Prevent partial chain state from escaping host recovery - #15
Merged
Conversation
* fix: raise the task file-size cap from 8 MiB to 256 MiB The 8 MiB RLIMIT_FSIZE capped every file a task script could write — including the agent's own release binary during a self-update. The 2026-08-12 fleet upgrade died to SIGXFSZ (exit 153, 'File size limit exceeded') on 18 of 20 attempted nodes. The server-side update script now lifts the inherited cap itself (the only fix that reaches agents already deployed); this raise is the belt-and-braces for non-update tasks and for future agents once their update has run. 256 MiB still bounds runaway writes. * fix: bump grpc to v1.82.1 (GO-2026-6061) govulncheck flags the sing-box stats gRPC client path under the pinned v1.72.2. Unrelated to the rlimit change; the vuln DB entry postdates the last release. protobuf rides to v1.36.11. Full suite green.
The E3 transaction path depends on the task execution and 256 MiB output baseline already present on main, while the approved feature branch must retain the exact integration ancestry. Merge that prerequisite before adding E3 behavior. Constraint: Feature work starts at exact integration c783354 and requires main d2666e9 Confidence: high Scope-risk: narrow Reversibility: clean Tested: ancestry and exact prerequisite OID verified Not-tested: E3 behavior is introduced by the following commit
Apply the E3 fragment and source-side declaration through one private, crash-recoverable transaction manager. Recovery now precedes observable agent traffic, transfers one stable terminal result into the durable outbox, and retains generic task behavior. Installer and compatibility wiring make the private transaction root and alpha contract explicit, while the real sing-box harness proves client-to-source-to-target traffic. Constraint: E3 uses the existing opaque shell task channel and adds no dependency Constraint: Host state must be exactly the old pair or desired pair before result publication Rejected: Shell traps alone | cannot recover helper SIGKILL or power loss Rejected: Generic interrupted-task synthesis | could publish an unknown result before host recovery Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep linechain journal cleanup after confirmed outbox completion and before acknowledged outbox removal Tested: go test ./...; go test -race -cover ./...; go vet ./...; installer integrity; real sing-box 1.13.18 client-B-A-origin E2E Not-tested: Full server-to-agent E3 payload integration awaits the server lane exact contract
The initial E3 lane left authority and crash-boundary gaps around lock files, runtime layout, result retention, and artifact binding. This follow-up refuses hostile lock state, resolves layout locally, retains only E3 results during cleanup retries, binds combined digests to raw artifact bytes, and makes transaction roots durable and private. Constraint: Server documents cannot choose arbitrary host paths Constraint: Generic task result behavior must remain unchanged Rejected: Repairing hostile lock modes in place | could mutate another owner’s state Confidence: high Scope-risk: moderate Directive: Keep cleanup retryable without retaining unrelated generic results Tested: full normal/race-cover/vet/gofmt/diff/install gates Not-tested: Full live server payload replay remains cross-lane integration work
The follow-up touched existing tests and runtime layout discovery while closing the crash and authority gaps. Normalize those files so CI applies the same formatting gate as local verification. Constraint: CI rejects any gofmt drift Confidence: high Scope-risk: narrow Tested: gofmt and targeted Go tests Not-tested: none
Generic durable shell tasks must not be classified as replayable linechain operations merely because their script mentions a helper string. Require the server-authored E3 marker, helper invocation, and transaction-root binding together. Constraint: Generic result endpoints are not replay-safe Confidence: high Scope-risk: narrow Directive: Server task rendering must emit lattice-linechain-e3-v1 exactly Tested: go test, race-cover, vet, gofmt, diff Not-tested: full live server payload replay
Use explicit leased protocol metadata for live classification and derive artifact paths from the agent-resolved sing-box layout while retaining a narrow legacy recovery marker. Constraint: Existing pending journals do not carry leased protocol metadata Rejected: Trust server-supplied absolute paths | permits host redirection Confidence: medium Scope-risk: moderate Directive: Remove legacy marker fallback once all persisted outbox entries carry durable_protocol Tested: go test ./internal/linechain ./cmd/lattice-agent Not-tested: authentic external sing-box E2E harness
Require explicit linechain-e3-v1 metadata for durable E3 execution and remove script-marker classification. Constraint: pending outbox records do not yet persist protocol metadata Rejected: Parse script comments | spoofable and conflates generic delivery Confidence: medium Scope-risk: moderate Tested: gofmt; targeted go test (legacy cleanup regression remains) Not-tested: full contract matrix and real-binary E2E
