From 47474632ae3a49a1d9720f2ca1e4db3e23c49ddb Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 09:24:05 +0800 Subject: [PATCH 01/29] docs: add RFC-030 implementation plan --- docs/plans/RFC-030-implementation-plan.md | 216 ++++++++++++++++++++++ 1 file changed, 216 insertions(+) create mode 100644 docs/plans/RFC-030-implementation-plan.md diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md new file mode 100644 index 00000000..634fcb21 --- /dev/null +++ b/docs/plans/RFC-030-implementation-plan.md @@ -0,0 +1,216 @@ +# RFC-030 implementation plan — Codex app-server production runtime + +> Tracking issue: [#428](https://github.com/sleep2agi/agent-network/issues/428) +> +> Authoritative RFC: [`docs/rfcs/RFC-030-codex-tui-bridge.md`](../rfcs/RFC-030-codex-tui-bridge.md) +> +> Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** +> +> Last updated: 2026-07-12 (Asia/Shanghai) + +This is the engineering master plan for moving `codex-app-server` from an +opt-in preview to the independently launched Codex TUI runtime approved by +Vincent on 2026-07-10. Issue #428 is the chronological external log; this file +is the current decomposition, ownership, evidence and gate state. Update both +after every checkpoint. + +## 1. Frozen product and security decisions + +| Decision | Frozen value | +|---|---| +| Canonical runtime ID | `codex-app-server`; `codex-tui-bridge` is display/product wording only | +| Product form | Independent `codex` TUI runtime backed by `codex app-server`; the earlier “first ship as codex-sdk transport” step is cancelled | +| Production topology | One upstream app-server behind one Policy Gateway; Agent and TUI never attach as uncontrolled peer clients | +| Codex baseline | Exact CLI version `0.144.0`; schema mismatch fails closed | +| Phase 1 policy | `read-only` and `approval=never`; writes and approval enabling remain disabled | +| Reply lifecycle | `send_reply` plus `new_reply` SSE wake; the Phase-0 origin-aware `send_task` deviation must not enter production | +| CommHub token boundary | Codex/app-server environment and argv contain no CommHub token; the gateway owns authenticated CommHub access | +| SQLite | No native dependency. Bun uses `bun:sqlite`; Node uses `node:sqlite` only on Node `>=22.13`; older Node fails closed for this runtime only. Global `agent-node` engines stay `>=18.17` | +| Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | +| Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | + +### Hard locks + +- No production change, deploy, preview publish, `latest` switch or lead merge. +- No Wave 2 task starts before the Wave-1 checkpoint is signed. +- The author never self-reviews security-critical changes. +- Any P0/P1 failure in the independent §8 review keeps the runtime preview-only. +- `通信牛` remains on its separate Grok coexistence line and is not reassigned. + +## 2. Wave map + +| Wave / lane | Owner | State | Branch / PR | Current evidence | Exit gate | +|---|---|---|---|---|---| +| Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | +| Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | +| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **In progress** | PR #431 | ETA 10–12h, three segment checkpoints | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests | +| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **In progress** | `rfc030-gateway-runtime`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Revised ETA 5h; committed evidence pending | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | +| Wave 1B L2 — runtime hardening | 通信SDK马 | **Released after L1** | PR #432 | Revised ETA 4h; committed evidence pending | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | +| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Locked** | PR #432 | Additional ETA required | L1 + L2 accepted; stale contract/mux/authorizer deleted; full wire/startup evidence | +| Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | +| Wave 2 — product/runtime plumbing | Owners assigned after checkpoint | **Locked** | TBD | Not started | §3 scope complete; Docker tests green | +| Wave 3 — independent security review and release decision | 通信评审牛 + 通信龙 + Vincent | **Locked** | TBD | Not started | §8 PASS, Vincent explicitly authorizes release/deploy/latest | + +## 3. Wave 2 scope — do not start before checkpoint + +Wave 2 is the independent runtime/product plumbing originally listed in RFC-030 +§8.2 and §9. It includes: + +- app-server client eager boot, reconnect/backoff, shutdown and preflight; +- runtime normalization and CLI wizard selection; +- `agent-node` runtime map and supervisor capability reporting; +- server runtime normalization, create-node validation and host capability gate; +- CLI doctor and daemon preflight for Node `>=22.13` or Bun; +- Dashboard runtime display and actionable unsupported-runtime state; +- runtime docs and release notes; +- Docker-isolated layered E2E across supported Bun/Node versions. + +Wave 2 must consume the Policy Gateway. It must not create a direct second +app-server client, bypass the gateway, add a token escape hatch, or enable +writes/approvals. + +## 4. Wave-1A frozen surface + +Canonical freeze commit: `90d1e58`. + +| File | SHA-256 | +|---|---| +| `agent-node/src/runtime/codex-policy-gateway/contract.ts` | `b36dd3f586aebae3960ec825ae1b978dfb36504ddb3590d76248c8f1dd5581f3` | +| `agent-node/src/runtime/codex-policy-gateway/protocol.ts` | `9488231872eb7341c3abb00cc89ff0dea87f3f80fcc90ef6c315c1299e278b9e` | + +Frozen