[SVG-RELEASE-D] Qualify the current public Typed SDD backend, refusal and lifecycle/bundle receiver contract #4849

Activity

1. EHotwagner

   added a parent issue on Oct 23, 2026

   • [SVG-RELEASE-D] Qualify and activate the current Release-D coherent receiver successor #4644
2. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Programme/root CONDITIONAL source selection for the first genuine current-public D5 REHEARSAL only. This supplies the exact source admission URL; it does not dispatch an operation. Accountable owner remains the same4849 worker.

   Reviewed scope: fixed raw-omitted, provider-omitted and wizard-omitted receivers; actual default quint-specification-v1 backend author/inspect plus exact wrong-profile refusal with unchanged owned files and original managed first-cause/EOF/retirement evidence. Full raw-plus42 matrix requires a separate later admission and remains open. Public tuple remains Templates0.19.3, SDD2.4.0, Wizard0.22.0, overlay0.18.2 at their already selected exact hashes/source commits. SDK10.0.401/runtime10.0.12, Go1.24.1 exact archive and canonical main.go/LMT recipe and pinnedQuint remain unchanged.

   Source activation may replace ADMISSION=None with this comment URL and literal-false receiver gate with exact manual/main/attempt1 admission gating. PR-only compiled preflight, source-enforced rehearsal scope at CLI and actual entry, earliest original first-step clock, canonical ac222065/d846dbe managed owner, closed original input/executable identities and bounded evidence collection must remain. Integrate actual protected DOM delivery before first push and reconcile the real shared-reader/adapter seals; no functional overwrite or stale catalogue.

   Prospective profile: one NEW ubuntu24.04 VM, CPU2/8GiB/swap0/Tasks512 delegated unit,1800s runtime/5s stop, original first-step2100s workflow, Root observer2400s including at most300s queue/setup. Same original cumulative setup720/generation360/backend480/collection120/cleanup30/overhead90; no phase/command clock renewal. Actual capacity must prove CPU2, available memory10GiB and staging20GiB before acquisition, with actual namespace/backing/writer/reservation facts;439+46 Unknown holds remain unreleased. Every command uses the canonical owner. Probe the unchanged literal unshare user/map-root/net route with LANG=C.UTF-8/TZ=UTC after unit/capacity guards and BEFORE SDK/Go/assets. Failure stops the original operation: no sysctl, alternate backend or security-policy fallback. Host sandbox availability and success-fit are unmeasured.

   Before any dispatch Root must independently accept final exact activated source and current-head required CI, verify its normal protected merge, refresh complete workflow/run census and reservations, and write one original possible-send intent with actual selected SHA/UTC and absolute observer deadline. At most ONE POST; ambiguous outcome uses read-only recovery, never a second POST or rerun. Latest first dispatch under this conditional source selection is00:10UTC2026-10-24; an unused expired selection is not renewed. Root records actual selection separately. No runtime clock begins at this comment or source preparation.

   Acceptance requires genuine original managed receipts and uncapped EOF/containment/reaping/empty removal for every command, independent same-boot InvocationID/cgroup-inode/MainPID-birth unit retirement, original failures and bounded immutable terminal evidence. Exit0 or a source merge alone cannot qualify a receiver. No browser/AT/full4849/4644/provider physical disposal or historical reservation release is granted.
3. EHotwagner commented on Oct 23, 2026

   

   EHotwagner

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Prospective SOURCE-ONLY replacement of the unused conditional selection6376768563. No D5 dispatch, run identity, runtime possible-send intent or native operation clock has begun; the final source is still unpublished. The actual protected-source integration and required CI wait has not completed, so this new source selection uses a realistic later first-dispatch cutoff. Preserve the old unused conditional selection as history; this starts no runtime clock and renews no original operation. Use this NEW comment URL in the final reviewed activation source.

   Programme/root CONDITIONAL source selection for the first genuine current-public D5 REHEARSAL only. This supplies the exact source admission URL; it does not dispatch an operation. Accountable owner remains the same4849 worker.

   Reviewed scope: fixed raw-omitted, provider-omitted and wizard-omitted receivers; actual default quint-specification-v1 backend author/inspect plus exact wrong-profile refusal with unchanged owned files and original managed first-cause/EOF/retirement evidence. Full raw-plus42 matrix requires a separate later admission and remains open. Public tuple remains Templates0.19.3, SDD2.4.0, Wizard0.22.0, overlay0.18.2 at their already selected exact hashes/source commits. SDK10.0.401/runtime10.0.12, Go1.24.1 exact archive and canonical main.go/LMT recipe and pinnedQuint remain unchanged.

   Source activation may replace ADMISSION=None with this comment URL and literal-false receiver gate with exact manual/main/attempt1 admission gating. PR-only compiled preflight, source-enforced rehearsal scope at CLI and actual entry, earliest original first-step clock, canonical ac222065/d846dbe managed owner, closed original input/executable identities and bounded evidence collection must remain. Integrate actual protected DOM delivery before first push and reconcile the real shared-reader/adapter seals; no functional overwrite or stale catalogue.

   Prospective profile: one NEW ubuntu24.04 VM, CPU2/8GiB/swap0/Tasks512 delegated unit,1800s runtime/5s stop, original first-step2100s workflow, Root observer2400s including at most300s queue/setup. Same original cumulative setup720/generation360/backend480/collection120/cleanup30/overhead90; no phase/command clock renewal. Actual capacity must prove CPU2, available memory10GiB and staging20GiB before acquisition, with actual namespace/backing/writer/reservation facts;439+46 Unknown holds remain unreleased. Every command uses the canonical owner. Probe the unchanged literal unshare user/map-root/net route with LANG=C.UTF-8/TZ=UTC after unit/capacity guards and BEFORE SDK/Go/assets. Failure stops the original operation: no sysctl, alternate backend or security-policy fallback. Host sandbox availability and success-fit are unmeasured.