Add an explicit protocol field and protocol-aware Begin seam so recovery can classify pending deliveries without parsing scripts. Constraint: existing Begin callers and persisted entries must remain readable Rejected: infer protocol from task script | spoofable Confidence: medium Scope-risk: narrow Tested: go test ./internal/taskoutbox Not-tested: agent integration wiring and real E2E
Recovery failure now gates readiness and polling without flushing pending results, preventing arbitrary durable entries from crossing an unresolved linechain authority boundary. Constraint: recovery must precede every observable delivery Rejected: flush retained results during blocked recovery | journal/outbox identity may be unresolved Confidence: high Scope-risk: moderate Tested: focused linechain tests (remaining cleanup retention assertion fails) Not-tested: full matrix and real E2E
Use the protocol-aware outbox seam when available while preserving compatibility with existing outbox implementations. Constraint: mocks and older stores expose only Begin(task) Rejected: change interface abruptly | breaks generic and NetGuard implementations Confidence: medium Scope-risk: narrow Tested: focused linechain test (cleanup retention remains red) Not-tested: full matrix and real E2E
Treat protocol and durability as one leased-task contract, admit generic, NetGuard, and E3 pairs only, and bind protocol to duplicate journal identity. E3 tasks are rejected before journaling when linechain is unavailable. Constraint: protocol metadata is server-authored and security-sensitive Rejected: accept durable=true with missing protocol | ambiguous execution authority Confidence: high Scope-risk: moderate Tested: internal/taskoutbox passes; existing agent tests require fixture updates for explicit protocol pairs Not-tested: full contract matrix and real E2E
Accept the v2 document envelope while preserving v1 journal compatibility, and require the agent-owned fragment basename before local path derivation. Constraint: existing journals and tests remain version 1 Rejected: trust server absolute paths in v2 | host path redirection Confidence: medium Scope-risk: narrow Tested: go test ./internal/linechain Not-tested: semantic sidecar merge and real E2E
Perform raw decode-time rejection of legacy absolute path fields before deriving agent-owned artifact locations. Constraint: v1 documents and journals retain compatibility Rejected: validate after normalization | derived local paths obscure hostile input Confidence: high Scope-risk: narrow Tested: go test ./internal/linechain Not-tested: semantic sidecar overlay and real E2E
Require the v2 fragment basename to match the exact lowercase hexadecimal namespace contract. Constraint: server must bind deterministic artifact identity Rejected: broad prefix and extension checks | permits ambiguous names Confidence: high Scope-risk: narrow Tested: go test ./internal/linechain Not-tested: sidecar overlay and real E2E
Replace the file-write smoke test with a loopback-only sing-box 1.13.x harness that observes the B-to-A hop, drives basename-only v2 Manager documents through create/resync/remove, validates runtime discovery, and exercises process-group crash recovery while the supervisor remains alive. Keep the binary external and mandatory in the script lane. Constraint: E2E owns only the agent test and invocation script; Manager, main loop, and outbox integration remain worker-2 owned Constraint: The official sing-box binary is a local test tool, never a Go or repository dependency Rejected: Stub restart/check commands | they cannot prove that B loads the published fragment Rejected: Starting B pre-chained | it cannot prove the apply operation changed live routing Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep the v2 fixture basename-only and preserve real process restart plus observer assertions Tested: go test ./cmd/lattice-agent -run '^TestLinechainE2E(Apply|Restart|Active)Helper$' -count=1 Not-tested: Full real-binary lane pending integration with worker-2 final v2 Manager head
Update the cleanup-failure regression to exercise the explicit leased E3 protocol contract rather than obsolete durable-result-only payloads. Constraint: generic and NetGuard deliveries must remain distinct Rejected: infer E3 from script marker | spoofable Confidence: high Scope-risk: narrow Tested: focused test remains red, exposing outbox completion protocol propagation gap Not-tested: full matrix and real E2E
The integration regression must model a node that resolved its local sing-box layout; otherwise the protocol guard correctly rejects the lease before exercising retention. Constraint: E3 execution is forbidden when readiness is false Rejected: weaken production guard | would permit unsafe host execution Confidence: high Scope-risk: narrow Tested: go test ./cmd/lattice-agent -run TestRunTasksLinechainCompletesHandoffWithoutReplay -count=1 Not-tested: full matrix and real E2E