invariants: + +- Agent surface exposes only `enqueueTask`, `getTaskState`, + `cancelQueuedTask` and read-only runtime-state subscription. +- `AuthenticatedSender.role` is exactly + `owner | admin | member | viewer | node | child`; inbound `unknown` fails + closed. +- `taskId` is the stable logical task identity across retry/reassign; + `messageId` is a unique delivery-attempt/idempotency identity. +- Numeric and string gateway error codes cannot be split by diagnostic data. +- TUI initialize is separate from the Agent handshake. +- TUI approval responses consume only a pending reverse-request ID; unknown or + duplicate IDs fail closed. +- One upstream mux covers internal and proxied-TUI requests, preserves numeric + versus string TUI IDs, consumes responses once, and supports selective TUI + drain. + +Any requested shape change must be reported to the coordinator and reviewed as +a freeze amendment before code changes. + +## 5. Wave-1B L1 principal and task model + +### Principal authority + +| Caller | Authoritative classification | +|---|---| +| User token in a network | `network_members.role` for the effective network | +| REST global system administrator | global `users`/auth role → `admin` | +| Ordinary node token | server-resolved token kind → least-privilege `node`; never inherit its owner's role | +| RFC-026 child token | server-resolved child token kind / `api_tokens.role` → `child` | +| Legacy/global/open/no-token row | no principal; Gateway path fails closed while legacy consumers remain compatible | + +The auth context must carry server-resolved token scope/kind. Raw token prefixes, +aliases, client payload fields and `from_session` are never authorization input. + +### Additive persistence + +- `tasks` stores an immutable, write-once origin token ID and origin role. +- `inbox` stores the server-stamped sender principal and a canonical task ID. +- Initial delivery may have `canonical_task_id == inbox.id`. +- Retry/reassign keep the original `tasks.task_id` as `taskId` and mint a new + `inbox.id` as `messageId`. +- `send_reply` resolves the canonical task ID, never the mutable delivery ID. +- Auto-chain propagates the authenticated principal that triggered + `send_reply`, not the original coordinator's authority. + +### Invalid-row isolation + +Phase 1 consumes only `type=task`. A missing/invalid principal is ACKed and +dead-lettered, the trusted task lifecycle is marked failed, and an audit event +is written. The gateway must not reply to untrusted `from_session`. Tests must +prove high-priority invalid rows cannot occupy the inbox `LIMIT` window and +starve a valid task. + +## 6. Wave-1A UDS/lifecycle checkpoints + +| Segment | Scope | Required evidence | +|---|---|---| +| A | Agent UDS + TUI UDS + framing | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | +| B | Human owner and reverse-request lifecycle | TUI disconnect drains only proxied TUI and reverse IDs; internal response still routes; unknown/duplicate approval response fails closed; reconnect does not replay drained approvals | +| C | Lifecycle orchestration | Inject B's backend/client/preflight rather than duplicate scheduler, ledger, policy, baseline gate or reconnect logic; provider/diagnostics are no-throw; UDS opens only after preflight; shutdown rejects pending work before drain | + +## 7. Production hard-gate matrix + +The checkpoint is green only when the integrated production path—not a helper or +fixture with the same name—proves every row. + +| Gate | Current state | Evidence / blocker | +|---|---|---| +| Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | +| 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | +| Single mux, collisions and out-of-order routing | **Partial / blocked** | A mux unit tests green; audited PR #432 head used an unwired duplicate mux and replayed duplicate responses | +| Approval forgery | **Partial / blocked** | Pure policy rejection is green; real TUI reverse-ID wire path not yet integrated | +| CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | +| Authenticated principal | **Blocked** | L1 implementation and real handler/REST/pump tests pending | +| Phase 1 read-only / approval never | **Blocked** | Audited PR #432 head defined it but did not enforce it before spawn/connect | +| TUI policy default-deny | **Blocked** | Audited PR #432 head allowed unknown shell/fs/write/applyPatch methods | +| Owner lease fail-closed | **Blocked** | Audited scheduler defaulted missing `ownerAttached` to true | +| Codex/schema/SQLite startup gate | **Blocked** | Helpers tested but not called on the production startup path; bundle digest needs path and boundary domain separation | +| Reply lifecycle and SSE wake | **Blocked** | No integrated Gateway `send_reply → new_reply` E2E or `markReplied` path | +| Human interrupt race | **Blocked** | Atomic interrupt/send/completion semantics and wire race test pending | +| Retry/reassign state consistency | **Blocked** | Canonical task/message ID and cancelled ledger state implementation pending | +| Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | + +## 8. Reproducible evidence log + +| Date | Ref | Command / evidence | Result | Interpretation | +|---|---|---|---|---| +| 2026-07-12 | A `90d1e58` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `169 pass / 0 fail / 555 expect` | Contract/protocol freeze evidence | +| 2026-07-12 | B audited