From c851d7f78ea1218f922f527c5687dc7d7b2331e6 Mon Sep 17 00:00:00 2001 From: sammiller Date: Mon, 26 Oct 2026 00:48:38 +0000 Subject: [PATCH] docs: record MR-13 backup input retention repair Record Design-first implementation, real backup/restore before and after evidence, final native profiles and merge gates. Update the maintenance list and append AF-NODE-02 completion through the Plan CLI. Co-Authored-By: OpenAI Codex --- ledger/ledger.jsonl | 1 + maintenance/2026-10-24-repair-list.md | 2 +- maintenance/2026-10-26-mr13-validation.md | 106 ++++++++++++++++++++++ 3 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 maintenance/2026-10-26-mr13-validation.md diff --git a/ledger/ledger.jsonl b/ledger/ledger.jsonl index 81c52a4..f268b4d 100644 --- a/ledger/ledger.jsonl +++ b/ledger/ledger.jsonl @@ -144,3 +144,4 @@ {"at": "2026-10-25T23:04:59Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-103 fixed: ArcForges#53 merged as 4990f63f33bcf36855e184e4e8c4d3b8d7bde003; reviewed final head 0b11e1c97081dc6c1cb4baf8065015bb3038f79f, tree 153aee3c889f4942fe3d89938d8e8657c2f2b617, base 47ec7aa. Native Windows full 13 steps/1140s and Linux full 16 steps/1357s passed; all results and exact-head statuses read with fresh main/head/tree. Direct self-review 6404412350 by OpenAI Codex alone under user authorization. Guard all three end-step paths (Windows holder, Linux ExecStop, observe-only children): nonpositive timeout receives remaining shared budget, positive timeout capped, root outcome and launch-step semantics unchanged. Existing Design 04 section 3 at 376c6e9 suffices. Real regressions before Windows 3 failures/1 control and Linux 6 failures/2 controls; after Windows holder 9/9 JIT/native and launch faults 18/18 native, Linux full platform 92/92 JIT and 92/92 native-helper, no Linux skips. Total budget/sentinel/root-result checks retained, no fake process/clock or bound weakening; own attempts/slice drained, actual user manager untouched. No schema/package/RPC/migration, real credential-store/orphan-file operation, LAN/cloud MCP or later feature. MR-16 remains blocked; MR-105 remains next open follow-up. See maintenance/2026-10-25-mr103-validation.md."} {"at": "2026-10-25T23:52:51Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-105 fixed: Design#32 merged as 772435e591339a0c94ec34832bbebe5b94094a57 before ArcForges#54 merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a; reviewed final head 3c16d263d22cd2777dbba6f72f852a1fa0811f4d, tree 140798f0d9d717c15964e213a051674a41819d29, base 4990f63. Design native full Windows3/24s and Linux3/46s; source native full Windows13/1109s and Linux16/1356s, all results and exact-head statuses read with fresh main/head/tree. Kind-guarded synthetic ADOPTED initial RUNNING, cancellation STOPPING then FINISHED CANCELLED/HAPPENED, natural/recovery loss LOST/UNKNOWN; no invented exit status or managed FINALIZING. Actual production cancel now journals its first STOPPING change exactly once. Real Linux pre-fix1-fail/0-skips, final adoption4/4 and model18/18 in JIT/native-helper modes; final Windows model18/18 both modes and task control15/15, adoption0-executed/4-skips each mode. Native Host AOT zero warnings/errors both. Candidate864 Linux3-pass/1-cursor-test-fail and obsolete Windows interrupted/error retained separately; corrected test asserts API reset and reads actual cross-generation journal, no bound/guard weakening. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. AR-19 remains deferred/Open with cancellation procedure, MR-16 blocked; no real credential/orphan-file operations, schema/RPC/package/migration, user manager stop or later feature. See maintenance/2026-10-25-mr105-validation.md."} {"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."} +{"at": "2026-10-26T00:47:34Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-13 fixed (original ledger26 item3): Design#33 merged as 6358f94ebf32f4e2968d591413d86f5e2939decc before ArcForges#55 merged as 448e28dc247fb4234607cc4e811f3723f53e9b31; reviewed final head fcd99c085bb8b5bba44e4be4cb43d97fc147979e, tree 5517871c08c62ec72e659a37ddf014cadc51caa3, base 54e0809. Design complete native Windows3/25s, Linux3/46s; source complete native Windows13/1135s and Linux16/1355s, all results and exact-head statuses read with fresh main/head/tree. Retained backups never carry sealed task input: sanitize new copies before publish and older copies before open, reuse tombstones, compact/check integrity, fail closed on corrupt/locked/unreadable copies; records/names/schema/live retention/key remain. Restored sealed inputs require new submission. Real SQLite/GCM before 5 failures/0 skips each native host (test exit2), final fixed regressions5/5 both; full affected store project Windows93-pass/2-platform-skips of95 and Linux92-pass/3-platform-skips of95; Host and Bench AOT zero warnings/errors both. Initial CS0111 duplicate-constructor compile-only failure removed, existing constructor reused; no weakened assertion. External key backend is isolated under policy, never real OS-store stress/credential/orphan-file operation; no new or deployed database schema migration, enum/RPC/package change, node-key deletion/rotation or later feature. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. MR-16 blocked and MR-14 remains next separate page/WAL audit. See maintenance/2026-10-26-mr13-validation.md."