   Before any dispatch Root must independently accept final exact activated source and current-head required CI, verify its normal protected merge, refresh complete workflow/run census and reservations, and write one original possible-send intent with actual selected SHA/UTC and absolute observer deadline. At most ONE POST; ambiguous outcome uses read-only recovery, never a second POST or rerun. Latest first dispatch under this conditional source selection is01:15UTC2026-10-24; an unused expired selection is not renewed. Root records actual selection separately. No runtime clock begins at this comment or source preparation.

   Acceptance requires genuine original managed receipts and uncapped EOF/containment/reaping/empty removal for every command, independent same-boot InvocationID/cgroup-inode/MainPID-birth unit retirement, original failures and bounded immutable terminal evidence. Exit0 or a source merge alone cannot qualify a receiver. No browser/AT/full4849/4644/provider physical disposal or historical reservation release is granted.
4. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Programme/root selects ONE fresh first genuine D5 rehearsal under6377028965, delivered/reviewed source8179803c31d27490edacb269a51a8aad3d8800cc/tree0c0756092130a421e8a0e015f0b553930b9cfe13, workflow394461426. Exact current-head required CI and normal protected delivery through PR768 are independently accepted. Scope is ONLY raw/provider/Wizard omitted receivers and the actual two-root backend/refusal journeys; full43 and whole4849/4644 remain open.

   Root reviewed the concrete fixed public tuple,11source seals, actor, dispatch-only/main/attempt1 gates, source-enforced rehearsal, executable successors and earliest native clock. The final adjacent actor/main/source/manual census checks run BEFORE a durable one-POST intent. Actual selectedUTC is recorded once there, latest-start=selected+300s and observer=selected+2400s; no preparation/comment clock is reused. Latest firstPOST01:15UTC remains. Absent/ambiguous identity uses only read-only recovery, never resend/rerun/cancel/renewal.

   The selected new VM must prove actual CPU2/available10GiB/staging20GiB and original unit/cgroup/birth facts before assets; unit2CPU/8GiB/swap0/Tasks512/1800s+5stop and originalfirststep2100s remain. Root retains all439+46 Unknown holds and the separately named earlier-three accidental Python hold; no zero reservation, provider disposal or shared-host release is inferred. Hosted CI waits do not supply VM capacity. Before SDK/Go/packages the actual unchanged-host user/network namespace probe must pass; failure stops this original without sysctl/security/backend fallback.

   All commands require canonical original managed receipts, exact source/profile/input/image joins, uncapped EOF, contained/reaped/empty removal and independent same-boot InvocationID/cgroup-inode/MainPID-birth unit retirement. Native UTC trust/skew limits remain. Artifact acquisition/readback is separately bounded after the native result and cannot renew its work clock. Root will preserve the first cause and scoped failure/Unknown if any gate refuses; no acceptance follows from a successful dispatch or source merge.
5. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Programme/root accepts the scoped original failure and retirement, following independent readback of run40047202735/attempt1 on protected source8179803c31d27490edacb269a51a8aad3d8800cc (delivered PR768). The single original POST under Root’s final selection was recovered read-only; no second POST, rerun or cancellation occurred.

   Primary failure: managed group setup-002-unshare exited1; original stderr is unshare: write failed /proc/self/uid_map: Operation not permitted. The exact namespace probe failed before SDK/Go/public-package acquisition, receiver creation or backend/browser qualification. Precise host-policy cause is unresolved; the error alone does not establish AppArmor, seccomp, kernel-policy or dumpability attribution. No fallback or host-policy change occurred.

   Independent custody verified original artifact12541488846, current-d5-rehearsal-40047202735-1, raw ZIP SHA256 d92b514c0306c8874d1fd6a48d85cb9affd535800fb76867b4d2487beb99b4e4: one download,21 safe members, all15 indexed entries verified. Original attempt bytes and primary cause remain intact. Terminal collection separately records D5 reporting/collection: ValueError: D5 collection incomplete; executable-identities.json and input-downloads.json were NOT PRODUCED. This collection secondary does not replace the namespace failure.

   Both managed groups have verified contained receipts, stdout/stderr EOF, reaped leaders and empty/removed leaves. Independent same-boot readback verifies original unit/cgroup/MainPID birth absence; the bounded artifact receiver retired with all HTTP children terminal/reaped. Original Root UTC inputs, source/run/attempt/boot and fixed clock projection join; native UTC trust/skew is not independently authenticated. Provider physical disposal remains Unknown.

   This accepts failure evidence and scoped retirement only. All three rehearsal receivers and the full raw-plus42-case matrix (43 receivers) remain unqualified; #4849 and parent #4644 stay open. All439+46 Unknown holds and the named earlier-three Python hold remain. Root selected a separate isolated metadata-only source diagnostic from817 to retain missing pre-unshare facts, with no policy/argv/resource change. Review, required CI, protected delivery and a fresh explicit Root admission must precede any successor runtime; consumed grants/clocks cannot be reused. Existing accepted clean-creation and separate scoped #4816 evidence retain only their original scope.
6. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Conditional SOURCE selection: one fresh D5 diagnostic successor, no native dispatch selected.

   Root selects reviewed parent-only diagnostic sourcef857f2e26614369f1b9cf658e461f056b60cdb4e for integration with the maintained original-clock first-rehearsal route. Original40047202735/a1 remains FAILED at UID-map write denial; scoped retirement acceptance6378074235 remains unchanged. Parent metadata does not prove post-CLONE cause. Preserve the literal probe, optional-failure isolation, original stderr/attempt/terminal/manifest/upload, canonical managed ownerac222065/d846dbe1, exact current public pins and unchanged2CPU/8GiB/Tasks512/1800s unit/2100s first-step profile.

   This NEW source condition expires for the first dispatch at2026-10-24T03:30:00Z. Only after exact integrated independent review, current-head CI, actual protected delivery and fresh source/run/capacity joins may Root separately select ONE fresh first-rehearsal original. Actual selectedUTC=T0 immediately before its one possible-send intent/POST; latest first-step=T0+300s; observer end=T0+2400s. Seal/project the exact three fields once and preserve original-clock refusal/metadata even on early failure. Old6377028965 and the failed original's times are not renewed or replayed. No actual T0, run, profile change or new operation is selected here.

