved untouched (content, protection, owner UIC) and counted separately in the %PCSI-I-DONE summary. Hardens the vms-f05 gate to match: removed the whole-job continue-on-error from ci.yml's upgrade-e2e step, and assertions (a)/(c) now dump_and_die immediately on failure instead of soft-failing. (b) (site config survival) is no longer a documented known-red gap -- it is a real, enforcing assertion like the rest. Verified by hand against a bind-mounted destination (no vmsfs.ko needed for PRODUCT.EXE's own file-copy logic): a legacy kit with ke_flags manually cleared for SYSTARTUP_VMS.COM reproduces the exact pre-fix clobber (3 installed, 0 preserved, marker lost) on the SAME code path a flagged kit preserves (2 installed, 1 preserved, marker survives) -- proving the preserve behavior is genuinely gated on the flag, not decoration, and that old-format kits are unaffected. Co-authored-by: alice <alice@workspace.local> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tests/qemu/test_upgrade_e2e.sh+run_upgrade_e2e.sh: a real docker+QEMU gate proving (or disproving) that aPRODUCT INSTALLupgrade preserves user state, using two realtools/cut-release.shbundles (never hand-faked "0.N"/"0.N+1") -- BASELINE cut from commit28a929b2(V0.1), UPGRADE cut from this branch's HEAD after bumpingOVMX_PRODUCT_VERSIONto V0.2.upgrade-e2ejob into.github/workflows/ci.yml(cuts both releases, boots the real kernel/vms.ko/vmsfs.ko, runs the gate).PRODUCT SHOW PRODUCT/SHOW HISTORYnever printed the installed product's version at all (src/product/product.c) -- a pure display fix using data already in the database, no format change."OVMX V0.1"boot-banner literal to V0.2 (test_executive_integral.sh,test_docker_persistent_disk.sh).The finding
Validated end-to-end in-session (real
docker buildxcuts, real QEMU boots -- not just written): 17 passed, 1 failed.SYSTARTUP_VMS.COM) survivesdo_install()insrc/product/product.cwrites every kit-listed file withO_TRUNCunconditionally, includingSYS$MANAGER:SYSTARTUP_VMS.COM(shipped by the kit) -- so a site customization there does not survive an OS upgrade. This is exactly the failure real OpenVMS sites are drilled to fear, and exactly why real VMS never reprovisionsSYS$MANAGER:startup files once seeded.A correct minimal fix needs kit-entry-level "seed once, never replace" metadata -- a kit format change (
ovmx_kit_format.h+tools/ovmx_kit_pack.c+src/product/product.c), its own design-change cascade per CLAUDE.md, larger than this item. Filed as vms-2c9 rather than weakening the test. Theupgrade-e2eCI job's test step iscontinue-on-errorwith a citation back to vms-2c9, so this tracked, honest finding stays visibly red on every run without blocking unrelated merges.Test plan
tools/cut-release.shtwice locally (commit28a929b2and HEAD) to produce real BASELINE/UPGRADE bundlestests/qemu/test_upgrade_e2e.shagainst real QEMU + vms.ko + vmsfs.ko, both boots, hard-bounded bytimeoutshellcheck -S warningclean on both new scripts.github/workflows/ci.ymlvms_initialize,vmsfs_master,vms_product) compiles cleanNot merging/closing vms-f05 -- conductor reaps per standing instructions.
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com