diff --git a/ledger/ledger.jsonl b/ledger/ledger.jsonl index f268b4d..620318b 100644 --- a/ledger/ledger.jsonl +++ b/ledger/ledger.jsonl @@ -145,3 +145,4 @@ {"at": "2026-10-25T23:52:51Z", "task": "AF-EXEC-02", "kind": "note", "text": "MR-105 fixed: Design#32 merged as 772435e591339a0c94ec34832bbebe5b94094a57 before ArcForges#54 merged as 54e0809d7386f1ec24c39cd4ec1a4fc90f35177a; reviewed final head 3c16d263d22cd2777dbba6f72f852a1fa0811f4d, tree 140798f0d9d717c15964e213a051674a41819d29, base 4990f63. Design native full Windows3/24s and Linux3/46s; source native full Windows13/1109s and Linux16/1356s, all results and exact-head statuses read with fresh main/head/tree. Kind-guarded synthetic ADOPTED initial RUNNING, cancellation STOPPING then FINISHED CANCELLED/HAPPENED, natural/recovery loss LOST/UNKNOWN; no invented exit status or managed FINALIZING. Actual production cancel now journals its first STOPPING change exactly once. Real Linux pre-fix1-fail/0-skips, final adoption4/4 and model18/18 in JIT/native-helper modes; final Windows model18/18 both modes and task control15/15, adoption0-executed/4-skips each mode. Native Host AOT zero warnings/errors both. Candidate864 Linux3-pass/1-cursor-test-fail and obsolete Windows interrupted/error retained separately; corrected test asserts API reset and reads actual cross-generation journal, no bound/guard weakening. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. AR-19 remains deferred/Open with cancellation procedure, MR-16 blocked; no real credential/orphan-file operations, schema/RPC/package/migration, user manager stop or later feature. See maintenance/2026-10-25-mr105-validation.md."} {"at": "2026-10-25T23:52:51Z", "task": "AF-SEC-01", "kind": "note", "text": "MR-105: AR-19 successful Windows adoption remains Open/deferred. On the current native workstation all three lifecycle adoption candidates created through WMI were already in a job and refused; the fourth test is Linux-only. Final author mode counts are 0 executed/4 skips for JIT and native-helper, never a successful adoption claim. Extend the existing user-provided outside-every-job venue procedure with CancellingAnAdoptionJournalsStoppingBeforeItsFinalResult: actual initial RUNNING/no previous states, one STOPPING despite repeated cancels, FINISHED CANCELLED/HAPPENED/no exit code, no adopted FINALIZING and the same real journal's managed-attempt guards. Linux current-venue adoption4/4 JIT/native-helper passed separately; it does not close Windows acceptance. No new provisioning request or feature activation; MR-16 remains blocked."} {"at": "2026-10-26T00:47:34Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-13 fixed (original ledger26 item3): Design#33 merged as 6358f94ebf32f4e2968d591413d86f5e2939decc before ArcForges#55 merged as 448e28dc247fb4234607cc4e811f3723f53e9b31; reviewed final head fcd99c085bb8b5bba44e4be4cb43d97fc147979e, tree 5517871c08c62ec72e659a37ddf014cadc51caa3, base 54e0809. Design complete native Windows3/25s, Linux3/46s; source complete native Windows13/1135s and Linux16/1355s, all results and exact-head statuses read with fresh main/head/tree. Retained backups never carry sealed task input: sanitize new copies before publish and older copies before open, reuse tombstones, compact/check integrity, fail closed on corrupt/locked/unreadable copies; records/names/schema/live retention/key remain. Restored sealed inputs require new submission. Real SQLite/GCM before 5 failures/0 skips each native host (test exit2), final fixed regressions5/5 both; full affected store project Windows93-pass/2-platform-skips of95 and Linux92-pass/3-platform-skips of95; Host and Bench AOT zero warnings/errors both. Initial CS0111 duplicate-constructor compile-only failure removed, existing constructor reused; no weakened assertion. External key backend is isolated under policy, never real OS-store stress/credential/orphan-file operation; no new or deployed database schema migration, enum/RPC/package change, node-key deletion/rotation or later feature. Exact-head direct self-review by OpenAI Codex alone, no other model/agent. MR-16 blocked and MR-14 remains next separate page/WAL audit. See maintenance/2026-10-26-mr13-validation.md."