From 9ec19caafe52ecd16d4ae83b1b57458d0a30e0a1 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Wed, 9 Sep 2026 03:56:58 -0500 Subject: [PATCH 1/3] fix(conformance): report restricted Unix producer exit status Verify child exit diagnostics on Linux and Darwin completion paths: 62 focused tests passed, 19 platform/validator skips; shell syntax and diff checks passed. The following authority commit will bind these exact bytes before full verification and publication. --- .github/workflows/client-v1-conformance.yml | 2 +- docs/phase1-conformance.md | 9 ++- scripts/unix-producer-supervisor.sh | 4 ++ src/unix-producer-exit-status.test.ts | 70 +++++++++++++++++++++ 4 files changed, 82 insertions(+), 3 deletions(-) create mode 100644 src/unix-producer-exit-status.test.ts diff --git a/.github/workflows/client-v1-conformance.yml b/.github/workflows/client-v1-conformance.yml index 6d8242b7..1766e509 100644 --- a/.github/workflows/client-v1-conformance.yml +++ b/.github/workflows/client-v1-conformance.yml @@ -9523,7 +9523,7 @@ jobs: ['scripts/phase1-linux-secret-service.sh', [5650, '83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476']], ['scripts/unix-artifact-handoff.c', [18704, '2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc']], ['scripts/unix-producer-command.sh', [3223, 'ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8']], - ['scripts/unix-producer-supervisor.sh', [29289, '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a']], + ['scripts/unix-producer-supervisor.sh', [29424, 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff']], ]); for (const [path, [size, digest]] of expected) { const stats = lstatSync(path); diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md index acf854d9..3ded4d07 100644 --- a/docs/phase1-conformance.md +++ b/docs/phase1-conformance.md @@ -1097,7 +1097,7 @@ The later SDK validator repin must use these exact committed file bytes: | File | Bytes | SHA-256 | | --- | ---: | --- | -| `.github/workflows/client-v1-conformance.yml` | 463,030 | `7aeb9602a61c867957f7682e8d9315fc59f7198c1c4cd6950413dfe47bc5a978` | +| `.github/workflows/client-v1-conformance.yml` | 463,030 | `675eb86a3cf5140cbc933736dfe10fc981713a591c74bda6da109fd2f3ca535c` | | `scripts/contract-canary.mjs` | 39,636 | `140552c13e8eeba12396ce0e13f812b4e2c53cbcccd4c15a3365ed335827cfca` | | `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` | | `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` | @@ -1117,7 +1117,7 @@ The later SDK validator repin must use these exact committed file bytes: | `scripts/phase1-linux-secret-service.sh` | 5,650 | `83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476` | | `scripts/unix-artifact-handoff.c` | 18,704 | `2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc` | | `scripts/unix-producer-command.sh` | 3,223 | `ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8` | -| `scripts/unix-producer-supervisor.sh` | 29,289 | `1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a` | +| `scripts/unix-producer-supervisor.sh` | 29,424 | `b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff` | | `scripts/unix-producer-supervisor-attack.c` | 6,211 | `e485ebebb6570b06f179c03a3849224d59d96400b7cadd5547067cce35239642` | | `scripts/unix-producer-supervisor.test.sh` | 13,348 | `a8c6f48915b0c86a704a7ddc28eaa7f808ae0a3ddfcdb38c0c23ac0d83738f6d` | | `scripts/phase1-windows-supervisor-build.sh` | 4,646 | `713a9e0282887ade3e243b5ba175794d74cdb02c28c38dcd41491c9505812770` | @@ -1206,3 +1206,8 @@ are recomputed from the exact clean checkout and embedded in the platform record. The SDK aggregator still requires those values to equal the validator checkout performing aggregation. No SDK validator revision is committed back into Chat, so the two repositories do not form a commit-hash cycle. + +The Unix supervisor reports a nonzero restricted producer exit status on stderr +before containment drain, retaining it even when cleanup subsequently fails. +This numeric status complements the bounded producer stage diagnostic; it does +not identify the failed authority check or establish successful containment. diff --git a/scripts/unix-producer-supervisor.sh b/scripts/unix-producer-supervisor.sh index 8d060a0d..0a27a5be 100755 --- a/scripts/unix-producer-supervisor.sh +++ b/scripts/unix-producer-supervisor.sh @@ -736,6 +736,10 @@ producer_status=$? set -e producer_pid= +if (( producer_status != 0 )); then + echo "unix-producer-supervisor: restricted producer exited with