   Integrate this shared helper/pin/Atlas change through existing PR769 with the earlier-three clock change when coherent; retain this separate4849 acceptance/condition. No host policy, NNP/capability/sysctl/backend change, SDK/global selector/cache repair, full43-cell acceptance, provider disposal or release of439+46+named earlier-three Unknowns follows.
7. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   D5 diagnostic original 40057752243/a1 — scoped acceptance

   Root accepts the original failure evidence and scoped retirement for run40057752243/a1, protected source 3b7cd90e, under the used condition6378268333. The one original POST used T0 2026-10-24T03:18:15.538559Z, latest first step 03:23:15.538559Z, observer end 03:58:15.538559Z; no rerun, resend or clock renewal follows.

   The unchanged literal namespace prerequisite failed at the UID-map write with exit1/Operation not permitted. The original first cause is retained; incomplete collection is secondary because later executable/input metadata was not produced. Independent review verified artifact12546420237 (SHA256 4ec06657a40c870ce4aff0d00c0d12be61ca8c2e32a3d5671c28cc7103c91906), original source/request/clocks, two contained groups with EOF/reap/empty removal, and the original outer unit identity joined to bounded post-unit/cgroup/birth absence. This is failed-attempt custody and scoped retirement, not a passing rehearsal. SDK/Go/packages/backend and typed receiver semantics were not reached.

   The new diagnostics describe the collector parent before the probe. They do not prove the child's post-CLONE state, an AppArmor cause, or a policy remedy. Provider physical disposal and universal metadata-descendant containment remain Unknown. Original40047202735, current initial census uncertainty/log-reader refusal, collection secondary, and all439+46 plus named earlier-three holds remain preserved.

   Root and the source owner are considering a bounded kernel-audit/loaded-policy/package-source observation for the same prerequisite, only after separate source/profile/condition review. No such activation or native operation is selected; NNP, namespace flags and policy remain unchanged. Full #4849/#4644 acceptance remains open.
8. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Root decision — 2026-10-24 ~15:10 UTC, fdev (Programme/root), under the repository owner's explicit delegation in the interactive session ('you decide the rest').

   User-namespace prerequisite. On ephemeral GitHub-hosted runners only, the diagnostic or qualification job may run the reviewed step sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 before the backend starts, and record the before/after value. This is a controlled A/B test of the AppArmor hypothesis, not an inference of it. It is never applied to Home or self-hosted machines. The NNP/namespace flags and the backend stay unchanged. If the denial persists with the restriction off, AppArmor is ruled out and the original diagnosis continues.
9. EHotwagner commented on Oct 24, 2026

   

   EHotwagner

   on Oct 24, 2026

   ContributorAuthor

   More actions

   fdev, Templates/D5 source owner (successor to resume_census4823): AppArmor A/B result for the user-namespace prerequisite. AppArmor restriction is the cause on GitHub-hosted ubuntu-24.04.

   Executed under Root decision 6385676372. Hosted ephemeral runners only; nothing was applied to Home or self-hosted machines.

   Source. Templates#772 merged as a946a7eca5fcf8f5be937b6ebffcbf7ce668dcf5 (reviewed head d04b3bede4630cb2e71124eeed5457348356c444). It adds a dispatch-only, observation-only workflow svg-release-d5-userns-ab.yml plus tests/composition/fable-game/d5-userns-ab-probe.py. The existing D5 workflow, gates and clocks are untouched. One independent review (fsgg-critic-normal): first head a2ad0e30 REQUEST CHANGES (the runner context is invalid in job-level env, so the file could not run; GitHub had already rejected it); repaired on the same PR, second review ACCEPT on d04b3bed. All required checks passed; squash-merged.

   Run. 40116649986 / attempt 1, workflow_dispatch on main a946a7ec, one POST, no rerun. Both matrix arms are separate fresh ubuntu-24.04 github-hosted VMs (kernel 6.17.0-1022-azure, user runner uid 1001). Artifacts: userns-ab-A-40116649986-1, userns-ab-B-40116649986-1 (30-day retention). Each arm ran the unchanged literal unshare --user --map-root-user --net -- /usr/bin/true (LANG=C.UTF-8, TZ=UTC) both directly and inside a transient unit with the D5 unit properties (NoNewPrivileges=yes, Delegate, CPUQuota=200%, TasksMax=512, MemoryMax=8G; only RuntimeMaxSec is 300 instead of 1800), plus a post-CLONE probe (unshare(CLONE_NEWUSER) in a child, then setgroups/uid_map writes).

   	Arm A (runner default)	Arm B (sysctl -w kernel.apparmor_restrict_unprivileged_userns=0)
   apparmor_restrict_unprivileged_userns before -> after	1 -> 1	1 -> 0
   literal probe, direct	exit 1, unshare: write failed /proc/self/uid_map: Operation not permitted	exit 0
   literal probe, NNP unit (NoNewPrivs: 1)	exit 1, same stderr	exit 0
   post-CLONE unshare(CLONE_NEWUSER)	ok, then /proc/self/attr/current = unprivileged_userns (enforce); setgroups write EACCES, uid_map write EPERM	ok; attr unconfined; setgroups ok, uid_map ok
   kernel/audit lines	AppArmor denials (below)	none

   Exact denial evidence (arm A, readable via dmesg, repeated in journalctl -k). For each unshare and python3 probe, in order:

   • apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns create - transitioning profile" profile="unconfined" comm="unshare" requested="userns_create" target="unprivileged_userns" execpath="/usr/bin/unshare"
   • apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" comm="unshare" capability=21 capname="sys_admin"

   (Likewise for comm="python3", /usr/bin/python3.12.) In arm B no AppArmor line appears and dmesg has no denial. Parent-side facts from the failed D5 attempt 40057752243/a1 agree: AppArmor enabled, restriction 1, attr unconfined, NNP 1.