} +{"at": "2026-10-26T02:12:43Z", "task": "AF-NODE-02", "kind": "note", "text": "MR-14 fixed: Design#34 merge 3df9db7946e9af6fd1e43f97216adfc44fd55507 before ArcForges#56 merge 5fa2ad5fe77bef791b96db11129b3851fe55c940, reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da. Existing secure_delete plus manual post-commit/replay WAL TRUNCATE and periodic zero-new-row retry; busy/failed manual checkpoint returns existing INTERNAL/internal, effect HAPPENED, no rollback/dedup rewrite. Real before 6 failures per native host, after all 6 own-platform regressions pass; full Store Windows95/97 (2 platform skips), Linux94/97 (3), affected AOT zero warnings/errors. Final complete Windows13/1148s and Linux16/1364s passed at exact head; Design Windows3/15s Linux3/34s. Evidence maintenance/2026-10-26-mr14-validation.md. Direct work/review by OpenAI Codex alone. No new schema migration, restricted credential operation or task activation. MR-16 remains blocked; MR-07 and MR-11 deferred/unresolved. Owner's 2026-10-26 instruction: finish MR-14 then stop for context adjustment to 872000; MR-15 remains next and unstarted. Current handoff maintenance/2026-10-26-handoff.md; 35 disposed,67 open,2 deferred,1 blocked of105. Design#35 merge 2d9995e78c4aa0f6327371ab0b5639857718da5c resolved the common idempotency-summary review finding before source merge; native full Windows3/26s Linux3/45s passed, no source/profile input change."} diff --git a/maintenance/2026-10-24-repair-list.md b/maintenance/2026-10-24-repair-list.md index 55d8cd9..5bc5260 100644 --- a/maintenance/2026-10-24-repair-list.md +++ b/maintenance/2026-10-24-repair-list.md @@ -51,7 +51,7 @@ managed tasks, no option that disables protection to enable elevation. The stop | ID | Issue | Ledger | Repos | Evidence | Proposed disposition | Status | |---|---|---|---|---|---|---| | MR-13 | Pre-migration backups (`records/backups`, last 3) keep `task_secret` values after the task's secrets are purged (R-EXE-017 / 04 §2 vs 13 §6). | 26 (3) | Design, ArcForges | 02 §2 step 3, 13 §6, node-store.md; no backup handling in the purge *(confirm)* | fix: Design states that a purge also removes the values from every retained backup (or that backups never carry them), and the node does so; regression test | fixed: Design#33 (merge 6358f94; native full Windows3/25 s, Linux3/46 s) before ArcForges#55 (merge 448e28d, reviewed head fcd99c0; native full Windows13/1135 s, Linux16/1355 s); all retained copies exclude sealed input, new copies before publish and older copies before open, fail closed on inability; real before 5 failures/0 skips each host, after 5/5 each and full store Windows93-pass/2-skip, Linux92-pass/3-skip; real restore with original isolated key backend, names/nonsecret records/schema/live retention preserved; no new/deployed schema migration or restricted credential operation; MR-14 separate; [validation](2026-10-26-mr13-validation.md); ledger AF-NODE-02 note | -| MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | open | +| MR-14 | Deleted sealed values may stay readable in free pages of the store file after a purge. | 26 (3) (same retention concern) | ArcForges | *(confirm `secure_delete` or equivalent)* | fix if confirmed (same Design statement as MR-13); else resolved with evidence | fixed: Design#34 (merge 3df9db7; native full Windows3/15 s, Linux3/34 s) before ArcForges#56 (merge 5fa2ad5, reviewed head 0d261bb; native full Windows13/1148 s, Linux16/1364 s); existing secure_delete retained, manual post-commit/replay TRUNCATE checkpoint with known-HAPPENED error when busy/failed, and periodic zero-new-row retry; real before 6 failures per host, after 6 own-platform regressions pass per host, full Store Windows95-pass/2-skip and Linux94-pass/3-skip