diff --git a/docs/reliability/GAP-REGISTER.md b/docs/reliability/GAP-REGISTER.md index 2e50aefd2..ac9b66ef4 100644 --- a/docs/reliability/GAP-REGISTER.md +++ b/docs/reliability/GAP-REGISTER.md @@ -6,19 +6,21 @@ guardrail against false DONE status. ## Current Open Gates -Neither row below blocks the Linux/WSL2 NBD MVP: Windows remains an explicitly +None of the rows below blocks the Linux/WSL2 NBD MVP: Windows remains an explicitly supervised beta, and ublk is outside the day-one transport scope. There are no open product gates for the calibrated Linux/WSL2 NBD MVP surface. | Gate | Status | Why it remains open | Required close evidence | | --- | --- | --- | --- | | Windows public driver distribution | BLOCKED | The validated package path is test-signed for supervised labs. Test-signing is not a public trust chain and cannot be promoted to production evidence; production trust requires an external Microsoft attestation or trusted signing identity. | Build from a clean release tag, obtain Microsoft attestation or another production-trusted signature, pass `InfVerif` and `SignTool verify /pa /all` with test-signing disabled, then pass install, rollback, and recovery drills on the declared compatibility surface. | +| Windows unattended daily service | PARTIAL | The physical Test Mode storage path is repeatably green, but the product SCM configuration requires a live broker at `127.0.0.1:7700`. The repository does not yet package and supervise that broker as a Windows dependency, so installing the demand-start service alone is not an autonomous daily product. | Package the supported broker/control-plane dependency, define ordered start/stop and failure recovery, then pass three cold-boot service lifecycles with Online, integrity, graceful stop, lease release, CUDA restoration, no dump, and zero LUN/Win32/PnP residue. | | Custom-kernel/ublk as day-1 product transport | DEFERRED | NBD remains the day-1 WSL2 product path. ublk root and QEMU smokes are historical capability evidence, not product transport closure. 2026-07-18 `C:\ramshared\artifacts\linux-kernel-lab-capability-20260718-131502` reached `linux-kernel-lab` over SSH with passwordless sudo, installed/loaded `ublk_drv`, and passed capability audit with `/dev/ublk-control` present. The VM still has no GPU surface, and no product ublk lifecycle, swapoff-first teardown, crash/drain, or no-ghost proof exists yet. | Dedicated custom-kernel lab SPEC with full up/down wire-up, swapoff-first teardown, crash/drain drills, and terminal no-ghost proof using the now-capable `linux-kernel-lab` surface. | ## Closed In This Session | Gap | Close evidence | | --- | --- | +| Physical Windows Test Mode storage stability | Elevated preflight `physical-testmode-final-preflight-20260724-224916` confirmed `testsigning Yes`, exact DriverStore/package SHA `324CC7Cā€¦`, an open control path, and no prior disk, pagefile, ghost, or dump. Three fresh physical campaigns `exhaustive-20260724-224946`, `exhaustive-20260724-225047`, and `exhaustive-20260724-225124` each passed Online/CUDA, three SHA rounds, direct disk-I/O measurement, graceful exit, lease release, and zero LUN/Win32/PnP residue. Final elevated preflight `physical-testmode-final-20260724-225209` passed with no minidump. This closes the supervised physical Test Mode claim only; it does not close public signing or unattended service packaging. | | PowerShell Direct harness hangs and false `UNKNOWN` verdicts | The exhaustive and product Online harnesses now put connection creation inside a bounded local job; the exhaustive path retries only the observed transient authentication transport error and normalizes multi-record output before exact `STATUS`/`EXIT` parsing. Campaign `guest-exhaustive-20260724-215817` passed both normal and Driver Verifier (`0x2093B`) IOCTL gates with no dump. Campaign `guest-product-online-20260724-221128` passed three fresh CUDA/Online lifecycles, binary matching, checksum integrity, graceful teardown, lease release, CUDA restoration, and terminal safety. | | Shared-host watchdog teardown race | `shared-wsl-pressure-20260724-044917` reproduced an equal-deadline race where the inner watchdog terminated the pressure controller while its integrity worker was draining NBD-backed pages. The corrected harness separates action and cleanup deadlines, never signals the controller, sizes pressure to the configured tiers, stops after a failed round, and retains the Windows outer watchdog as the sole forceful recovery owner. `shared-wsl-pressure-20260724-155908` completed three rounds with `action_rc=0`, three matching integrity checksums, artifact validation PASS, and a clean terminal state; the PowerShell 5.1 host-volume array false negative was independently revalidated for `C:` and `I:`. | | Exact NBD lifecycle identity and fail-closed telemetry | Post-v0.7.3 audit issue #147 adds exact device identity for daemon/CLI teardown, treats unreadable `/proc/swaps` as unsafe, refuses non-socket replacement, surfaces JSONL write failure, and requires exit-zero, clean terminal state, and identity-complete host-disk telemetry before the shared WSL campaign can publish its full PASS. Named regression tests and the validation