head `8bc5652` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `97 pass / 0 fail` | Useful local core tests; not checkpoint sign-off | +| 2026-07-12 | B audited head `8bc5652` | `bun test agent-node/src/runtime` | `453 pass / 0 fail / 1902 expect` | No detected runtime-suite regression at that head | +| 2026-07-12 | B audited head `8bc5652` | `bun test server/src/rfc030-principal-stamp.test.ts` | `6 pass / 0 fail / 16 expect` | Fixture-only SQL test; explicitly not accepted as auth-handler evidence | + +Do not count uncommitted worktree changes, claimed-but-missing commits, baseline +failures without an independently reproduced baseline, or tests whose fixture +bypasses the production path. + +## 9. Review and release sequence + +1. Accept Wave 1A UDS segments A/B/C independently. +2. Accept Wave 1B L1 and L2 as separate commits with production-entry tests. +3. Re-estimate and explicitly release L3; consume `90d1e58`, delete stale + contract/mux/authorizer copies, and run the integrated hard-gate matrix. +4. 通信龙 reviews the complete Wave-1 checkpoint evidence. Only an explicit + checkpoint release starts Wave 2 runtime/product plumbing. +5. Finish Wave 2, then run the Docker-isolated layered suite and update runtime + documentation/release notes. +6. Send the full corrected draft SHA and raw evidence to `通信评审牛` for the + independent RFC §8 security review in Wave 3. Targeted earlier security + reviews may be requested for principal/auth changes, but do not replace the + final whole-change review. +7. Any P0/P1 finding returns to its owning wave. No waiver by the author or + lead; no merge while a required finding is open. +8. Vincent must separately authorize merge, deployment, production enablement + and any `latest` switch. Approval of this plan is not release authorization. + +## 10. Update protocol + +After every checkpoint: + +1. Update the relevant owner/state/evidence/gate row here. +2. Add a chronological comment to issue #428 with exact branch, commit, command + and raw pass/fail counts. +3. Label partial evidence as partial; never turn a fixture-level PASS into an + integrated PASS. +4. Keep draft PRs do-not-merge until the independent security gate is green. +5. Record decision changes in §1 before implementation so A and B cannot build + against different contracts. + +## 11. Explicitly out of scope until later approval + +- Human steering of an Agent-owned turn. +- Approval enablement or any write-capable Agent policy. +- Multi-user/shared-host exposure. +- Production deployment, package publication or `latest` promotion. +- Renaming the canonical runtime away from `codex-app-server`. From 82a755352f140e63154820c111de7b3c5688a1b6 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 09:44:57 +0800 Subject: [PATCH 02/29] =?UTF-8?q?docs(rfc030-plan):=20Wave=201B=20L1=20(34?= =?UTF-8?q?bea40)=20+=20L2=20(ed45f4d)=20checkpoint=20evidence=20=E2=80=94?= =?UTF-8?q?=20committed,=20awaiting=20review?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Author Agent: 通信SDK马 --- docs/plans/RFC-030-implementation-plan.md | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 634fcb21..00aa99ec 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -44,8 +44,8 @@ after every checkpoint. | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | | Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **In progress** | PR #431 | ETA 10–12h, three segment checkpoints | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests | -| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **In progress** | `rfc030-gateway-runtime`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Revised ETA 5h; committed evidence pending | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | -| Wave 1B L2 — runtime hardening | 通信SDK马 | **Released after L1** | PR #432 | Revised ETA 4h; committed evidence pending | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | +| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Committed, awaiting review** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Real-handler matrix `17/0`, REST HTTP suite `3/0`, pump starvation + auto-chain + retry/reassign inherit all on production entrypoints | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | +| Wave 1B L2 — runtime hardening | 通信SDK马 | **Committed, awaiting review** | PR #432 @ `ed45f4d` | boot-gate `5/0` (zero-invocation spawn proof, shared-attach typed refusal, baseline-gate-before-spawn), TUI default-deny sweep 12×3, ownerAttached required + park/resume, error generalization + alias escaping wire-level tests; gateway+app-server `118/0` | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Locked** | PR #432 | Additional ETA required | L1 + L2 accepted; stale contract/mux/authorizer deleted; full wire/startup evidence | | Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | | Wave 2 — product/runtime plumbing | Owners assigned after checkpoint | **Locked** | TBD | Not started | §3 scope complete; Docker tests green | @@ -152,14 +152,14 @@ fixture with the same name—proves every row. | Single mux, collisions and out-of-order routing | **Partial / blocked** | A mux unit tests green; audited PR #432 head used an unwired duplicate mux and replayed duplicate responses | | Approval forgery | **Partial / blocked** | Pure policy rejection is green; real TUI reverse-ID wire path not yet integrated | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | -| Authenticated principal | **Blocked** | L1 implementation and real handler/REST/pump tests pending | -| Phase 1 read-only / approval never | **Blocked** | Audited PR #432 head defined it but did not enforce it before spawn/connect | -| TUI policy default-deny | **Blocked** | Audited PR #432 head allowed unknown shell/fs/write/applyPatch methods | -| Owner lease fail-closed | **Blocked** | Audited scheduler defaulted missing `ownerAttached` to true | -| Codex/schema/SQLite startup gate | **Blocked** | Helpers tested but not called on the production startup path; bundle digest needs path and boundary domain separation | +| Authenticated principal | **PASS (L1 @ `34bea40`, pending review)** | principal.ts shared MCP+REST resolver (role union incl node/child per freeze Δ14); 9 write sites stamped (grep-audited); real registerTools handler matrix `17/0`; real Bun.serve+utok HTTP REST `3/0`; pump dead-letter + LIMIT starvation test green | +| Phase 1 read-only / approval never | **PASS (L2 @ `ed45f4d`, pending review)** | Enforced in openCodexAppServerRuntime BEFORE spawn/socket; argv always explicit pins; shared/adopt attach refused (typed `codex_gateway_phase1_shared_unverified`); marker-binary proof: dangerous config → zero invocations | +| TUI policy default-deny | **PASS (L2 @ `ed45f4d`, pending review)** | Explicit Phase-1 allowlist + default deny (`tui_method_not_allowed`); 12 dangerous/unknown methods × 3 reservations 0-forward sweep; adapts to A's async TuiRequestAuthorizer at L3 | +| Owner lease fail-closed | **PASS (L2 @ `ed45f4d`, pending review)** | `ownerAttached` now REQUIRED; no-owner → refused_no_owner; owner-drop-during-queue parks (no dispatch) + re-attach resumes; in-flight turn never auto-interrupted; A lifecycle/lease wiring lands at L3 | +| Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Blocked** | No integrated Gateway `send_reply → new_reply` E2E or `markReplied` path | | Human interrupt race | **Blocked** | Atomic interrupt/send/completion semantics and wire race test pending | -| Retry/reassign state consistency | **Blocked** | Canonical task/message ID and cancelled ledger state implementation pending | +| Retry/reassign state consistency | **Partial (L1)** | canonical_task_id + write-once origin principal + inherit implemented and handler-tested; REMAINING: cancelled ledger state mapping + (taskId,messageId) pair dedup semantics per freeze — scheduled with L3 | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -170,6 +170,11 @@ fixture with the same name—proves every row. | 2026-07-12 | B audited head `8bc5652` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `97 pass / 0 fail` | Useful local core tests; not checkpoint sign-off | | 2026-07-12 | B audited head `8bc5652` | `bun test agent-node/src/runtime` | `453 pass / 0 fail / 1902 expect` | No detected runtime-suite regression at that head | | 2026-07-12 | B audited head `8bc5652` | `bun test server/src/rfc030-principal-stamp.test.ts` | `6 pass / 0 fail / 16 expect` | Fixture-only SQL test; explicitly not accepted as auth-handler evidence | +| 2026-07-12 | B L1 `34bea40` | `bun test server/src/rfc030-principal-handler.test.ts` | `17 pass / 0 fail / 91 expect` | Real registerTools handler matrix: role authority, ntok≠owner, forged-alias invariance, retry/reassign inherit + canonical, auto-chain principal, pump starvation, backcompat | +| 2026-07-12 | B L1 `34bea40` | `bun test server/src/rfc030-principal-rest.test.ts` | `3 pass / 0 fail / 14 expect` | Real Bun.serve + issueUserToken mint over HTTP: /api/task stamp+origin+canonical, unauth→null, /api/broadcast | +| 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-app-server/boot-gate.test.ts` | `5 pass / 0 fail / 18 expect` | Production-entry gates: dangerous config → zero binary invocations; baseline gate before spawn; shared attach typed refusal with 0 connections | +| 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `118 pass / 0 fail / 1280 expect` | Full gateway + app-server suites at L2 head | +| 2026-07-12 | B L1 `34bea40` | `bun test server/` (single process, COMMHUB_DB isolated) | `538 pass / 11 fail` vs baseline `d418862` `515 pass / 8 fail` (identical 8× #380) | Pre-existing multi-importer Bun.serve conflict; all rfc030 suites green per-file; delta fully attributed | Do not count uncommitted worktree changes, claimed-but-missing commits, baseline failures without an independently reproduced baseline, or tests whose fixture From 396b8800520d1acfc1cb639007047b4dd79f270e Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 11:01:53 +0800 Subject: [PATCH 03/29] =?UTF-8?q?docs(rfc030-plan):=20L3=20released=20by?= =?UTF-8?q?=20=E9=80=9A=E4=BF=A1=E9=BE=99=20checkpoint=20=E2=80=94=20imple?= =?UTF-8?q?mentation=20only,=20security=20final=20gates=20locked?