   Interpretation.

   • AppArmor's Ubuntu 24.04 unprivileged-userns restriction is the cause: the namespace is created, the process is moved to the unprivileged_userns profile, and that profile denies CAP_SYS_ADMIN in the new namespace, so the uid_map write fails with EPERM. Turning the restriction off with everything else unchanged makes the identical literal probe pass, including under NNP.
   • NNP, setgroups, the namespace flags and the argv played no differentiating role: the probe passes in the NNP unit once the restriction is off, and fails with NNP off while it is on.
   • Caveat: the two arms landed on different runner image versions (A 20261023.334.3, B 20261012.334.1), though both had restriction 1 before the arm step and the same kernel, and the arm-B flip is the only changed setting. n = 1 per arm. This is a prerequisite result only: no SDK, Go, package, backend or receiver was reached, so it qualifies none of the 43 D.5 receivers.

   Next step (proposed, not yet applied). Make the sysctl a permanent reviewed step of the hosted qualification profile for the D5 rehearsal (and the #4816 retained-reference rehearsal), placed after the unit/capacity guards and before the unit starts, recording before/after in the original outer evidence. That edits the gated D5/4816 workflow source and needs a fresh Root admission before any original dispatch (the earlier conditional selections have expired and are not renewed here). No original D5/4816 dispatch, policy change, Status write, package publication or Home effect was made. NNP/capabilities/namespace flags/backends stay unchanged.
10. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, Templates/D5 source owner: permanent hosted step delivered for D5; D5 dispatch and #4816 activation remain gated.

    • Templates#773 merged as 5d95c3daf24aa57c0c72c8e7c6aab1fa2be8aa7c (reviewed head 5844bf10, independent review ACCEPT after one REQUEST CHANGES: an incidental comment edit to d5-managed-runtime.py broke the sealed D5_SHA join in current-composition-managed.py and turned the composition preflight red; reverted, file byte-identical to main). It adds to the held D5 receiver job one hosted-only step, after the capacity guard and before the delegated unit: requires RUNNER_ENVIRONMENT=github-hosted, records kernel.apparmor_restrict_unprivileged_userns before and after in current-d5-<run>-1-userns/ (added to the uploaded evidence), runs exactly sudo -n sysctl -w kernel.apparmor_restrict_unprivileged_userns=0, and fails closed unless the value reads 0. NNP, unit properties, namespace flags, the literal probe and the backend are unchanged. New HostedUsernsStepControls tests assert scope, order and the unchanged unit.
    • Templates#774 merged as ff744ada8de92a4391ea82501d6ef7960a6055c5: Atlas record templates/hosted-userns-apparmor-restriction (finding, caveats n=1 and differing image versions, no authority).
    • The D5 workflow remains held behind its admission, attempt-1/main and original-clock gates; its conditional selection 6378268333 expired at 2026-10-24T03:30:00Z and is not renewed, so the new step has not run in a D5 dispatch and no D5 receiver is qualified.

    Needed from Root to continue D.5 (not done by me). A fresh conditional source selection with a new first-dispatch cutoff and new UTC fields for the D5 rehearsal (the activation source currently hard-codes the 03:30Z cutoff and ADMISSION), then exact review/CI/merge of that activation, then one Root-selected original dispatch under the usual one-POST intent. The first checks in that rehearsal will now be: the hosted step (userns/after.txt = 0), the literal namespace probe, then SDK/Go/packages/backend, which have never been reached on current public inputs.

    #4816. The shared retained-reference-rehearsal.yml (earlier-three and current-reference jobs) needs the same hosted-only step before its own activation; its owner/PR is separate and was not edited here. The tests in #773 give a template.
11. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root (fdev) decisions on the AppArmor A/B result, 2026-10-24. This supersedes the expired condition 6378268333; nothing of it is renewed or replayed.

    1. A/B accepted as conclusive (run 40116649986). On GitHub-hosted ubuntu-24.04, kernel.apparmor_restrict_unprivileged_userns=1 causes the UID-map EPERM. The kernel audit lines userns_create → unprivileged_userns and DENIED capable sys_admin are sufficient. No repeat on a matching image is required.
       • The hosted-only sysctl step merged in FS.GG.Templates#773 (5d95c3da) is the accepted permanent hosted-profile prerequisite. It applies to GitHub-hosted runners only, never Home or self-hosted.
    2. New conditional SOURCE selection for one fresh D5 first-rehearsal original:
       • Source: FS.GG.Templates protected main at or after 5d95c3daf24aa57c0c72c8e7c6aab1fa2be8aa7c, including parity: a starved queue is not an empty one — the engine tells #488's four outcomes apart by per-item reasons, not bash's count (#488, case 45) #773's step. The activation source's hard-coded cutoff must be updated to this new condition.
       • Condition expiry for the first dispatch: 2026-10-25T06:00:00Z.
       • Original profile, unchanged: 2 CPU / 8 GiB / Tasks 512 / 1800 s unit / 2100 s first step.
       • Clock fields: selected UTC = T0, immediately before the one possible-send POST; latest first step = T0+300 s; observer end = T0+2400 s. Seal and project these exactly once, and keep original-clock refusal on early failure.
       • Before Root's separate selection of the actual dispatch: independent review of the activation-source update, current-head CI, protected merge, and fresh source/capacity joins.
       • Delegation: given the user's request to minimize round-trips, Root delegates the actual single-dispatch selection to the [SVG-RELEASE-D] Qualify the current public Typed SDD backend, refusal and lifecycle/bundle receiver contract #4849 owner. This holds once all of the above are read back, and the owner records the T0 intent before the POST. One dispatch only, no retry of an uncertain send.
    3. FABLE-ADOPT-01 child: promised preserving upgrades and interrupted/conflict/rollback cases #4816: its original implementation owner is stopped, so Root assigns the same hosted-only step for retained-reference-rehearsal.yml to the [SVG-RELEASE-D] Qualify the current public Typed SDD backend, refusal and lifecycle/bundle receiver contract #4849 owner. Reconcile with any in-flight PR (e.g. Templates PR769) on that PR rather than opening a competing one.
12. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 first-rehearsal ORIGINAL possible-send intent (recorded before the POST).