status $producer_status" >&2 +fi + if [[ "$host_os" == Linux ]]; then drain_linux_cgroup || { echo 'unix-producer-supervisor: cgroup.kill did not reach populated 0' >&2; exit 1; } diff --git a/src/unix-producer-exit-status.test.ts b/src/unix-producer-exit-status.test.ts new file mode 100644 index 00000000..532508fb --- /dev/null +++ b/src/unix-producer-exit-status.test.ts @@ -0,0 +1,70 @@ +import { spawnSync } from 'node:child_process'; +import { readFileSync } from 'node:fs'; +import { dirname, resolve } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { describe, expect, test } from 'vitest'; + +const supervisor = readFileSync( + resolve(dirname(fileURLToPath(import.meta.url)), '../scripts/unix-producer-supervisor.sh'), + 'utf8', +); +const start = supervisor.indexOf('set +e\nwait "$producer_pid"'); +const end = supervisor.indexOf('\ndelete_producer_account ||', start); +const completion = supervisor.slice(start, end); + +describe('Unix producer completion diagnostics', () => { + test.each(['Linux', 'Darwin'])('%s reports child failure before draining containment', (host) => { + expect(start).toBeGreaterThan(0); + expect(end).toBeGreaterThan(start); + const result = spawnSync( + 'bash', + [ + '-c', + `set -euo pipefail +host_os=$1 +producer_uid=40000 +cgroup_relative=test-cgroup +timed_out=0 +producer_contained=1 +containment_proved=0 +drain_linux_cgroup() { echo drained >&2; } +lock_macos_account() { :; } +drain_macos_uid() { echo drained >&2; } +(exit 23) & +producer_pid=$! +${completion}`, + 'test', + host, + ], + { encoding: 'utf8' }, + ); + expect(result.status).toBe(1); + expect(result.stderr).toBe( + 'unix-producer-supervisor: restricted producer exited with status 23\n' + + 'drained\n' + + 'unix-producer-supervisor: restricted production failed\n', + ); + }); + + test('does not report a failure for a successful child', () => { + const result = spawnSync( + 'bash', + [ + '-c', + `set -euo pipefail +host_os=Linux +cgroup_relative=test-cgroup +timed_out=0 +producer_contained=1 +containment_proved=0 +drain_linux_cgroup() { :; } +(exit 0) & +producer_pid=$! +${completion}`, + ], + { encoding: 'utf8' }, + ); + expect(result.status).toBe(0); + expect(result.stderr).toBe(''); + }); +}); From 3df56f380e7338f30cbb3f909574ec1581f5c796 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Wed, 9 Sep 2026 04:03:31 -0500 Subject: [PATCH 2/3] test(conformance): bind Unix exit-status authority Bind the signed behavior commit and exact script/workflow objects. Precommit verification: 562 normal and 418 heavy tests passed; only the expected producer-versus-harness HEAD check requires this distinct authority commit. Typecheck, lint, build, shell syntax, and independent object review passed. --- phase1-conformance.lock.json | 14 +++++++------- src/phase1-conformance-lock.test.ts | 12 ++++++------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json index 52437347..f5683b38 100644 --- a/phase1-conformance.lock.json +++ b/phase1-conformance.lock.json @@ -18,11 +18,11 @@ }, "harness": { "repository": "OpenCoven/chat", - "revision": "e792d5f173c092d597b77340b0dbf6e73e742b11" + "revision": "9ec19caafe52ecd16d4ae83b1b57458d0a30e0a1" }, "harnessAuthority": { - "revision": "e792d5f173c092d597b77340b0dbf6e73e742b11", - "tree": "b2b97bf82d61386f4f44b1df93a5e94fe2c4f7c2", + "revision": "9ec19caafe52ecd16d4ae83b1b57458d0a30e0a1", + "tree": "365b887126efe2f811fbcf0f3806ecf9b706040e", "files": [ { "path": "scripts/phase1-conformance.mjs", @@ -111,8 +111,8 @@ }, { "path": "scripts/unix-producer-supervisor.sh", - "blob": "8d060a0ddc5dd27ef7378db63322e44169855dc9", - "sha256": "1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a" + "blob": "0a27a5be4d2eb4981d35d7e3c178424c851697c5", + "sha256": "b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff" }, { "path": "scripts/windows-job-supervisor.cs", @@ -146,8 +146,8 @@ }, { "path": ".github/workflows/client-v1-conformance.yml", - "blob": "6d8242b77a30cf1a2e30cf4702db09380edb74a1", - "sha256": "7aeb9602a61c867957f7682e8d9315fc59f7198c1c4cd6950413dfe47bc5a978" + "blob": "1766e509a2c7d4d78559d70a90b761248b4c7087", + "sha256": "675eb86a3cf5140cbc933736dfe10fc981713a591c74bda6da109fd2f3ca535c" } ], "productionDeltas": [ diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts index 7e45244b..ead1b3e1 100644 --- a/src/phase1-conformance-lock.test.ts +++ b/src/phase1-conformance-lock.test.ts @@ -80,8 +80,8 @@ const committedHarnessAuthority = JSON.parse( readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'), ).harnessAuthority; const expectedBehaviorAuthority = { - revision: 'e792d5f173c092d597b77340b0dbf6e73e742b11', - tree: 'b2b97bf82d61386f4f44b1df93a5e94fe2c4f7c2', + revision: '9ec19caafe52ecd16d4ae83b1b57458d0a30e0a1', + tree: '365b887126efe2f811fbcf0f3806ecf9b706040e', files: [ { path: 'scripts/phase1-conformance.mjs', @@ -105,8 +105,8 @@ const expectedBehaviorAuthority = { }, { path: 'scripts/unix-producer-supervisor.sh', - blob: '8d060a0ddc5dd27ef7378db63322e44169855dc9', - sha256: '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a', + blob: '0a27a5be4d2eb4981d35d7e3c178424c851697c5', + sha256: 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff', }, { path: 'scripts/windows-job-supervisor.cs', @@ -125,8 +125,8 @@ const expectedBehaviorAuthority = { }, { path: '.github/workflows/client-v1-conformance.yml', - blob: '6d8242b77a30cf1a2e30cf4702db09380edb74a1', - sha256: '7aeb9602a61c867957f7682e8d9315fc59f7198c1c4cd6950413dfe47bc5a978', + blob: '1766e509a2c7d4d78559d70a90b761248b4c7087', + sha256: '675eb86a3cf5140cbc933736dfe10fc981713a591c74bda6da109fd2f3ca535c', }, ], } as const; From 4de3fa7f37fa7cae79afaceeb544b4878d89512d Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Wed, 9 Sep 2026 04:38:46 -0500 Subject: [PATCH 3/3] test(conformance): bind merged Unix diagnostic authority Verify all 25 authority files and 10 production deltas from the signed merge revision; typecheck, lint, and diff checks passed. The combined behavior passed 103 focused tests before binding. --- phase1-conformance.lock.json | 14 +++++++------- src/phase1-conformance-lock.test.ts | 12 ++++++------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json index 9f27b6a9..67eba3f7 100644 --- a/phase1-conformance.lock.json +++ b/phase1-conformance.lock.json @@ -18,11 +18,11 @@ }, "harness": { "repository": "OpenCoven/chat", - "revision": "cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a" + "revision": "4a700bce4217536b294fd2d2c58f579459685484" }, "harnessAuthority": { - "revision": "cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a", - "tree": "d070889ca36ceb7f91c6181f748241516d891c1a", + "revision": "4a700bce4217536b294fd2d2c58f579459685484", + "tree": "898802820d9e35b2544b6f5705c401d13bda1700", "files": [ { "path": "scripts/phase1-conformance.mjs", @@ -111,8 +111,8 @@ }, { "path": "scripts/unix-producer-supervisor.sh", - "blob": "8d060a0ddc5dd27ef7378db63322e44169855dc9", - "sha256": "1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a" + "blob": "0a27a5be4d2eb4981d35d7e3c178424c851697c5", + "sha256": "b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff" }, { "path": "scripts/windows-job-supervisor.cs", @@ -146,8 +146,8 @@ }, { "path": ".github/workflows/client-v1-conformance.yml", - "blob": "688a939b241edb06471dde62ce5726ba3af3f813", - "sha256": "9d4deae1b25b5c2a6708fbeb760ad7e6af829ac18515672f746ed22e126406d9" + "blob": "20929040fbe91ff0f9b7f96f4b8acb16af167422", + "sha256": "a08ad1025dd70096bd5a0cae5f3d37ff1675f0173de4347deebdddfdc90f225d" } ], "productionDeltas": [ diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts index 394110ff..66f7f87f 100644 --- a/src/phase1-conformance-lock.test.ts +++ b/src/phase1-conformance-lock.test.ts @@ -80,8 +80,8 @@ const committedHarnessAuthority = JSON.parse( readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'), ).harnessAuthority; const expectedBehaviorAuthority = { - revision: 'cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a', - tree: 'd070889ca36ceb7f91c6181f748241516d891c1a', + revision: '4a700bce4217536b294fd2d2c58f579459685484', + tree: '898802820d9e35b2544b6f5705c401d13bda1700', files: [ { path: 'scripts/phase1-conformance.mjs', @@ -105,8 +105,8 @@ const expectedBehaviorAuthority = { }, { path: 'scripts/unix-producer-supervisor.sh', - blob: '8d060a0ddc5dd27ef7378db63322e44169855dc9', - sha256: '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a', + blob: '0a27a5be4d2eb4981d35d7e3c178424c851697c5', + sha256: 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff', }, { path: 'scripts/windows-job-supervisor.cs', @@ -125,8 +125,8 @@ const expectedBehaviorAuthority = { }, { path: '.github/workflows/client-v1-conformance.yml', - blob: '688a939b241edb06471dde62ce5726ba3af3f813', - sha256: '9d4deae1b25b5c2a6708fbeb760ad7e6af829ac18515672f746ed22e126406d9', + blob: '20929040fbe91ff0f9b7f96f4b8acb16af167422', + sha256: 'a08ad1025dd70096bd5a0cae5f3d37ff1675f0173de4347deebdddfdc90f225d', }, ], } as const;