of97; [validation](2026-10-26-mr14-validation.md); ledger AF-NODE-02 note; owner requested stop after this item, MR-15 unstarted; common replay summaries aligned by Design#35 (merge 2d9995e, Windows3/26s Linux3/45s) before source merge | | MR-15 | `CrashConsistencyTests.AStoreKilledDuringWritesReopensConsistent(420)` once saw every sealed value unavailable after a kill and reopen. | ArcForges#12 follow-up | ArcForges | Not reproduced; the test prints `UnavailableReason` *(confirm against host logs)* | fix if a cause is found; otherwise reported with evidence (no claim of resolution) | open | | MR-16 | Historical records from 2026-10-17 report 746 stress-generated Windows credentials and about 5,990 orphan credential files; current counts have not been inspected. Cleanup stopped by the owner's decision of 2026-10-18. | 39 (7), 40 | none (workstation) | Records only; no store access in this pass | blocked: the owner's decision on the recovery proposal in the final report | blocked: owner's stop of 2026-10-18 reaffirmed on 2026-10-25; recovery proposal retained; no real Credential Manager cleanup, orphan credential-file operations or real-store stress | diff --git a/maintenance/2026-10-25-handoff.md b/maintenance/2026-10-25-handoff.md index 97df782..a67631f 100644 --- a/maintenance/2026-10-25-handoff.md +++ b/maintenance/2026-10-25-handoff.md @@ -1,3 +1,5 @@ +> Superseded operational state and continuation instruction: see [2026-10-26 handoff](2026-10-26-handoff.md). The latest owner instruction is to finish MR-14 and STOP; MR-15 is unstarted. Refresh all refs and host state before resuming. + # Maintenance pass: session handoff, 2026-10-25 This file records where the maintenance pass stopped on 2026-10-25 and how the next session can take over without losing context. diff --git a/maintenance/2026-10-26-handoff.md b/maintenance/2026-10-26-handoff.md new file mode 100644 index 0000000..54c756b --- /dev/null +++ b/maintenance/2026-10-26-handoff.md @@ -0,0 +1,52 @@ +# Maintenance handoff, 2026-10-26 + +## Latest owner instruction + +Finish the current item, MR-14, including verification, merge and records, then STOP so the owner can adjust context to +872000. MR-14 is complete. Do not start MR-15 or continue automatically. A later explicit owner resume can continue +the authorized maintenance list from MR-15. Do not start AF-REC-01 or later features. + +This supersedes the resumption instruction and stale operational state in the [2026-10-25 handoff](2026-10-25-handoff.md). +Scope/order and current dispositions are in the [repair list](2026-10-24-repair-list.md); read the append-only ledger too. + +## Completed current item + +- MR-14: [Design#34](https://github.com/ArcForges/ArcForges-Design/pull/34), merge 3df9db7946e9af6fd1e43f97216adfc44fd55507, + precedes [ArcForges#56](https://github.com/ArcForges/ArcForges/pull/56), merge 5fa2ad5fe77bef791b96db11129b3851fe55c940. +- Reviewed implementation head 0d261bbe1d48f3c1e9848c15f32a26132cf030da, tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9. + Complete native Windows 13 steps/1148 s and Linux 16 steps/1364 s passed at that head; Design 3/15 s and 3/34 s. +- Real before: 6 failures on each host. After: all 6 own-platform regressions pass per host, plus existing affected checks. + Full evidence, initial compile-only failure, exact logs and limits: [MR-14 validation](2026-10-26-mr14-validation.md). +- Source repair is post-commit WAL checkpoint/replay and zero-new-row periodic retry. Existing secure_delete, schema, + tombstones, live key and retention remain. Busy readers can defer physical erasure, and manual success is withheld then. +- MR-13 is already complete: [source#55](https://github.com/ArcForges/ArcForges/pull/55) and [Plan#66](https://github.com/ArcForges/Plan/pull/66). + MR-101, MR-04 and MR-102 are also merged; never resume their historical diagnostics as unfinished work. +- This Plan record updates the list, appends the AF-NODE-02 note only through