fix(conformance): report restricted Unix producer exit status

.github/workflows/client-v1-conformance.yml

@@ -9523,7 +9523,7 @@ jobs:
             ['scripts/phase1-linux-secret-service.sh', [5650, '83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476']],
             ['scripts/unix-artifact-handoff.c', [18704, '2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc']],
             ['scripts/unix-producer-command.sh', [3223, 'ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8']],
-            ['scripts/unix-producer-supervisor.sh', [29289, '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a']],
+            ['scripts/unix-producer-supervisor.sh', [29424, 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff']],
           ]);
           for (const [path, [size, digest]] of expected) {
             const stats = lstatSync(path);

docs/phase1-conformance.md

@@ -1108,7 +1108,7 @@ The later SDK validator repin must use these exact committed file bytes:
 
 | File | Bytes | SHA-256 |
 | --- | ---: | --- |
-| `.github/workflows/client-v1-conformance.yml` | 463,030 | `9d4deae1b25b5c2a6708fbeb760ad7e6af829ac18515672f746ed22e126406d9` |
+| `.github/workflows/client-v1-conformance.yml` | 463,030 | `a08ad1025dd70096bd5a0cae5f3d37ff1675f0173de4347deebdddfdc90f225d` |
 | `scripts/contract-canary.mjs` | 39,636 | `140552c13e8eeba12396ce0e13f812b4e2c53cbcccd4c15a3365ed335827cfca` |
 | `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` |
 | `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` |
@@ -1128,7 +1128,7 @@ The later SDK validator repin must use these exact committed file bytes:
 | `scripts/phase1-linux-secret-service.sh` | 5,650 | `83ce19c0dd6da5002f6853fa37addb4fc2d39f3d17beee1b1c39e1fce232b476` |
 | `scripts/unix-artifact-handoff.c` | 18,704 | `2a003f9aa1d1886b9a593371a73cb65fe3a4a8b703f1c59fec8a27694367b7fc` |
 | `scripts/unix-producer-command.sh` | 3,223 | `ce9ec2ff00947f3ec0db53f144c99d34bc27de6085062d00dccff7c934c2e3c8` |
-| `scripts/unix-producer-supervisor.sh` | 29,289 | `1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a` |
+| `scripts/unix-producer-supervisor.sh` | 29,424 | `b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff` |
 | `scripts/unix-producer-supervisor-attack.c` | 6,211 | `e485ebebb6570b06f179c03a3849224d59d96400b7cadd5547067cce35239642` |
 | `scripts/unix-producer-supervisor.test.sh` | 13,348 | `a8c6f48915b0c86a704a7ddc28eaa7f808ae0a3ddfcdb38c0c23ac0d83738f6d` |
 | `scripts/phase1-windows-supervisor-build.sh` | 4,646 | `713a9e0282887ade3e243b5ba175794d74cdb02c28c38dcd41491c9505812770` |
@@ -1217,3 +1217,8 @@ are recomputed from the exact clean checkout and embedded in the platform
 record. The SDK aggregator still requires those values to equal the validator
 checkout performing aggregation. No SDK validator revision is committed back
 into Chat, so the two repositories do not form a commit-hash cycle.
+
+The Unix supervisor reports a nonzero restricted producer exit status on stderr
+before containment drain, retaining it even when cleanup subsequently fails.
+This numeric status complements the bounded producer stage diagnostic; it does
+not identify the failed authority check or establish successful containment.

phase1-conformance.lock.json

@@ -18,11 +18,11 @@
   },
   "harness": {
     "repository": "OpenCoven/chat",
-    "revision": "cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a"
+    "revision": "4a700bce4217536b294fd2d2c58f579459685484"
   },
   "harnessAuthority": {
-    "revision": "cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a",
-    "tree": "d070889ca36ceb7f91c6181f748241516d891c1a",
+    "revision": "4a700bce4217536b294fd2d2c58f579459685484",
+    "tree": "898802820d9e35b2544b6f5705c401d13bda1700",
     "files": [
       {
         "path": "scripts/phase1-conformance.mjs",
@@ -111,8 +111,8 @@
       },
       {
         "path": "scripts/unix-producer-supervisor.sh",
-        "blob": "8d060a0ddc5dd27ef7378db63322e44169855dc9",
-        "sha256": "1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a"
+        "blob": "0a27a5be4d2eb4981d35d7e3c178424c851697c5",
+        "sha256": "b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff"
       },
       {
         "path": "scripts/windows-job-supervisor.cs",
@@ -146,8 +146,8 @@
       },
       {
         "path": ".github/workflows/client-v1-conformance.yml",
-        "blob": "688a939b241edb06471dde62ce5726ba3af3f813",
-        "sha256": "9d4deae1b25b5c2a6708fbeb760ad7e6af829ac18515672f746ed22e126406d9"
+        "blob": "20929040fbe91ff0f9b7f96f4b8acb16af167422",
+        "sha256": "a08ad1025dd70096bd5a0cae5f3d37ff1675f0173de4347deebdddfdc90f225d"
       }
     ],
     "productionDeltas": [