Replace the file-write smoke test with a loopback-only sing-box 1.13.x harness that observes the B-to-A hop, drives basename-only v2 Manager documents through create/resync/remove, validates runtime discovery, and exercises process-group crash recovery while the supervisor remains alive. Keep the binary external and mandatory in the script lane. Constraint: E2E owns only the agent test and invocation script; Manager, main loop, and outbox integration remain worker-2 owned Constraint: The official sing-box binary is a local test tool, never a Go or repository dependency Rejected: Stub restart/check commands | they cannot prove that B loads the published fragment Rejected: Starting B pre-chained | it cannot prove the apply operation changed live routing Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep the v2 fixture basename-only and preserve real process restart plus observer assertions Tested: go test ./cmd/lattice-agent -run '^TestLinechainE2E(Apply|Restart|Active)Helper$' -count=1 Not-tested: Full real-binary lane pending integration with worker-2 final v2 Manager head
A leased linechain task must be resolved by the linechain journal manager before generic interrupted-result synthesis; generic and NetGuard entries retain legacy recovery behavior. Constraint: E3 execution outcome is owned by the linechain transaction journal Rejected: synthesize unknown result in generic outbox path | can conflict with terminal journal Confidence: high Scope-risk: moderate Tested: go test ./internal/taskoutbox Not-tested: full cross-check matrix and real E2E
Decode only the basename-bound v2 wire contract, derive all host paths from the configured runtime layout, and keep ordinary sidecar rewrites outside the fragment predecessor CAS. Normalize absent artifact digests consistently so create recovery can restore the exact old pair. Constraint: E3 v2 wire documents cannot carry host paths or previous sidecar digests Constraint: Existing v1 test fixtures are obsolete and migrate with the strict decoder Rejected: Preserve v1 wire compatibility | the approved E3 contract requires strict v2-only decode Confidence: high Scope-risk: moderate Reversibility: clean Directive: Never reintroduce server-controlled artifact paths or sidecar predecessor CAS into v2 Tested: go test ./internal/linechain ./internal/taskoutbox ./cmd/lattice-agent -count=1 Not-tested: Real sing-box lane until accepted E2E increment is integrated
Exercise the exact VLESS+REALITY transport shape, make the crash boundary signal-driven, and model ordinary sidecar resync outside the E3 transaction so removal proves it tolerates unrelated metadata drift. Constraint: E3 v2 artifact authority binds only the fragment predecessor; ordinary metadata writers may change sidecar bytes independently Rejected: Manager-driven metadata resync | it hides the required independent-writer drift case Rejected: Polling published files as the crash trigger | it races a fast restart and can miss the intended journal phase Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep the crash marker inside the restart helper so pair_published is deterministic Tested: tagged helper compilation and go vet for cmd/lattice-agent Not-tested: Unsimulated real-binary lane pending worker-2 Manager contract repairs
Canonicalize trusted runtime roots, reject trailing and legacy wire data, merge server-owned sidecar keys over ordinary metadata, and require exact task/lease/protocol agreement between bounded outbox and linechain snapshots before recovery can mutate either domain. Constraint: Completed E3 outbox entries may outlive cleaned linechain journals; leased E3 entries may not lack them Constraint: Ordinary sidecar top-level fields are outside E3 ownership and must survive create, replace, and remove Rejected: Byte-level sidecar predecessor CAS | independent metadata writers make it stale by design Confidence: high Scope-risk: moderate Reversibility: clean Directive: Run cross-contract validation before either generic outbox or linechain recovery Tested: go test ./internal/linechain ./internal/taskoutbox ./cmd/lattice-agent -count=1 Not-tested: Full/race/real-binary gates follow this commit
The managed linechain transaction now binds server-approved task scripts to canonical local artifacts, validates complete journal authority across the outbox handoff, preserves semantic sidecar ownership, and proves runtime state before recording terminal results. Trusted task execution no longer exposes linechain paths to ordinary or NetGuard tasks, while nofollow bounded reads and fault-matrix coverage close recovery and rollback ambiguity. Constraint: E3 recovery must suppress observable networking until exact outbox, journal, artifact, and runtime authority agree Constraint: Existing ordinary sidecar fields remain locally owned and survive managed overlay updates Rejected: Trust task and lease identifiers alone | they do not bind the approved script or desired artifacts Rejected: Include command output in durable failures | checker output may contain credentials Confidence: high Scope-risk: moderate Reversibility: clean Directive: Do not bypass RunLinechain protocol selection or weaken full-journal authority capture before recovery Tested: go test ./... -count=1; go vet ./...; go test -race -cover ./... -count=1; exact unsimulated sing-box 1.13.18 E2E; release workflow and install integrity scripts; version and compatibility output; secret scan Not-tested: GitHub CI on this unpushed commit