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Author Agent: 通信SDK马 --- docs/plans/RFC-030-implementation-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 00aa99ec..11e52326 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -46,7 +46,7 @@ after every checkpoint. | Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **In progress** | PR #431 | ETA 10–12h, three segment checkpoints | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Committed, awaiting review** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Real-handler matrix `17/0`, REST HTTP suite `3/0`, pump starvation + auto-chain + retry/reassign inherit all on production entrypoints | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Committed, awaiting review** | PR #432 @ `ed45f4d` | boot-gate `5/0` (zero-invocation spawn proof, shared-attach typed refusal, baseline-gate-before-spawn), TUI default-deny sweep 12×3, ownerAttached required + park/resume, error generalization + alias escaping wire-level tests; gateway+app-server `118/0` | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | -| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Locked** | PR #432 | Additional ETA required | L1 + L2 accepted; stale contract/mux/authorizer deleted; full wire/startup evidence | +| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **In progress — released by 通信龙 checkpoint (implementation only; security final gates NOT unlocked)** | PR #432 | R1–R9 plan, ~15h (~4.5h sequenced after 1A Segment B/C); hard acceptance: retry/reassign→send_reply lands on original canonical task owner-visible (integrated E2E), pump really consumes sender_*, all 9 write sites stamped | 副指挥 independent re-check + 通信评审牛 §8 review remain hard gates; stale contract/mux/authorizer deleted; full wire/startup evidence | | Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | | Wave 2 — product/runtime plumbing | Owners assigned after checkpoint | **Locked** | TBD | Not started | §3 scope complete; Docker tests green | | Wave 3 — independent security review and release decision | 通信评审牛 + 通信龙 + Vincent | **Locked** | TBD | Not started | §8 PASS, Vincent explicitly authorizes release/deploy/latest | From 3aacbc80af146e29b6d87ee05a97f6704cf55417 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 11:22:54 +0800 Subject: [PATCH 04/29] =?UTF-8?q?docs(rfc030-plan):=20L3=20R1-R5/R7/R8=20e?= =?UTF-8?q?vidence=20(ed827b3)=20=E2=80=94=20R6=20sequenced=20after=201A?= =?UTF-8?q?=20Segment=20B/C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Author Agent: 通信SDK马 --- docs/plans/RFC-030-implementation-plan.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 11e52326..a80070c0 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -149,7 +149,7 @@ fixture with the same name—proves every row. |---|---|---| | Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | | 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | -| Single mux, collisions and out-of-order routing | **Partial / blocked** | A mux unit tests green; audited PR #432 head used an unwired duplicate mux and replayed duplicate responses | +| Single mux, collisions and out-of-order routing | **PASS (L3 @ `7c1e12a`, pending review)** | SharedUpstreamMux deleted; client drives A's one-shot UpstreamRequestMux; duplicate response → orphan (replay hole closed); tuiId restored; drain selectivity wire-tested | | Approval forgery | **Partial / blocked** | Pure policy rejection is green; real TUI reverse-ID wire path not yet integrated | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | | Authenticated principal | **PASS (L1 @ `34bea40`, pending review)** | principal.ts shared MCP+REST resolver (role union incl node/child per freeze Δ14); 9 write sites stamped (grep-audited); real registerTools handler matrix `17/0`; real Bun.serve+utok HTTP REST `3/0`; pump dead-letter + LIMIT starvation test green | @@ -157,9 +157,9 @@ fixture with the same name—proves every row. | TUI policy default-deny | **PASS (L2 @ `ed45f4d`, pending review)** | Explicit Phase-1 allowlist + default deny (`tui_method_not_allowed`); 12 dangerous/unknown methods × 3 reservations 0-forward sweep; adapts to A's async TuiRequestAuthorizer at L3 | | Owner lease fail-closed | **PASS (L2 @ `ed45f4d`, pending review)** | `ownerAttached` now REQUIRED; no-owner → refused_no_owner; owner-drop-during-queue parks (no dispatch) + re-attach resumes; in-flight turn never auto-interrupted; A lifecycle/lease wiring lands at L3 | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | -| Reply lifecycle and SSE wake | **Blocked** | No integrated Gateway `send_reply → new_reply` E2E or `markReplied` path | -| Human interrupt race | **Blocked** | Atomic interrupt/send/completion semantics and wire race test pending | -| Retry/reassign state consistency | **Partial (L1)** | canonical_task_id + write-once origin principal + inherit implemented and handler-tested; REMAINING: cancelled ledger state mapping + (taskId,messageId) pair dedup semantics per freeze — scheduled with L3 | +| Reply lifecycle and SSE wake | **PASS (L3 @ `57e45ce`, pending review)** | Integrated E2E: real handlers + real pump + real Bun.serve SSE; retry-crossing canonical hit + owner-visible replied + new_reply wake asserted | +| Human interrupt race | **PASS (L3 @ `ed827b3`, pending review)** | noteHumanInterruptForwarded wire hook; abort-completion reclassified interrupted_by_human; dispatch-response race via sentinel; completed-first never falsely interrupted — 2 wire-race tests | +| Retry/reassign state consistency | **PASS (L3 @ `c950e30`, pending review)** | Attempt-per-messageId ledger rows; (taskId,messageId) pair dedup exactly-once; cancelled state + roundtrip; queuePosition race fixed; canonical E2E via R7 | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -175,6 +175,8 @@ fixture with the same name—proves every row. | 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-app-server/boot-gate.test.ts` | `5 pass / 0 fail / 18 expect` | Production-entry gates: dangerous config → zero binary invocations; baseline gate before spawn; shared attach typed refusal with 0 connections | | 