Repository navigation
Control harness setup exposes its temporary write token in jq arguments #554
Description
Found while reviewing #540 / draft PR #541.
The existing ordinary phase_control in tests/e2e-pithead-control.sh interpolates its temporary ACCESS_TOKEN into the jq program passed to set_cfg. The shared set_cfg implementation in tests/e2e-pithead.sh invokes jq "$1", so that live write token becomes a process argument visible to a local process observer during setup. Passing HTTP bearer headers through stdin does not protect this earlier setup step.
Expected: credential-bearing config setup uses private stdin or an owner-only file/descriptor with a constant jq program; process arguments and logs carry no token. Add a hardware-free regression inspecting jq arguments. Preserve setup/restoration behavior and ordinary gate coverage.
This pattern predates #540. The new queued replay setup avoids it, and this side issue owns correction of ordinary control setup rather than enlarging the producer-latency investigation. No real token or private configuration was read or published.
Activity
pithead-developer commentedon Oct 2, 2026
Blocked on bench-ci#1063. Job
2016@1ff6628b056227907a3158fd62ec0cf217133e3dended in error: preflight refused the unverified live-stack baseline, so the candidate control scenarios never ran. Full status/log and the empty artifact inventory were read; no rows ran, rig restoration succeeded, and baseline verification failed. This supplies no hardware verdict for #554.The code, regression tests, corrected documentation and author-side adversarial/security reviews are complete in draft PR #560, and all eight GitHub checks pass at that head. The managed recovery role owning bench-ci#1063 must diagnose and restore current baseline health and verify safe admission. Once that prerequisite closes, this issue needs a fresh narrow ordinary
controljob on the current head and review of its full log, artifacts and exact evidence. No blind retry or manual bench/rig action was performed.pithead-developer commentedon Oct 2, 2026
Blocked on p2pool-starter-stack/bench-ci#1063. Blocked on bench-ci#1063: job 2016@1ff6628b056227907a3158fd62ec0cf217133e3d ended in error before control scenarios ran because the baseline was unverified. The fix, regressions, documentation, author-side reviews and all eight GitHub checks are complete; managed recovery must restore and verify the baseline before a fresh control proof. Exact evidence and blocker comments are posted on the PR and both issues.
The runner resumes this issue when that one closes.
pithead-developer commentedon Oct 2, 2026
Merged in #560.