    Delegated by Root (6387729342). Source: protected main 026d239948ff696dcbdc41761b3265d182ad406e (#775 reviewed head 3e41ed26, ACCEPT; required PR-head CI green; #773 hosted AppArmor step included; D5 files equal the reviewed head). Workflow svg-release-d5-current-public.yml, ref main, scope rehearsal, attempt 1. Public pins: emitted d5-current-public.py pins output (Templates 0.19.3 / SDD 2.4.0 / Wizard 0.22.0 / overlay 0.18.2), equal to the pins of the failed attempt 40057752243.

    • selected_utc (T0): 2026-10-24T18:31:35Z
    • latest_start_utc: 2026-10-24T18:36:35Z
    • observer_deadline_utc: 2026-10-24T19:11:35Z

    Census just before this intent: no queued or in-progress run of this workflow; no other D5 original in flight. Exactly ONE POST follows this comment; an uncertain outcome is recovered read-only, never resent or rerun. Unchanged: 2 CPU / 8 GiB / Tasks 512 / 1800 s unit / 2100 s first step; hosted-only sysctl step records before/after; 439+46 and earlier-three Unknown holds untouched.
13. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 first-rehearsal ORIGINAL 40121103111/a1: FAILED at the receiver backend check, far past the namespace prerequisite. No receiver is qualified. The failure is a qualifier-source defect.

    Dispatch. One POST under Root's delegation (6387729342); intent recorded first at 6387964714. T0 2026-10-24T18:31:35Z, latest first step 18:36:35Z, observer end 19:11:35Z. POST at 18:31:32.99Z, original first step observed 18:31:45.68Z (accepted), no resend/rerun/cancel. Source: protected main 026d239948ff696dcbdc41761b3265d182ad406e (D5 files equal the reviewed #775 head 3e41ed26; #773 step included). Workflow svg-release-d5-current-public, ref main, scope rehearsal, attempt 1, pins equal to the pins emitted by d5-current-public.py pins. Artifact current-d5-rehearsal-40121103111-1 (id 12571565869, API digest sha256:026e2e7bd7a6dd7926ac04146e91cb9a05a70b66a541af93bab46e2a63d35f51), downloaded once to /home/developer/.cache/release-d-4849/run2.

    Reached (new beyond 40047202735 and 40057752243):

    • Hosted step: kernel.apparmor_restrict_unprivileged_userns 1 -> 0 (userns/before.txt, set.txt, after.txt).
    • The literal unshare --user --map-root-user --net prerequisite passed (managed groups 001-022 setup all exit 0), then SDK, Go, the four public packages, ProviderTool build, quint/lmt.
    • Receiver creation and current-d5-receiver-check all passed under managed custody: raw-omitted (024/025: raw dotnet new fs-gg-fable-game, lifecycle none), provider-omitted (027/028: installed fsgg-sdd scaffold, typed-sdd), wizard-omitted (030/031: omitted Wizard creation, typed-sdd).
    • Backend on provider-omitted with the default quint-specification-v1: typed-sdd provision (032), actual author (034, succeeded/quint-specification-v1, 11 changed paths) and inspect (035, succeeded). Wrong-profile author with fsgg-quint-profile/1 (037) exited 1 with the expected outcome: blocked, changedPaths: [], diagnostic QUINT-PROFILE-IDENTITY ("Expected 'fsgg-quint-profile/2', got 'fsgg-quint-profile/1'"); the before and after owner snapshots are identical (271 files).

    Failure. firstCause: managed group installed-038-dotnet failed: command failed with exit 1. 038 is ProviderTool current-d5-backend-check, stderr provider-tool: current-d5-backend-or-preservation-refused. Cause, by reproduction: validateCurrentD5Backend (src/FS.GG.Templates.ProviderTool/ReferencePublication.fs) requires a work/d5-default/ file in the before-snapshot, a layout invented in its synthetic fixture. Public SDD 2.4.0 typed-sdd author --work d5-default writes only readiness/d5-default/... and models/svg-arena/... (the before-snapshot has no work/ key); typed-authority.json shape (backend/profileIdentity/packageIdentity/artifacts) matches the checker. Replaying the new real-layout fixture against the old code fails with exactly that error; the corrected code passes. So the check, not the product, refused. wizard-omitted backend author/inspect/refusal was never reached (provider-omitted ran first). The full raw-plus-42 matrix is not touched.

    Custody (my readback, not Root acceptance). 38 managed groups: 36 succeeded, 2 failed (037 expected refusal exit 1, 038 checker), all contained, cleanup observed-empty-removed. Outer: client-exit 1, post-unit original-unit-absent (service not-found, no cgroup, no original birth), same boot id f79c5ae1-.... Original clock accepted. Collection terminal failed carries the same first cause (no collection secondary this time).

    Tally. Receivers the run qualified: 0 of 43. Journeys with passing underlying evidence in this failed original (not acceptance): receiver-check passed for 3 of 3 rehearsal receivers (raw, provider, wizard omitted); default-backend author/inspect plus wrong-profile refusal evidenced on 1 of 3 (provider-omitted) but not accepted by the checker.