scripts/unix-producer-supervisor.sh

@@ -736,6 +736,10 @@ producer_status=$?
 set -e
 producer_pid=
 
+if (( producer_status != 0 )); then
+  echo "unix-producer-supervisor: restricted producer exited with status $producer_status" >&2
+fi
+
 if [[ "$host_os" == Linux ]]; then
   drain_linux_cgroup ||
     { echo 'unix-producer-supervisor: cgroup.kill did not reach populated 0' >&2; exit 1; }

src/phase1-conformance-lock.test.ts

@@ -80,8 +80,8 @@ const committedHarnessAuthority = JSON.parse(
   readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'),
 ).harnessAuthority;
 const expectedBehaviorAuthority = {
-  revision: 'cd2f5a3ded0fe4dabf4cfc84ba53cdb293d2234a',
-  tree: 'd070889ca36ceb7f91c6181f748241516d891c1a',
+  revision: '4a700bce4217536b294fd2d2c58f579459685484',
+  tree: '898802820d9e35b2544b6f5705c401d13bda1700',
   files: [
     {
       path: 'scripts/phase1-conformance.mjs',
@@ -105,8 +105,8 @@ const expectedBehaviorAuthority = {
     },
     {
       path: 'scripts/unix-producer-supervisor.sh',
-      blob: '8d060a0ddc5dd27ef7378db63322e44169855dc9',
-      sha256: '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a',
+      blob: '0a27a5be4d2eb4981d35d7e3c178424c851697c5',
+      sha256: 'b73036415744c80ed27d5667f255ceea149096ca517b47c93a154299802206ff',
     },
     {
       path: 'scripts/windows-job-supervisor.cs',
@@ -125,8 +125,8 @@ const expectedBehaviorAuthority = {
     },
     {
       path: '.github/workflows/client-v1-conformance.yml',
-      blob: '688a939b241edb06471dde62ce5726ba3af3f813',
-      sha256: '9d4deae1b25b5c2a6708fbeb760ad7e6af829ac18515672f746ed22e126406d9',
+      blob: '20929040fbe91ff0f9b7f96f4b8acb16af167422',
+      sha256: 'a08ad1025dd70096bd5a0cae5f3d37ff1675f0173de4347deebdddfdc90f225d',
     },
   ],
 } as const;

src/unix-producer-exit-status.test.ts

@@ -0,0 +1,70 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, test } from 'vitest';
+
+const supervisor = readFileSync(
+  resolve(dirname(fileURLToPath(import.meta.url)), '../scripts/unix-producer-supervisor.sh'),
+  'utf8',
+);
+const start = supervisor.indexOf('set +e\nwait "$producer_pid"');
+const end = supervisor.indexOf('\ndelete_producer_account ||', start);
+const completion = supervisor.slice(start, end);
+
+describe.skipIf(process.platform === 'win32')('Unix producer completion diagnostics', () => {
+  test.each(['Linux', 'Darwin'])('%s reports child failure before draining containment', (host) => {
+    expect(start).toBeGreaterThanOrEqual(0);
+    expect(end).toBeGreaterThan(start);
+    const result = spawnSync(
+      'bash',
+      [
+        '-c',
+        `set -euo pipefail
+host_os=$1
+producer_uid=40000
+cgroup_relative=test-cgroup
+timed_out=0
+producer_contained=1
+containment_proved=0
+drain_linux_cgroup() { echo drained >&2; }
+lock_macos_account() { :; }
+drain_macos_uid() { echo drained >&2; }
+(exit 23) &
+producer_pid=$!
+${completion}`,
+        'test',
+        host,
+      ],
+      { encoding: 'utf8' },
+    );
+    expect(result.status).toBe(1);
+    expect(result.stderr).toBe(
+      'unix-producer-supervisor: restricted producer exited with status 23\n' +
+        'drained\n' +
+        'unix-producer-supervisor: restricted production failed\n',
+    );
+  });
+
+  test('does not report a failure for a successful child', () => {
+    const result = spawnSync(
+      'bash',
+      [
+        '-c',
+        `set -euo pipefail
+host_os=Linux
+cgroup_relative=test-cgroup
+timed_out=0
+producer_contained=1
+containment_proved=0
+drain_linux_cgroup() { :; }
+(exit 0) &
+producer_pid=$!
+${completion}`,
+      ],
+      { encoding: 'utf8' },
+    );
+    expect(result.status).toBe(0);
+    expect(result.stderr).toBe('');
+  });
+});