The cmd package test binary now enters the same rlimit child shim as the production agent before testing starts. This prevents a trusted E3 shell test from recursively running the entire test suite when Runner re-execs /proc/self/exe on Linux. Constraint: Linux task execution re-execs the current binary before invoking the interpreter Rejected: Increase the helper timeout | it would mask recursive test execution and keep CI flaky Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep cmd TestMain aligned with production taskexec.MaybeRunChildShim behavior Tested: helper race test x10; go test -race -cover ./...; go test ./...; go vet ./...; exact sing-box 1.13.18 E2E with zero residual helpers; installer and release checks Not-tested: GitHub CI for this new commit
Canonical semantic patches carry only the source identity and expected/desired downstream transition. The agent preserves unrelated metadata, applies an exact chain-object CAS, and validates the issued patch plus semantic artifact digests without treating whole host sidecar input or output as server-owned authority. Constraint: Strict alpha contract is linechain-e3-v2 with no compatibility branch Rejected: Bind the whole host sidecar base/output in approval | ordinary metadata is host-owned and may evolve independently Rejected: Replace the complete inbounds array | deletes unrelated ordinary-writer state Rejected: Recompute and overwrite issued digests | breaks approval and replay authority Confidence: high Scope-risk: narrow Directive: Keep merged output digests agent-journal-only and out of wire approval authority Tested: go test ./internal/linechain -count=1; git diff --check Not-tested: server-rendered fixture and Document/Apply/journal integration pending exact nullable-field ACK
Replace whole-sidecar byte authority with a canonical source-scoped patch and semantic artifact binding, while retaining actual merged output digests only in the crash journal. Recovery now cross-checks the independently issued artifact embedded in the exact server task wrapper, rejects legacy durable entries, and preserves unrelated host metadata through UUID-plus-tag CAS updates. Constraint: Server approval may bind only canonical PatchSHA and ArtifactSHA, never mutable host base or output bytes Constraint: Existing metadata v2 sidecars remain owned by ordinary host writers outside the matched chain member Rejected: Hash the merged host sidecar as issued authority | host-local unrelated fields make that value unavailable to the server before execution Rejected: Trust journal ArtifactSHA during recovery | that makes authority circular after local journal corruption Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep the v2 wrapper, patch, artifact, journal output, and outbox authority fields distinct; do not restore raw whole-sidecar binding Tested: production server fixture and fixed vectors; focused semantic, recovery, outbox, and taskexec tests; go test ./...; go test -race -cover ./...; go vet ./...; installer, release-workflow, proto, install/version/compat, and secret gates Not-tested: Full real sing-box lifecycle E2E is owned by Task 18
Route every host sidecar root, inbound, and chain object through the existing token-based unique-key decoder. Duplicate authority fields now fail before fragment publication, sidecar replacement, or journal creation, while preserving the strict semantic merge contract established by E3 v2. Constraint: Host sidecar bytes are independently mutable and cannot use last-key-wins JSON semantics for authority-bearing fields Rejected: Validate only the matched inbound after json.Unmarshal | duplicate keys are already collapsed and their ambiguity is no longer observable Confidence: high Scope-risk: narrow Reversibility: clean Directive: All authority-bearing JSON objects must reject duplicate keys before semantic validation or mutation Tested: five Apply-level no-mutation duplicate cases; production server fixture; go test ./...; go test -race -cover ./...; go vet ./...; installer, release-workflow, proto, install/version/compat, secret, and diff gates Not-tested: Full real sing-box lifecycle E2E remains owned by Task 18