    Next (source only). Fix the checker to the real layout (prefix readiness/d5-default/quint/ instead of work/d5-default/; real-layout fixture): PR follows with independent review and CI. A second original dispatch needs a NEW Root selection; Root's delegation covered this one POST only and is consumed. No Status writes, publication or Home effects.
14. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: corrective source delivered. Templates#778 merged as 3790979c1de1a89222f75da11485afb8b335271b (independent review ACCEPT on a78b2929: replayed against the real 271-entry snapshot from 40121103111; the old checker refuses it, the corrected one passes; no other backend-check condition found failing, wizard-omitted expected to pass; ProviderComposition.Tests 240 PASS; required CI green). Templates#779 merged: Atlas lesson record. No second original has been dispatched: the Root delegation covered one POST and is consumed (original 40121103111/a1 failed, retained, not rerun). Remaining: a NEW Root conditional selection (and delegation, if wanted) for one fresh first-rehearsal original on main at or after 3790979c; the activation cutoff 2026-10-25T06:00:00Z from 6387729342 would still be open to a new selection. Still open: all 43 receivers, the wizard-omitted backend journey, the raw-plus-42 matrix, #4849/#4644 acceptance, plus #4816 (its own selection and cutoff update needed).
15. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root (fdev) decisions after original run 40121103111/a1, 2026-10-24. This supersedes condition 6387729342, which was consumed by that one dispatch. Nothing of it is renewed or replayed.

    Run 40121103111/a1: accepted as a failed original with useful scope.

    • It reached SDK, Go, package, quint and lmt acquisition, and receiver creation and checks for all three rehearsal receivers.
    • The provider-omitted default backend journey passed: provision, author, inspect, and wrong-profile refusal.
    • It then failed at current-d5-backend-check. The cause is a fixture-only layout assumption (work/d5-default/), fixed in FS.GG.Templates#778 (3790979c).
    • 0/43 receivers qualified. The owner's custody readback is noted. The original is not replayed.

    New conditional SOURCE selection for one fresh D5 first-rehearsal original.

    • Source: FS.GG.Templates protected main at or after 3790979c. Bind the activation source's cutoff to this condition.
    • Expiry for the first dispatch: 2026-10-25T09:00:00Z.
    • Profile and clock fields are unchanged from 6387729342: T0, then T0+300 s for the first step, then T0+2400 s for the observer end.
    • Delegation: the same as before. Once review, current-head CI, protected merge and fresh joins are read back, the [SVG-RELEASE-D] Qualify the current public Typed SDD backend, refusal and lifecycle/bundle receiver contract #4849 owner makes the single dispatch, recording the T0 intent before the POST. No retry of an uncertain send.

    New precondition, from this failure's lesson.
    Before the dispatch, run every receiver-side checker in the path offline against the REAL retained snapshot from run 40121103111, not only the synthetic fixtures. Fix any further fixture-only assumptions first.

    #4816 earlier-three.

    • A separate fresh conditional selection is issued on the same terms: source at or after b6772917, bound to its own cutoff, expiry 2026-10-25T09:00:00Z.
    • It is delegated to the same owner as one dispatch. Run it only AFTER the D5 rerun's terminal outcome is read back, so the two originals never overlap.
16. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 first-rehearsal ORIGINAL (rerun) possible-send intent (recorded before the POST).

    Delegated by Root (6387729342). Source: protected main 4a6a336012f122a8bc7e221d9772da020ef3f01c (#780 reviewed head 3ddeb9b5, ACCEPT; required PR-head CI green; #778 checker fix and #773 hosted AppArmor step included; main tree equals the reviewed head; offline replay of the receiver-side checkers against the real retained snapshot of 40121103111 done and reviewed). Workflow svg-release-d5-current-public.yml, ref main, scope rehearsal, attempt 1. Public pins: emitted d5-current-public.py pins output (Templates 0.19.3 / SDD 2.4.0 / Wizard 0.22.0 / overlay 0.18.2), equal to the pins of 40121103111.

    • selected_utc (T0): 2026-10-24T19:14:19Z
    • latest_start_utc: 2026-10-24T19:19:19Z
    • observer_deadline_utc: 2026-10-24T19:54:19Z

    Census just before this intent: no queued or in-progress run of this workflow; no other D5 original in flight. Exactly ONE POST follows this comment; an uncertain outcome is recovered read-only, never resent or rerun. Unchanged: 2 CPU / 8 GiB / Tasks 512 / 1800 s unit / 2100 s first step; hosted-only sysctl step records before/after; 439+46 and earlier-three Unknown holds untouched.
17. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 first-rehearsal ORIGINAL (rerun) 40124373443/a1: PASSED. disposition receiver-checks-complete, client exit 0, no failure, no collection secondary. Evidence readback only; qualification/acceptance is Root's.

    Preconditions. Templates#780 merged as 4a6a336012f122a8bc7e221d9772da020ef3f01c (independent review ACCEPT on 3ddeb9b5, required CI green, main tree equals reviewed head, includes #778 and #773) under Root's selection 6388209473. Root's new precondition met: the receiver-side checkers not yet exercised on real data were replayed offline on the real retained trees of 40121103111 (exact quint 0.32.0, lmt rebuilt from the pinned recipe at sha 37e0b036, SDD 2.4.0 from the retained package, real author/inspect/refusal, then the merged backend check: valid for provider-omitted AND wizard-omitted); the critic independently re-ran it and replayed the success-branch collection. No further fixture-only assumption was found, and none surfaced in the run.

    Dispatch. Intent recorded first: 6388406497. T0 2026-10-24T19:14:19Z, latest first step 19:19:19Z, observer end 19:54:19Z. One POST at 19:14:17.67Z, first step observed 19:14:24.41Z (accepted), no resend/rerun/cancel. Run on main 4a6a3360, workflow svg-release-d5-current-public, scope rehearsal, attempt 1, pins equal to those of 40121103111. Artifact current-d5-rehearsal-40124373443-1 (id 12571923852, API digest sha256:25200b980f894a3abc1388adfb9891f57f2afc3a09bafb988fe8b000f65ea966), downloaded once to /home/developer/.cache/release-d-4849/run3.

    Results.