record are authoritative; no new pressure claim is inferred from static tests. | diff --git a/docs/specs/no-milestone/windows-storport-cuda-vram/evidence/physical-testmode-repetition-20260724.md b/docs/specs/no-milestone/windows-storport-cuda-vram/evidence/physical-testmode-repetition-20260724.md new file mode 100644 index 000000000..81489fcd7 --- /dev/null +++ b/docs/specs/no-milestone/windows-storport-cuda-vram/evidence/physical-testmode-repetition-20260724.md @@ -0,0 +1,56 @@ +# Physical Windows Test Mode Repetition ā€” 2026-07-24 + +## Environment + +- Windows build: `26200.8875` +- GPU: NVIDIA GeForce RTX 2060, 6144 MiB +- Driver mode: Windows Test Mode (`testsigning Yes`) +- Package signer: `CN=RamShared Test Signing` +- Driver SHA-256: + `324CC7C95A17BE3C245865F55EFC3E87B443D9CF711249068A4221DD86DEDBFA` + +The host was rebooted once to activate Test Mode and again after deploying the +miniport. The final campaign therefore did not reuse an image loaded before the +DriverStore update. + +## Preflight + +Artifact: +`C:\ramshared\artifacts\physical-testmode-final-preflight-20260724-224916` + +The elevated storage-only preflight passed: + +- exact package/running binary match; +- `RamSharedCtl` open; +- no RAMSHARE disk, Win32 disk, PnP ghost, or pagefile; +- no minidump; +- CUDA and NVIDIA telemetry available. + +## Repeated physical campaigns + +| Artifact | Online | SHA rounds | Direct I/O | Graceful | Lease | Terminal storage identity | +| --- | --- | ---: | --- | --- | --- | --- | +| `exhaustive-20260724-224946` | PASS | 3/3 | PASS | PASS | released | none | +| `exhaustive-20260724-225047` | PASS | 3/3 | PASS | PASS | released | none | +| `exhaustive-20260724-225124` | PASS | 3/3 | PASS | PASS | released | none | + +Every lifecycle used an exact 64 MiB `RAMSHARE VRAMDISK` identity and a private +mount below `C:\ProgramData\RamShared\mounts`. No physical-disk fallback, +drive-letter formatting, pagefile, external pressure, or Driver Verifier fuzz +was used on the daily host. + +Final elevated preflight: +`C:\ramshared\artifacts\physical-testmode-final-20260724-225209` + +It passed with no RAMSHARE storage identity or minidump. The miniport service +and control path remain available for supervised tests. + +## Claim boundary + +This evidence closes supervised physical Test Mode functionality on this exact +host. It does not close: + +- Microsoft attestation or production-trusted signing; +- Secure Boot and anti-cheat compatibility; +- autonomous daily SCM operation, because the product configuration requires a + supervised broker dependency at `127.0.0.1:7700`. diff --git a/validation.md b/validation.md index 2629465dd..7a10df824 100644 --- a/validation.md +++ b/validation.md @@ -2777,3 +2777,45 @@ cargo clippy --workspace --all-targets -- -D warnings under Driver Verifier and three product Online lifecycles. This does not change the public-distribution gate: the package remains test-signed and requires a production-trusted or Microsoft-attested signature before official deployment. + +## 2026-07-24 22:52 ā€” Physical Windows Test Mode repetition + +**What:** Enabled Windows Test Mode on the physical RTX 2060 host, performed a +clean test-signed miniport deployment with a mandatory post-deploy reboot, and +repeated the bounded product storage lifecycle three times. + +**Commands:** +```text +bcdedit /set testsigning on +scripts/windows/Get-WinDrivePreflight.ps1 -StorageOnly +devcon.exe install C:\ramshared\package\ramshared.inf Root\RamShared +Restart-Computer -Force +scripts/windows/Run-HostExhaustive.ps1 -SizeBytes 67108864 +scripts/windows/Get-WinDrivePreflight.ps1 -StorageOnly +``` + +**Measured data:** +- Elevated post-deploy preflight + `physical-testmode-final-preflight-20260724-224916`: `testsigning Yes`, + `PREFLIGHT_STORAGE_ONLY=PASS`, control path open, no RAMSHARE disk/Win32/PnP + residue or minidump, and DriverStore/package SHA-256 match + `324CC7C95A17BE3C245865F55EFC3E87B443D9CF711249068A4221DD86DEDBFA`. +- Physical campaigns `exhaustive-20260724-224946`, + `exhaustive-20260724-225047`, and `exhaustive-20260724-225124`: each reports + `HOST_ONLINE=true`, three matching SHA rounds, `GRACEFUL=true`, `EXIT=0`, + `LEASE_RELEASED=true`, `DISK_IO_MEASURE_OK=true`, and + `LUN_GONE=true`/`WIN32_GONE=true`/`PNP_GONE=true`. +- Aggregate physical evidence: three fresh CUDA/Online lifecycles, nine SHA + matches, three direct disk-I/O checks, three graceful teardowns, zero forced + product termination, and zero residual storage identities. +- Final elevated preflight `physical-testmode-final-20260724-225209`: PASS, + Test Mode still enabled, service/control available, no RAMSHARE storage + identity, no pagefile on RAMSHARE, and no minidump. +- Terminal GPU observation: RTX 2060 at 681 MiB used, 5274 MiB free of + 6144 MiB. Firmware Secure Boot remains disabled. + +**Verdict:** āœ… The supervised physical Windows storage path is repeatably +functional in Test Mode on this exact host/build/GPU. This is not an official +Windows distribution or anti-cheat-compatible state: Test Mode remains enabled, +the package is test-signed, and autonomous SCM use still requires a packaged, +supervised broker dependency.