the Plan CLI, and links the new handoff from + the old one. It needs its own fresh native full profiles and unchanged freshly fetched Design context before merge. + +- Additional [Design#35](https://github.com/ArcForges/ArcForges-Design/pull/35), merge 2d9995e78c4aa0f6327371ab0b5639857718da5c, aligned AD-0004 and the common replay summary before source merge; both native full legs passed (Windows 3/26 s, Linux 3/45 s). It is the Design context used by this Plan record. + +## Remaining and boundaries + +105 list items: 35 disposed, 67 open, 2 deferred, 1 blocked. MR-15 is next, not started: investigate the historical +CrashConsistencyTests(420) all-secrets-unavailable observation from retained logs/UnavailableReason; nonrecurrence does +not establish its cause or a repair. Do not repeat a timed-out launch without checking logs/processes/products first. + +MR-16 stays blocked: no real Windows Credential Manager cleanup/stress or orphan credential-file operations; preserve +the recovery proposal. MR-07/AR-20 and MR-11/AR-21 stay unresolved/deferred. Other acceptance-register limitations, +including successful real Windows adoption AR-19, remain. No LAN/cloud MCP implementation or new/deployed DB migration. + +## Resume safely + +Use only the native Windows and Linux MCP servers for host actions, discover tools afresh, and test connections. +Windows root C:/MyFile/Projects/ArcForges; Linux root /home/sammiller/arcforges. No direct executor, SSH or WSL fallback. +Refresh GitHub PRs/statuses, git refs, all applicable AGENTS/governance and Design, and actual processes/logs. +Recorded SHAs and PIDs are historical evidence, never live state. Preserve all worktrees, user changes and ignored caches. +Primary checkouts intentionally remain stale; use fresh origin/main and task worktrees. + +Windows source worktree: ArcForges/.worktree/mr-14 (clean detached final head). +Linux source worktree: ArcForges/.worktree/mr-14 (task/mr-14, clean final head). +Plan reusable Windows worktree: Plan/.worktree/maintenance-resume-2026-10-25, branch plan/maintenance-mr14-purge-erasure. +Formal logs remain under each repository's .git/arcforges-verify/logs; mr14-* wrapper logs are in the hosts' dev/logs or logs. +Never terminate the Linux user systemd manager, use pkill -f or daemon-reload. Keep formal hosts free of competing tests. +Work alone under the owner's instruction; use truthful OpenAI Codex attribution and direct review. diff --git a/maintenance/2026-10-26-mr14-validation.md b/maintenance/2026-10-26-mr14-validation.md new file mode 100644 index 0000000..a8cde78 --- /dev/null +++ b/maintenance/2026-10-26-mr14-validation.md @@ -0,0 +1,105 @@ +# MR-14: live SQLite sealed-value erasure, 2026-10-26 + +MR-14 is fixed. Design#34 merged first as 3df9db7946e9af6fd1e43f97216adfc44fd55507. +The additional direct-review finding in the common idempotency summaries was resolved in +[Design#35](https://github.com/ArcForges/ArcForges-Design/pull/35), merge 2d9995e78c4aa0f6327371ab0b5639857718da5c, +reviewed head f45a6f2deae5d02a0256b4a5fa7f57ab1fc9cb41, tree 1e93ab47a607ee7f4ccdafe57b8659b8a911da2f. +Its complete native Windows 3 steps/26 s and Linux 3 steps/45 s +passed before implementation merge; all results and both required statuses were read. AD-0004 and contracts README +now distinguish the stored logical outcome from the transient known-HAPPENED checkpoint error on replay, without +replacing dedup bytes or repeating deletion. No source/profile input changed; the source checks use the same final head. +ArcForges#56 merged as 5fa2ad5fe77bef791b96db11129b3851fe55c940, reviewed head 0d261bbe1d48f3c1e9848c15f32a26132cf030da, +tree 852d5472ff079f9df9debe57a1a3329f8bc0faf9, base 448e28dc247fb4234607cc4e811f3723f53e9b31. + +- [Design#34](https://github.com/ArcForges/ArcForges-Design/pull/34), [design review](https://github.com/ArcForges/ArcForges-Design/pull/34#issuecomment-6405954167), [gate](https://github.com/ArcForges/ArcForges-Design/pull/34#issuecomment-6405967642). +- [ArcForges#56](https://github.com/ArcForges/ArcForges/pull/56), [author