    • Hosted step: kernel.apparmor_restrict_unprivileged_userns 1 -> 0; the literal user/map-root/net namespace probe passed; SDK, Go, public packages, quint, lmt acquired; ProviderTool built.
    • Receivers (creation + current-d5-receiver-check): raw-omitted (raw dotnet new, SVG Player), provider-omitted (installed fsgg-sdd scaffold, typed-sdd), wizard-omitted (omitted Wizard creation, typed-sdd) all passed.
    • Default quint-specification-v1 backend, for BOTH provider-omitted and wizard-omitted: typed-sdd author succeeded (11 changed paths each), inspect succeeded; wrong-profile author --profile fsgg-quint-profile/1 (managed groups 037 and 043) exited 1 with outcome: blocked, changedPaths: [], QUINT-PROFILE-IDENTITY; the owner before/after snapshots were identical (271 and 276 entries) and current-d5-backend-check passed for both.
    • Custody (my readback): 44 managed groups, 42 succeeded, 2 failed (exactly the two expected refusals 037/043), all contained, cleanup observed-empty-removed; collection manifest 825 files / 46.9 MB of the 1 GiB cap, failures: [], collection-terminal = receiver-checks-complete; client-exit 0; post-unit original-unit-absent on the same boot a3b0f37d-...; retirement field unqualified (the harness default pending Root).

    Tally (candidate, pending Root acceptance). Rehearsal receivers evidenced: 3 of 3 (raw-omitted, provider-omitted, wizard-omitted), including the actual default backend author/inspect and wrong-profile refusal on both typed receivers. Of the 43-receiver contract: 3 of 43. Still open: the 40 other receivers (raw-plus-42-case matrix: explicit lifecycle tokens and named SVG bundle selections), independent acceptance, the browser/AT/builds scope, provider physical disposal and the 439+46 holds (untouched).

    Next. #4816 earlier-three runs only now that this terminal outcome is read back. It needs its selection posted on #4816 (the source only accepts a .../issues/4816#issuecomment- admission); requested at #4816 (comment).
18. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root (fdev) acceptance of D5 rerun 40124373443/a1 (2026-10-24)

    Accepted at rehearsal-receiver scope: 3/43 receivers qualified (raw-omitted, provider-omitted, wizard-omitted).

    Run

    • The offline real-snapshot precondition was met first: real quint 0.32.0, lmt 37e0b036 and SDD 2.4.0 replay; both typed receivers valid; critic re-ran it.
    • One dispatch, with T0 19:14:19Z recorded before the POST; first step at 19:14:24Z, inside the window.
    • Source: main 4a6a3360. Client exit 0, receiver-checks-complete.

    Results

    • Hosted userns step 1 → 0; namespace probe passed.
    • All acquisitions succeeded.
    • On both typed receivers, the default-backend author and inspect passed.
    • The wrong-profile QUINT-PROFILE-IDENTITY refusal held, with identical snapshots (271 and 276 entries).

    Custody (owner readback, accepted by Root)

    • 42 managed groups succeeded, plus 2 expected refusals. All contained, with cleanup observed-empty-removed.
    • The original unit is absent on the same boot.
    • Collection: 825 files / 46.9 MB, artifact digest sha256:25200b98….

    Out of scope (none of this is claimed by this acceptance): the remaining 40 receivers, browser/AT/build scope, provider physical disposal, and the 439+46 holds.

    ---

    New conditional SOURCE selection: one fresh full-matrix D5 original (raw-plus-42: explicit lifecycle tokens and named bundle selections).

    • Source: FS.GG.Templates protected main at or after the binding PR for this condition.
    • Expiry for the first dispatch: 2026-10-25T15:00:00Z.
    • Profile: the existing full-matrix profile; if none is maintained, the rehearsal profile scaled per the owner's reviewed proposal.
    • Clock fields: T0 + existing contract.
    • Same delegation as before: a single dispatch by the owner after review, CI, merge and joins.
    • Ordering: dispatch only AFTER the FABLE-ADOPT-01 child: promised preserving upgrades and interrupted/conflict/rollback cases #4816 earlier-three original's terminal outcome is read back. No overlap.
    • Precondition: replay every matrix checker offline against real retained D5 output (run3) first, and fix any fixture-only assumption.
19. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 FULL-MATRIX (raw-plus-42) ORIGINAL possible-send intent (recorded before the POST).

    Delegated by Root (6387729342). Source: protected main 668bc6983ddceb37751b0792ca0d05d3458601ce (#783 reviewed head 9e4d6f65, ACCEPT; required PR-head CI green; main tree equals the reviewed head; #778 and #773 included; offline replay of all 42 case receivers with the real tools and run3 packages done and reviewed). Workflow svg-release-d5-current-public.yml, ref main, scope full, attempt 1. Public pins: emitted d5-current-public.py pins output (Templates 0.19.3 / SDD 2.4.0 / Wizard 0.22.0 / overlay 0.18.2), equal to the pins of 40124373443.

    • selected_utc (T0): 2026-10-24T19:55:34Z
    • latest_start_utc: 2026-10-24T20:00:34Z
    • observer_deadline_utc: 2026-10-24T20:35:34Z

    Census just before this intent: no queued or in-progress run of this workflow or of retained-reference-rehearsal.yml; the #4816 earlier-three original 40125840475 is terminal (passed) and read back, so no overlap. Exactly ONE POST follows this comment; an uncertain outcome is recovered read-only, never resent or rerun. Unchanged: 2 CPU / 8 GiB / Tasks 512 / 1800 s unit / 2100 s first step; hosted-only sysctl step records before/after; 439+46 and earlier-three Unknown holds untouched.
20. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    fdev, #4849 owner: D5 FULL-MATRIX ORIGINAL 40127488229/a1: PASSED. scope: full, disposition receiver-checks-complete, client exit 0, no failure, no additional failure, no collection secondary. Evidence readback only; qualification/acceptance is Root's.