The mandatory script now builds the exact agent, locates the frozen repaired server tree, runs its persistent lifecycle gate, and then proves live A/B/client/origin traffic and recovery with the same official sing-box input. The agent fixture now uses the strict semantic v2 patch and artifact contract. Constraint: The public command and mandatory official sing-box 1.13.x input remain unchanged Rejected: Sequential fixture-only coverage | it would not exercise public HTTP planning, leasing, and result replay Confidence: high Scope-risk: narrow Reversibility: clean Directive: Do not add a skip path or replace official sing-box with a simulator Tested: Exact scripts/test-linechain-e2e.sh command with official sing-box 1.13.18; agent race compile; tagged vet Not-tested: GitHub CI
Compare every server path against the repaired production tree while excluding only the new build-tagged lifecycle test itself, so the gate remains immutable without rejecting its own committed harness. Constraint: Task18 may add only the tagged server test beyond the Task21 production tree Confidence: high Scope-risk: narrow Reversibility: clean Tested: Shell static parse and exact lifecycle command Not-tested: GitHub CI
The mandatory E2E command now builds the tagged helper binary and keeps the server-issued lifecycle as the sole authority for live traffic, recovery, and remove verification rather than falling back to a second hand-built document. Constraint: Existing production files remain frozen; only E2E harness surfaces changed Rejected: Separate agent-local document test | it split artifact authority from persistent server leasing Confidence: high Scope-risk: narrow Directive: Keep the exact official sing-box command and no-skip leak gates Tested: Exact persistent lifecycle command with official sing-box 1.13.18 Not-tested: Full GitHub CI
Expose strict tagged-binary entrypoints for startup recovery, durable result resolution, journal cleanup, and runtime inventory so the server lifecycle cannot fabricate those transitions. Harden managed sing-box teardown around process groups and explicit reaping to make residual-process failures visible. Constraint: Task24 owns the server consumer and official binary lifecycle Constraint: This task may modify only the node-agent harness files Rejected: Keep synchronous fabricated server results | bypasses production recovery authority Rejected: Signal only the sing-box leader PID | can leak process-group children Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep the exported environment names stable across the tagged server harness Tested: go test ./cmd/lattice-agent -count=1 Tested: go test -tags=linechain_e2e ./cmd/lattice-agent -run ^TestKillManagedSingBox -count=1 Tested: go test -c -tags=linechain_e2e ./cmd/lattice-agent Tested: go vet ./cmd/lattice-agent and go vet -tags=linechain_e2e ./cmd/lattice-agent Tested: gofmt and git diff --check Not-tested: Official sing-box server lifecycle is owned by Task24
…sumer Allow the exact Task24 tagged network E2E file alongside the existing tagged lifecycle file so the harness can run without weakening its production source comparison. Constraint: Task24 adds one named tagged server test outside the frozen production tree Rejected: Exclude all E2E files by wildcard | would permit unrelated source drift Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep this allowlist exact; do not exclude production server paths Tested: sh -n scripts/test-linechain-e2e.sh Tested: frozen server diff check with both exact path exclusions Tested: git diff --check Not-tested: Official binary lifecycle remains Task24
Place the server lifecycle beneath one script-owned absolute runtime root and clean leaked work by unique process group rather than command leader PID. The gate now verifies both group disappearance and an empty final runtime scan. Constraint: Server A/B/client paths previously escaped the script build root Constraint: Task25 owns only scripts/test-linechain-e2e.sh Rejected: Scan only the agent build root | misses server t.TempDir processes Rejected: Kill matching leader PIDs | can leave process-group children alive Confidence: high Scope-risk: narrow Reversibility: clean Directive: Task24 must keep all lifecycle runtime paths under LATTICE_LINECHAIN_E2E_RUNTIME_ROOT Tested: sh -n scripts/test-linechain-e2e.sh Tested: git diff --check Not-tested: Official binary lifecycle awaits Task24 adoption of the runtime-root env
Track leader reaping separately from process-group liveness so a TERM-exiting leader cannot hide a surviving child. Cleanup now falls through to SIGKILL until both the owned leader is reaped and the entire PGID reports ESRCH. Constraint: TERM-ignoring sing-box descendants can outlive a reaped group leader Constraint: Task26 owns only the tagged node-agent harness file Rejected: Treat cmd.Wait completion as group completion | leaves descendant processes alive Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep leader-reap and PGID-disappearance checks independent Tested: go test -race -tags=linechain_e2e ./cmd/lattice-agent -run ^TestKillManagedSingBox -count=1 Tested: go vet -tags=linechain_e2e ./cmd/lattice-agent Tested: gofmt and git diff --check Not-tested: Official binary lifecycle remains Task24