evidence](https://github.com/ArcForges/ArcForges/pull/56#issuecomment-6406450264), [direct review](https://github.com/ArcForges/ArcForges/pull/56#issuecomment-6406450558). +- Final source gate: https://github.com/ArcForges/ArcForges/pull/56#issuecomment-6406691491. + +## Diagnosis and repair + +The original secure_delete=ON pragma was already present. The confirmed gap was post-commit checkpoint handling: +manual PurgeTaskRecord did not checkpoint at all, so it acknowledged success with old ciphertext still present in the +main database/WAL. A retention purge attempted a checkpoint only when it changed rows; a held older read snapshot +could block it, and the next pass changed zero rows and never retried physical erasure. + +Manual purge now attempts a truncating checkpoint after the command and its logical dedup response commit, including +identical-command replay. A busy checkpoint or SQLite exception produces the existing INTERNAL/internal error with +known effect HAPPENED and AFTER_TIME advice. It never implies rollback or overwrites the stored logical result: +ApiCommands parses the stored bytes into a new response before this post-commit step. Release the reader and replay +the identical command to reattempt the checkpoint. A refused logical outcome does not take this path. + +PurgeDue attempts a checkpoint on every pass, including zero newly purged rows. This retains retry across a restart +without a new marker, schema or migration. The returned count is logical purges, not a physical-erasure completion flag. +A long read snapshot can retain old sealed bytes until a checkpoint succeeds; housekeeping uses its existing 10-minute +interval. This is live SQLite-file erasure, without a device/filesystem/external-copy guarantee. MR-13 backup exclusion +stays separate. No key rotation/deletion, real OS-store operation or restricted credential-file operation is introduced. + +## Real before/after evidence + +Test-only baseline dcb10d0ae8e5ce97e45080b64815457c13286420 (tree 703ab467a901a2abe1147280da37639c36749ccf) +has unchanged production from 448e28d. Both native hosts built Release with zero warnings/errors: Windows 13.68 s, +Linux 9.88 s. Each host then had 2 retention failures (0 skips) and 4 own-platform RPC failures (4 opposite-platform +skips), test exit 2, both wrappers drained with exit 0. The retention failure found old ciphertext after a zero-new-row +pass; unblocked manual purge found ciphertext after success; held-reader manual purge incorrectly returned success. + +The initial test-only 1cb7c38a36a771845399d82c5966eb017cefca25 had four compile/analyzer errors: the test used the +wrong sealed-input type and omitted direct cancellation-token references. Neither regression suite nor AOT ran there. +These errors were corrected before the actual failing baseline. They are not product failures or validation passes. + +At the fixed head (Linux author working tree byte-identical; Windows clean fetched head): + +| Check | Native Windows | Native Linux | +|---|---|---| +| Changed-file format and Release build | pass, 0 warnings/errors; build 13.22 s | pass, 0 warnings/errors; build 3.89 s | +| New retention regressions | 2/2, no skips, 13.877 s | 2/2, no skips, 10.783 s | +| New real-RPC purge regressions | 4 passed/4 Linux skips, 10.192 s | 4 passed/4 Windows skips, 7.215 s | +| Full affected Store project | 95 passed/2 platform skips of 97, 13.611 s | 94 passed/3 platform skips of 97, 10.712 s | +| Existing affected TaskService class | 9/9, no skips, 5.512 s | Windows-only class; no new Linux execution claim | +| Host and Bench Native AOT publish | both pass, 0 warnings/errors | both pass, 0 warnings/errors | +| Diff and author wrapper | clean, exit 0 | clean, exit 0 | + +Windows Store skips are the Linux-only directory-mode/Secret Service selection cases; Linux skips are two Windows +mapped-file cases and the