    Preconditions. Templates#783 merged as 668bc6983ddceb37751b0792ca0d05d3458601ce (independent review ACCEPT on 9e4d6f65, required CI green, main tree equals the reviewed head), binding the source to Root's full-matrix selection 6388444491 (cutoff 2026-10-25T15:00:00Z; workflow scope now [full]). Offline replay of every matrix checker first: using the real run3 packages and tools I created all 42 case receivers exactly as run_d5 does and ran the merged current-d5-receiver-check on each (42/42 passed, 134 s on 2 cores), plus wizard hive registrations (21/21 one 0.19.3 row with the pinned archive hash); the critic re-ran the 42 checks, 12 negative mismatches (all refused), 10 cases under the cleared runner-style environment, and a collect over the 12 k-file tree. Ordering: the #4816 earlier-three original 40125840475 was terminal (passed) before this dispatch.

    Dispatch. Intent recorded first: 6388827829 (its prose labels the delegation with the older 6387729342 number by mistake; the linked admission URL, the dispatched admission input and the source are 6388444491). T0 2026-10-24T19:55:34Z, latest first step 20:00:34Z, observer end 20:35:34Z. One POST at 19:55:32.22Z, first step observed 19:56:02.41Z (accepted), no resend/rerun/cancel. Run on main 668bc698, workflow svg-release-d5-current-public, scope full, attempt 1, pins equal to 40124373443. Artifact current-d5-full-40127488229-1 (id 12573164690, API digest sha256:1dbc6bf6f331e58172424d9335b58ea411280f7b9f9229cc74380ff183584990), downloaded once to /home/developer/.cache/release-d-4849/run5.

    Results.

    • Hosted step: kernel.apparmor_restrict_unprivileged_userns 1 -> 0; namespace probe, SDK/Go/packages/quint/lmt all passed.
    • cases.tsv: 42 typed rows, routes provider and wizard x lifecycles omitted, none, sdd, typed-sdd, spec-kit (with the 5 bundle selections for the explicit ones). current-d5-receiver-check ran exactly 43 times under managed custody (raw-omitted + 42) and every one passed: 21 provider scaffold creations, 21 wizard creations, 7 template-hive installs, 21 wizard hive registrations verified.
    • Default quint-specification-v1 backend on the two omitted typed receivers: typed-sdd author and inspect succeeded on provider-omitted and wizard-omitted (11 changed paths each); wrong-profile author (groups 122 and 128) exited 1 with blocked/QUINT-PROFILE-IDENTITY, owner snapshots identical (271 and 276 entries), backend check passed for both.
    • Custody (my readback): 129 managed groups, 127 succeeded, 2 failed (exactly the two expected refusals), all contained, cleanup observed-empty-removed; collection 12,612 files / 151.2 MB of the 1 GiB cap, failures: []; client-exit 0; post-unit original-unit-absent on the same boot e6f1adc9-...; 163.7 s total.

    Tally (candidate, pending Root acceptance): 43 of 43 receivers (raw-omitted, provider-omitted, wizard-omitted from the accepted rehearsal re-evidenced here, plus the 40 matrix receivers). Not claimed: builds, browser/AT, retained-workspace upgrades (#4816 is scoped separately), product-native adoption, public hosting, provider physical disposal, native UTC trust/skew, the 439+46 holds. #4849/#4644 closure is Root's.
21. EHotwagner commented on Oct 24, 2026

    

    EHotwagner

    on Oct 24, 2026

    ContributorAuthor

    More actions

    Root acceptance (fdev, Programme/root), 2026-10-24: the #4849 Done when is established.

    Source

    • Reviewed maintained qualifier source and controls merged, each with an independent critic and green required CI. FS.GG.Templates parity: the engine got #520 RIGHT and said NOTHING — closed-issue sweep restores the reason, plus take/blocked parity #772, parity: a starved queue is not an empty one — the engine tells #488's four outcomes apart by per-item reasons, not bash's count (#488, case 45) #773, guard: re-authorize agent PR merges — keep the direct-push-to-main block #775, parity: an unreadable claim marker is never an empty lock — the engine fails CLOSED over HTTP (#461, case 42) #778, parity: a fenced Paths: line is not a declaration — a fabricated touch-set reserves nothing, over HTTP (#277, case 33) #780 and parity: take exits EX_RATE (75) on an exhausted budget — the back-off signal, over HTTP (#418, case 40) #783, plus parity: batch scopes its touch-set comparison BY REPO — a cross-repo namesake never phantom-blocks a candidate (#312, case 35) #776 and parity: batch fails closed on a faulted in-flight marker too — the engine does not carry #584 #782 for the shared prerequisite.
    • The AppArmor root cause was proven by A/B (40116649986). The hosted-only fix is part of the profile.

    Admitted actual current-public receiver evidence

    • Rehearsal 40124373443/a1: 3/3, accepted earlier.
    • Full matrix 40127488229/a1: receiver-checks-complete in 164 s.
      • current-d5-receiver-check passed 43/43 (raw plus 42 matrix receivers of explicit lifecycle tokens and named SVG bundle selections).
      • Default quint-specification-v1 author and inspect passed on the provider-omitted and wizard-omitted typed receivers.
      • The wrong-profile QUINT-PROFILE-IDENTITY refusal held, with identical authority/owner snapshots.
      • Custody: 129 managed groups (127 succeeded, plus 2 expected refusals), all contained and removed. Collection is 12,612 files / 151 MB with no failures.
    • Precondition: the offline real-artifact replay (42/42) preceded the dispatch. The critic re-ran it and ran 12 negative mismatches, all refused.
    • Intent prose: the T0 intent text named the older selection by mistake. The linked URL and the dispatched input are the correct selection 6388444491; I accept this as a prose error only.

    Composition: exact published SDD 2.4.0 / Wizard 0.22.0 / Workspace.Template 0.19.3. Build and browser results are reused only where accepted identities match.

    Out of scope for this Delivery: retained-workspace upgrades (#4816), product-native adoption, public hosting, provider physical disposal, native UTC trust, and the 439+46 holds.

    Next: parent #4644 is reconciled separately. Closing as completed.
22. EHotwagner

    closed this as completedon Oct 24, 2026