} diff --git a/maintenance/2026-10-24-repair-list.md b/maintenance/2026-10-24-repair-list.md index 1173943..55d8cd9 100644 --- a/maintenance/2026-10-24-repair-list.md +++ b/maintenance/2026-10-24-repair-list.md @@ -50,7 +50,7 @@ managed tasks, no option that disables protection to enable elevation. The stop | ID | Issue | Ledger | Repos | Evidence | Proposed disposition | Status | |---|---|---|---|---|---|---| -| MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | open | +| MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | fixed: Design#33 (merge 6358f94; native full Windows3/25 s, Linux3/46 s) before ArcForges#55 (merge 448e28d, reviewed head fcd99c0; native full Windows13/1135 s, Linux16/1355 s); all retained copies exclude sealed input, new copies before publish and older copies before open, fail closed on inability; real before 5 failures/0 skips each host, after 5/5 each and full store Windows93-pass/2-skip, Linux92-pass/3-skip; real restore with original isolated key backend, names/nonsecret records/schema/live retention preserved; no new/deployed schema migration or restricted credential operation; MR-14 separate; [validation](2026-10-26-mr13-validation.md); ledger AF-NODE-02 note | | MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | open | | MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | open | | MR-16 | Historical records from 2026-10-17 report 746 stress-generated Windows credentials and about 5,990 orphan credential files; current counts have not been inspected. Cleanup stopped by the owner's decision of 2026-10-18. | 39 (7), 40 | none (workstation) | Records only; no store access in this pass | blocked: the owner's decision on the recovery proposal in the final report | blocked: owner's stop of 2026-10-18 reaffirmed on 2026-10-25; recovery proposal retained; no real Credential Manager cleanup, orphan credential-file operations or real-store stress | diff --git a/maintenance/2026-10-26-mr13-validation.md b/maintenance/2026-10-26-mr13-validation.md new file mode 100644 index 0000000..0c4d4ce --- /dev/null +++ b/maintenance/2026-10-26-mr13-validation.md @@ -0,0 +1,106 @@ +# MR-13: retained backups exclude sealed task input + +## Scope and authority + +MR-13 confirmed that pre-migration backups kept decryptable task_secret values after both live-store purge paths. The maintenance +list permits either removing values from all retained backups or excluding them from backups. This repair selects exclusion: +new copies are sanitized before publish; older retained copies are sanitized on store open before migration/startup. Failure +to sanitize any retained copy refuses the open. Task records, nonsecret data, presence-only names and store_meta schema version +are retained. A backup restore requires new submission for sealed inputs, including values still available in the live store. +The live store's retention and the node data key are unchanged. + +[Design#33](https://github.com/ArcForges/ArcForges-Design/pull/33) merged first as +6358f94ebf32f4e2968d591413d86f5e2939decc. Reviewed head 029fc26067a26a0d4e9a92cb99ca857363cd6682, tree +d2a106cfee32753d702104db2e4e5fc0bb90a407, base 772435e591339a0c94ec34832bbebe5b94094a57. +AD-0006, execution, startup, distribution and node-store documentation agree on this retention policy and its restore consequence. + +Design author checks: zero errors, protoc 25 files, both SQL schemas, 47 tool tests with 20 Windows platform skips, diff clean. +Final native Windows full 3 steps/25 s (20261026-000524-029fc26067a2-win); Linux 3 steps/46 s +(20261026-080520-029fc26067a2-linux). All six results, both wrapper exit records 0 and both exact-head required success statuses +were read, owner-hosted check skipped. Fresh main/head/tree checked before merge. +[Direct self-review](https://github.com/ArcForges/ArcForges-Design/pull/33#issuecomment-6405254475); +[final gate](https://github.com/ArcForges/ArcForges-Design/pull/33#issuecomment-6405277250). + +## Real before-fix proof + +Source test-only head ebc2b951cff881ab85173ca7ccef85d16c7b61c0, tree 4ebdbb06f88f0dc009b1bf7f2090496f19b1c376, +kept production unchanged at main 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a. Both native hosts fetched through Git. + +- Windows locked restore/Release build passed, zero warnings/errors, build 19.89 s. Five actual regressions failed, zero skips, + test exit 2, 3.317 s. +- Linux locked restore/Release build passed, zero warnings/errors, build 15.57 s. Five actual regressions failed, zero skips, + test exit 2, 0.878 s. +- Four cases restored a real SQLite backup with the original isolated key backend still available, and found the input Available + instead of Unavailable: new copies with small and overflow-sized payloads, and three legacy retained copies after immediate + and retention-based live purges. The live purge itself passed its unavailable assertion before the legacy restore failed. +- The fifth case found that a corrupt retained backup did not refuse the open. The unexpected successful open was disposed. +- Both wrappers captured the expected test failures and exited 0; these are before-fix evidence, never a successful regression + or complete profile. No formal profile ran on either intermediate test-only head. + +The AES-GCM, SQLite files, backup copy and restored store are real. Only the external key backend is isolated, as required by +the secret-store test policy. Tests use synthetic input and their own temporary roots, verify key cleanup through the isolated +backend, and never call a real OS secret store or inspect/delete credential or orphan-credential files. +They also require nonsecret records/names/schema preservation, unchanged live input availability, no migration, backup integrity, +absence of sampled old ciphertext bytes, and refusal without damaging live input. An unrelated file is retained untouched. + +Before logs: Windows C:\MyFile\Projects\dev\logs\mr13-before.