Windows Credential Manager denial guard. These are platform skips, never real-store passes. +The new tests use real SQLite/GCM, real old read snapshots and real native attempts through a real RPC node. They +first checkpoint the original cipher into the main DB and prove it is present, then look for three 16-byte fragments +across main/WAL after cleanup. Payloads cover small cells and overflow/free-list pages (Store: 32 and 131072 characters; +RPC: 32 and 8192). They assert known committed error effect, unavailable logical values, identical-ID replay, no new due +row, integrity and unchanged schema. Only the external key backend is isolated; every fixture deletes its own isolated +keys and checks for leaks. New RPC tests run the node in-process; AOT publication/full native profiles are separate +evidence, not a new standalone Native AOT purge-runtime claim. No injected I/O failure was tested. + +Author commands: changed-file dotnet format, dotnet build ArcForges.slnx -c Release --no-restore, dotnet test --project +tests/ArcForges.Node.Store.Tests --filter-class ArcForges.Node.Store.Tests.SecretPageErasureTests -c Release --no-build, +the analogous PurgeSecretErasureTests class in Node.Core.Tests, the full Store project, the Windows TaskServiceTests +class, and affected Host/Bench AOT publishes (Windows eng/publish.ps1 with the two-element component array in the +installed MSVC environment; Linux python3 eng/verify_linux.py publish host,bench). Exact commands, durations and exits +are retained in mr14-before2 and mr14-author scripts/logs on each host. The original mr14-before compile-only logs remain. + +## Final pushed-head merge gates + +Both legs ran python eng/verify.py run-and-report, at the exact head/tree above. All results and engine-reported required +statuses were read before merge; the owner-hosted checks were skipped as expected. No competing build/test ran on the +same host. Direct self-review by OpenAI Codex under the explicit single-model/no-agent instruction left no unresolved issues; +no independent reviewer or other model/agent is claimed. No assertions, bounds, hooks or required checks were weakened. + +| Repository | Windows | Linux | +|---|---|---| +| Design, head bebad6a2e5f83d7c39d34229e2168dd31c97a5be | full 3 steps/15 s, all pass | full 3 steps/34 s, all pass | +| Design follow-up, head f45a6f2deae5d02a0256b4a5fa7f57ab1fc9cb41 | full 3 steps/26 s, all pass | full 3 steps/45 s, all pass | +| ArcForges, head 0d261bbe1d48f3c1e9848c15f32a26132cf030da | full 13 steps/1148 s, all pass | full 16 steps/1364 s, all pass | + +Source summary IDs: Windows 20261026-015108-0d261bbe1d48-win; Linux 20261026-091249-0d261bbe1d48-linux. +Design summary IDs: Windows 20261026-010658-bebad6a2e5f8-win; Linux 20261026-090652-bebad6a2e5f8-linux. +Design follow-up summary IDs: Windows 20261026-021046-f45a6f2deae5-win; Linux 20261026-095744-f45a6f2deae5-linux. +Windows full summary: C:/MyFile/Projects/ArcForges/ArcForges/.git/arcforges-verify/logs/20261026-015108-0d261bbe1d48-win/summary.json. +Linux full summary: /home/sammiller/arcforges/ArcForges/.git/arcforges-verify/logs/20261026-091249-0d261bbe1d48-linux/summary.json. +Wrapper logs: C:/MyFile/Projects/dev/logs/mr14-*.out/.err/.exit and /home/sammiller/arcforges/logs/mr14-*.out/.err/.exit. + +## Record and stopping point + +The maintenance list is updated to fixed; one AF-NODE-02 completion note is appended through tools/plan.py ledger +after the implementation merge. No delivery-graph state changes or later feature activation. +The owner subsequently asked to finish MR-14 and stop to adjust context to 872000. This supersedes automatic continuation: +MR-15 is next and remains unstarted. MR-16 remains blocked. List totals after MR-14: 35 disposed, 67 open, +2 deferred-validation items (MR-07/AR-20 and MR-11/AR-21), 1 blocked item (MR-16), 105 total. +See [current handoff](2026-10-26-handoff.md); refresh all refs, host processes and MCP tools on any later resumption.