Journal the exact leased E3 task before execution, persist and confirm the terminal result before transaction cleanup, and export only a result reread from the durable outbox. Also reject dirty or untracked server worktrees before the canonical lifecycle begins. Constraint: Production ordering is outbox Begin before execution and durable Complete before linechain Cleanup Constraint: Task27 owns only the two tagged node harness files Rejected: Export callback memory before durable outbox write | loses results across the cleanup crash window Rejected: Trust HEAD while allowing dirty tagged files | executes unreviewed lifecycle code Confidence: high Scope-risk: moderate Reversibility: clean Directive: Server Task24 must invoke BeginHelper before the exact leased script and reuse the same outbox directory Tested: go test -race -tags=linechain_e2e ./cmd/lattice-agent -run ^TestLinechainE2EDurableResultSurvivesOutboxReopen$ -count=1 Tested: go test -c -tags=linechain_e2e ./cmd/lattice-agent Tested: go vet -tags=linechain_e2e ./cmd/lattice-agent Tested: sh -n scripts/test-linechain-e2e.sh; gofmt; git diff --check Not-tested: Official server-issued lifecycle awaits Task24 interface adoption
Select durable results by exact task and lease, remove only the server-acknowledged entry, and prove a missing outbox Begin cannot clean the terminal transaction. Authorized recovery now persists the exact result before journal cleanup and survives unrelated pending entries. Constraint: Server replays acknowledge one exact task result at a time Constraint: Task28 owns only tagged node-agent harness files Rejected: Require a singleton Pending list | breaks create/remove sequences in one outbox Rejected: Cleanup after an in-memory recovery result | loses authority when outbox completion fails Confidence: high Scope-risk: moderate Reversibility: clean Directive: Task24 must invoke AckHelper only after a successful exact server replay Tested: go test -race -tags=linechain_e2e ./cmd/lattice-agent -run ^TestLinechainE2E(RecoveryDoesNotCleanupBeforeDurableResult|DurableResultSurvivesOutboxReopen)$ -count=1 Tested: go test -c -tags=linechain_e2e ./cmd/lattice-agent Tested: go vet -tags=linechain_e2e ./cmd/lattice-agent Tested: gofmt and git diff --check Not-tested: Official binary lifecycle awaits Task24 AckHelper adoption
Constraint: Cleanup scans must not match their own awk process Rejected: Literal awk command exclusion | argv formatting is platform-dependent Confidence: high Scope-risk: narrow Tested: sh -n; git diff --check Not-tested: official sing-box binary unavailable in this environment
The process table reports absolute executable paths, so cleanup scans must compare the configured binary path rather than a basename. A synthetic regression locks the strict executable and argument matching while rejecting basename and awk self-matches. Constraint: ps reports absolute executable paths Rejected: basename matching | misses the official executable Confidence: high Scope-risk: narrow Tested: sh -n scripts/test-linechain-e2e.sh; scanner regression Not-tested: full official E2E
The official Task29 rerun must validate against the production identity fix at the current lifecycle head rather than the stale baseline. Constraint: canonical server lifecycle head is 6fad0eb Confidence: high Scope-risk: narrow Tested: sh -n scripts/test-linechain-e2e.sh; git diff --check Not-tested: full official E2E
Advance the canonical server production-tree pin so the real sing-box lifecycle exercises the batch-scoped identity resolver while preserving the strict two-file tagged-helper exception. Constraint: The lifecycle harness rejects production drift outside the exact server pin Confidence: high Scope-risk: narrow Directive: Repin only after the corresponding server commit is clean and verified Tested: bash -n scripts/test-linechain-e2e.sh; git diff --check Not-tested: lifecycle execution is the next gate
Advance the strict server production-tree pin so the canonical real sing-box lifecycle runs against the node-owned UUID authority repair. Constraint: The harness rejects all server production drift outside its exact pin Confidence: high Scope-risk: narrow Directive: Keep this pin synchronized with the independently reviewed server authority commit Tested: bash -n scripts/test-linechain-e2e.sh; git diff --check Not-tested: lifecycle execution is the next gate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Exact delivery
145f3e65a63a5cb560244bb92d875d8324d2496d7a67ff9212dd05a13045ada0fef53554e1e7ba1cintegration611df861450cf3cf6c401f2c5e6303a499f9581ecommits_scanned=19 violations=0 physical=149 escaped=0 parsed=149Verification at exact head
go test ./... -count=1— PASSgo test -race -cover ./... -count=1— PASS; linechain 79.3%, taskoutbox 69.5%go vet ./...— PASSsh scripts/check-release-workflow.sh— PASSsh scripts/test-install-integrity.sh— PASStest -z "$(gofmt -l .)", andgit diff --check— PASSgo build ./cmd/lattice-agent— PASS611df861— PASS (TestLineChainPersistentServerAgentLifecycleE2E, 1.80s)020ecf20d3faa9ec3e917762085f0581aafbd3dd87a69573ae7345fc66fabc7fBoundaries