{ps1,out,err,test-exit,exit}; +Linux /home/sammiller/arcforges/logs/mr13-before.{sh,out,err,test-exit,exit}. + +## Diagnosed author iteration + +The first fixed working-tree Windows author attempt passed formatting but failed compilation with CS0111: an added +StoreBackupException(string, Exception) duplicated the existing constructor. The duplicate addition was removed; the existing +constructor is reused. No regression or AOT checks ran in that failed attempt. This was a compile-only failure, not a passed +profile or weakened test. Logs: C:\MyFile\Projects\dev\logs\mr13-author.{ps1,out,err,exit} (exit 2). + +## Author and final evidence + +[ArcForges#55](https://github.com/ArcForges/ArcForges/pull/55) merged as 448e28dc247fb4234607cc4e811f3723f53e9b31. +Final reviewed head: fcd99c085bb8b5bba44e4be4cb43d97fc147979e. +Tree: 5517871c08c62ec72e659a37ddf014cadc51caa3. +Base: 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a. +Four files: backup sanitization, its store-open hook, reuse of the existing tombstone and real backup/restore regressions. + +New copies are sanitized before rename/publish. Store open processes every retained backup before startup or any existing +migration path. The copy uses secure_delete, DELETE journal mode and VACUUM, then integrity_check. Existing schemas are not +migrated or expanded. The original task secret rows in the live store remain usable until their own purge; key operations and +retention policy are unchanged. Older copies with no task_secret table are not given a new table. Copy failures retain the +underlying error and refuse the open. Named backup retention remains three. + +Windows author working tree was byte-identical to this final head: changed-file format/diff and Release build passed with +zero warnings/errors (10.77 s); new regressions 5/5, no skips, 3.780 s. Full affected store project: 95 total, 93 passed, +2 platform skips, 8.052 s. Skips: Linux Secret Service selection and Unix directory modes. Host and Bench win-x64 Native AOT +both published with zero warnings/errors; mr13-author2 exited 0. + +Linux fetched the exact final head: Release build zero warnings/errors, new regressions 5/5, no skips, 0.880 s. Full affected +store project: 95 total, 92 passed, 3 platform skips, 3.013 s (two Windows mapped-file behaviors and the Windows-only +Credential Manager denial guard). Host and Bench linux-x64 Native AOT both published with zero warnings/errors; changed-file +format/diff passed and worktree clean; mr13-after exited 0. Both author jobs drained before either complete final profile. +These author tests exercise the managed store on each native host; AOT publish validates the affected components. A broader +native executable backup-runtime claim is not inferred. + +[Author evidence](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405463572). +[Exact-head direct self-review](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405463805): all four files against +the merged Design, no findings. No identical full suite was repeated for review. +Author logs: Windows C:\MyFile\Projects\dev\logs\mr13-author2.{ps1,out,err,exit}; +Linux /home/sammiller/arcforges/logs/mr13-after.{sh,out,err,exit}. + +Both complete post-push native profiles passed at the final reviewed head: + +- Windows full: 13 steps/1135 s, 20261026-002302-fcd99c085bb8-win. +- Linux full: 16 steps/1355 s, 20261026-082255-fcd99c085bb8-linux. +- Every selected summary result read and passed, including JIT/native exclusive suites and startup gates. +- Both required exact-head arcforges/windows and arcforges/linux statuses success; owner-hosted checks skipped as configured. +- Fresh PR head/tree and source main/base checked immediately before merge. +- [Final merge gate](https://github.com/ArcForges/ArcForges/pull/55#issuecomment-6405736718). + +Formal logs: Windows C:\MyFile\Projects\dev\logs\mr13-final.{out,err,exit}; +Linux /home/sammiller/arcforges/logs/mr13-final.{out,err,exit}. Both native runners exited 0 and drained, with no competing +build/test. No earlier head, expected failure, partial run, skip or relaxed assertion substituted for these gates. +Only after the actual source merge, the maintenance list was updated and the owning AF-NODE-02 ledger note was appended +through the Plan CLI. Task states and later feature activation remain unchanged. + +The implementation uses existing tables and tombstones. No new or deployed database schema migration, enum/RPC/package change, +real credential-store operation, node-key deletion/rotation or orphan credential-file operation is included. MR-16 remains blocked. +MR-14's live-store page/WAL erasure is the next separate item. No user manager shutdown, daemon-reload, pkill -f, LAN/cloud MCP +or AF-REC-01/later feature activation. All work/review by OpenAI Codex alone; no other model/agent or independent review claimed.