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `118 pass / 0 fail / 1280 expect` | Full gateway + app-server suites at L2 head | | 2026-07-12 | B L1 `34bea40` | `bun test server/` (single process, COMMHUB_DB isolated) | `538 pass / 11 fail` vs baseline `d418862` `515 pass / 8 fail` (identical 8× #380) | Pre-existing multi-importer Bun.serve conflict; all rfc030 suites green per-file; delta fully attributed | +| 2026-07-12 | B L3 `ed827b3` (R1–R5,R7,R8) | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `270 pass / 0 fail / 2387 expect` | Incl. A's frozen 169 contract/protocol tests running in B's tree after verbatim adoption (sha256 == freeze) | +| 2026-07-12 | B L3 `57e45ce` | `bun test server/src/rfc030-reply-lifecycle-e2e.test.ts` | `1 pass / 0 fail / 17 expect` | 通信龙硬验收①② integrated E2E: retry→pump(sender_*)→send_reply lands on ORIGINAL canonical task, owner-visible replied+result, originator woken over REAL HTTP SSE new_reply | Do not count uncommitted worktree changes, claimed-but-missing commits, baseline failures without an independently reproduced baseline, or tests whose fixture From bc7c19ba056b72326d9d22c99750766633424fa4 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:29:13 +0800 Subject: [PATCH 05/29] docs(rfc030-plan): Wave 1A Segments A/B/C committed (00d4ea8) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the Wave 1A UDS/lifecycle row, per-segment checkpoint table, and evidence log with the three post-freeze commits: Segment A `98676f1` uds-server.ts 28 pass / 0 fail / 72 expect Segment B `04560c0` human-owner.ts 16 pass / 0 fail / 43 expect Segment C `00d4ea8` lifecycle.ts 19 pass / 0 fail / 59 expect Combined gateway suite at C: 232 pass / 0 fail / 729 expect (command: `bun test agent-node/src/runtime/codex-policy-gateway/`). State semantics preserved: coordinator independent recheck and the §8 security review remain hard-locked. Test-green is not merge- green — merge/deploy/latest all still frozen per §1 and §9. Author: comm eng --- docs/plans/RFC-030-implementation-plan.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index a80070c0..db9699d7 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) +> Last updated: 2026-07-12 (Asia/Shanghai) — Wave 1A Segments A/B/C committed at `00d4ea8`, gateway suite `232/0/729`; coordinator recheck + §8 security review still hard-locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -43,7 +43,7 @@ after every checkpoint. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **In progress** | PR #431 | ETA 10–12h, three segment checkpoints | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests | +| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **Segments A/B/C committed, awaiting review** | PR #431 @ `00d4ea8` (A `98676f1` / B `04560c0` / C `00d4ea8`) | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests, no-throw provider/diagnostics, Phase-1 default-deny fake | Coordinator independent recheck; §8 security gate remains locked | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Committed, awaiting review** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Real-handler matrix `17/0`, REST HTTP suite `3/0`, pump starvation + auto-chain + retry/reassign inherit all on production entrypoints | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Committed, awaiting review** | PR #432 @ `ed45f4d` | boot-gate `5/0` (zero-invocation spawn proof, shared-attach typed refusal, baseline-gate-before-spawn), TUI default-deny sweep 12×3, ownerAttached required + park/resume, error generalization + alias escaping wire-level tests; gateway+app-server `118/0` | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **In progress — released by 通信龙 checkpoint (implementation only; security final gates NOT unlocked)** | PR #432 | R1–R9 plan, ~15h (~4.5h sequenced after 1A Segment B/C); hard acceptance: retry/reassign→send_reply lands on original canonical task owner-visible (integrated E2E), pump really consumes sender_*, all 9 write sites stamped | 副指挥 independent re-check + 通信评审牛 §8 review remain hard gates; stale contract/mux/authorizer deleted; full wire/startup evidence | @@ -134,11 +134,14 @@ starve a valid task. ## 6. Wave-1A UDS/lifecycle checkpoints -| Segment | Scope | Required evidence | -|---|---|---| -| A | Agent UDS + TUI UDS + framing | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | -| B | Human owner and reverse-request lifecycle | TUI disconnect drains only proxied TUI and reverse IDs; internal response still routes; unknown/duplicate approval response fails closed; reconnect does not replay drained approvals | -| C | Lifecycle orchestration | Inject B's backend/client/preflight rather than duplicate scheduler, ledger, policy, baseline gate or reconnect logic; provider/diagnostics are no-throw; UDS opens only after preflight; shutdown rejects pending work before drain | +| Segment | Scope | Committed SHA | Required evidence | Status | +|---|---|---|---|---| +| A | Agent UDS + TUI UDS + framing | `98676f1` | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | **Committed 28/0/72** — pending coordinator recheck | +| B | Human owner and reverse-request lifecycle | `04560c0` | TUI disconnect drains only proxied TUI and reverse IDs; internal response still routes; unknown/duplicate approval response fails closed; reconnect does not replay drained approvals; Phase 1 `approvalMode="never"` refuse-all + defense-in-depth; Phase 2 `passthrough` structure ready as a config flip | **Committed 16/0/43** — pending coordinator recheck | +| C | Lifecycle orchestration | `00d4ea8` | Injected `PreflightRunner` runs before any socket touches disk; failing preflight leaves no path on disk; no-throw `TuiInitializeProvider` / `ProtocolDiagnostics` wrappers (self-throwing sink does not cascade or hang); explicit-empty-allowlist Phase 1 `defaultDenyTuiAuthorizer`; state machine created→starting→running→stopping→stopped; shutdown drains mux + reverseNs after GatewayServer.stop; no second queue/scheduler/ledger/reservation/baseline-gate/client-reconnect | **Committed 19/0/59** — pending coordinator recheck | + +Full gateway suite after Segment C: `232 pass / 0 fail / 729 expect()` +(`bun test agent-node/src/runtime/codex-policy-gateway/`). ## 7. Production hard-gate matrix @@ -177,6 +180,10 @@ fixture with the same name—proves every row. | 2026-07-12 | B L1 `34bea40` | `bun test server/` (single process, COMMHUB_DB isolated) | `538 pass / 11 fail` vs baseline `d418862` `515 pass / 8 fail` (identical 8× #380) | Pre-existing multi-importer Bun.serve conflict; all rfc030 suites green per-file; delta fully attributed | | 2026-07-12 | B L3 `ed827b3` (R1–R5,R7,R8) | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `270 pass / 0 fail / 2387 expect` | Incl. A's frozen 169 contract/protocol tests running in B's tree after verbatim adoption (sha256 == freeze) | | 2026-07-12 | B L3 `57e45ce` | `bun test server/src/rfc030-reply-lifecycle-e2e.test.ts` | `1 pass / 0 fail / 17 expect` | 通信龙硬验收①② integrated E2E: retry→pump(sender_*)→send_reply lands on ORIGINAL canonical task, owner-visible replied+result, originator woken over REAL HTTP SSE new_reply | +| 2026-07-12 | A Segment A `98676f1` | `bun test agent-node/src/runtime/codex-policy-gateway/uds-server.test.ts` | `28 pass / 0 fail / 72 expect` | Real UDS bytes-in/out coverage: 0700 dir + 0600 socket + lstat symlink/pre-existing-path refusal; fragmented / coalesced / half-packet / oversize / malformed JSON / blank-line keepalive / slow-loris cap; real no-id `initialized` = 0 wire response; TUI init returns injected upstream snapshot; dual-origin same socket out-of-order; duplicate & unknown upstream response → diagnostic orphan; TUI disconnect preserves internal pending; approval-spoof + duplicate reverse-id fail closed; no-TUI reverse request → NoOwner upstream; connection cap | +| 2026-07-12 | A Segment B `04560c0` | `bun test agent-node/src/runtime/codex-policy-gateway/human-owner.test.ts` | `16 pass / 0 fail / 43 expect` | HumanOwnerCoordinator sole holder of ReverseRequestNamespace; Phase 1 `approvalMode="never"` refuses regardless of TUI attach; Phase 2 `passthrough` with TUI → forward_tui / no TUI → NoOwner / collision → InvalidArg; detachTui drains proxied_tui + reverseNs, internal pending untouched; reconnect cannot re-approve stale ids | +| 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/lifecycle.test.ts` | `19 pass / 0 fail / 59 expect` | `PreflightRunner` throw → no socket path on disk, state=stopped; mid-run fs inspection proves preflight runs before bind; makeNoThrowInitializeProvider degrades to undefined + logs sink; makeNoThrowDiagnostics newCorrelationId throw / non-string return → "cid-fallback"; reportInternalError throw swallowed; `DEFAULT_DENY_ALLOWLIST.size === 0`; every method → verdict=deny + code=Busy with explicit reason; state gating rejects sendInternal/sendProxiedTui outside `running`; shutdown drains mux + reverseNs + cleans sockets | +| 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `232 pass / 0 fail / 729 expect` | Full gateway suite after A/B/C combined — no regression against frozen contract/protocol test count (169 → 197 after A → 213 after B → 232 after C) | Do not count uncommitted worktree changes, claimed-but-missing commits, baseline failures without an independently reproduced baseline, or tests whose fixture From edd9ae02b24b6fa87c4f243b955d7cf812c02059 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:43:34 +0800 Subject: [PATCH 06/29] docs(rfc030-plan): record independent checkpoint failures --- docs/plans/RFC-030-implementation-plan.md | 53 +++++++++++++++-------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index db9699d7..dfb536c9 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) — Wave 1A Segments A/B/C committed at `00d4ea8`, gateway suite `232/0/729`; coordinator recheck + §8 security review still hard-locked. +> Last updated: 2026-07-12 (Asia/Shanghai) — independent checkpoint audit **FAIL** despite green unit suites; A/B corrective work is required and all downstream gates remain hard-locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -43,10 +43,10 @@ after every checkpoint. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **Segments A/B/C committed, awaiting review** | PR #431 @ `00d4ea8` (A `98676f1` / B `04560c0` / C `00d4ea8`) | Owner-only UDS, real framing/notifications, one mux instance, disconnect/reverse-ID tests, no-throw provider/diagnostics, Phase-1 default-deny fake | Coordinator independent recheck; §8 security gate remains locked | -| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Committed, awaiting review** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Real-handler matrix `17/0`, REST HTTP suite `3/0`, pump starvation + auto-chain + retry/reassign inherit all on production entrypoints | Real auth/handler/REST/retry/reassign/auto-chain/starvation E2E | -| Wave 1B L2 — runtime hardening | 通信SDK马 | **Committed, awaiting review** | PR #432 @ `ed45f4d` | boot-gate `5/0` (zero-invocation spawn proof, shared-attach typed refusal, baseline-gate-before-spawn), TUI default-deny sweep 12×3, ownerAttached required + park/resume, error generalization + alias escaping wire-level tests; gateway+app-server `118/0` | Spawn-time read-only/never, TUI default-deny, owner fail-closed, sanitized errors/aliases | -| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **In progress — released by 通信龙 checkpoint (implementation only; security final gates NOT unlocked)** | PR #432 | R1–R9 plan, ~15h (~4.5h sequenced after 1A Segment B/C); hard acceptance: retry/reassign→send_reply lands on original canonical task owner-visible (integrated E2E), pump really consumes sender_*, all 9 write sites stamped | 副指挥 independent re-check + 通信评审牛 §8 review remain hard gates; stale contract/mux/authorizer deleted; full wire/startup evidence | +| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — corrective work required** | PR #431 @ `00d4ea8` (A `98676f1` / B `04560c0` / C `00d4ea8`) | `232/0/729` is retained as unit evidence only; real-path audit found coordinator bypass, unresolved pending requests, transport teardown and lifecycle-race failures | Separate P0 integration + P1 hardening commits, then independent reproduction | +| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — corrective work required** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but valid pump rows are not ACKed, pump has no production wiring, MCP auth still branches on raw token prefix, and canonical-attempt cleanup is incomplete | Real auth/pump/dead-letter/canonical-attempt production E2E | +| Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | +| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Candidate was pushed after an explicit L3 pause; `351/0/2634` remains unit evidence only and does not override A/L1 blockers | No further changes until coordinator re-releases a scoped tranche; full integrated evidence required | | Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | | Wave 2 — product/runtime plumbing | Owners assigned after checkpoint | **Locked** | TBD | Not started | §3 scope complete; Docker tests green | | Wave 3 — independent security review and release decision | 通信评审牛 + 通信龙 + Vincent | **Locked** | TBD | Not started | §8 PASS, Vincent explicitly authorizes release/deploy/latest | @@ -136,9 +136,9 @@ starve a valid task. | Segment | Scope | Committed SHA | Required evidence | Status | |---|---|---|---|---| -| A | Agent UDS + TUI UDS + framing | `98676f1` | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | **Committed 28/0/72** — pending coordinator recheck | -| B | Human owner and reverse-request lifecycle | `04560c0` | TUI disconnect drains only proxied TUI and reverse IDs; internal response still routes; unknown/duplicate approval response fails closed; reconnect does not replay drained approvals; Phase 1 `approvalMode="never"` refuse-all + defense-in-depth; Phase 2 `passthrough` structure ready as a config flip | **Committed 16/0/43** — pending coordinator recheck | -| C | Lifecycle orchestration | `00d4ea8` | Injected `PreflightRunner` runs before any socket touches disk; failing preflight leaves no path on disk; no-throw `TuiInitializeProvider` / `ProtocolDiagnostics` wrappers (self-throwing sink does not cascade or hang); explicit-empty-allowlist Phase 1 `defaultDenyTuiAuthorizer`; state machine created→starting→running→stopping→stopped; shutdown drains mux + reverseNs after GatewayServer.stop; no second queue/scheduler/ledger/reservation/baseline-gate/client-reconnect | **Committed 19/0/59** — pending coordinator recheck | +| A | Agent UDS + TUI UDS + framing | `98676f1` | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | **FAIL after independent review** — no role capability handshake/single TUI, incomplete rollback/path hardening, escaped 128 KiB payload can exceed the frame cap | +| B | Human owner and reverse-request lifecycle | `04560c0` | TUI disconnect drains only proxied TUI and reverse IDs; internal response still routes; unknown/duplicate approval response fails closed; reconnect does not replay drained approvals; Phase 1 `approvalMode="never"` refuse-all + defense-in-depth | **FAIL after independent review** — coordinator is not connected to the real UDS reverse-request path | +| C | Lifecycle orchestration | `00d4ea8` | Injected `PreflightRunner` runs before any socket touches disk; no-throw provider/diagnostics wrappers; explicit-empty-allowlist default-deny authorizer; lifecycle state machine | **FAIL after independent review** — stop/upstream close can orphan internal promises; no transport close/abort contract; stop-during-preflight can resurrect the server | Full gateway suite after Segment C: `232 pass / 0 fail / 729 expect()` (`bun test agent-node/src/runtime/codex-policy-gateway/`). @@ -152,17 +152,17 @@ fixture with the same name—proves every row. |---|---|---| | Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | | 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | -| Single mux, collisions and out-of-order routing | **PASS (L3 @ `7c1e12a`, pending review)** | SharedUpstreamMux deleted; client drives A's one-shot UpstreamRequestMux; duplicate response → orphan (replay hole closed); tuiId restored; drain selectivity wire-tested | +| Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | | Approval forgery | **Partial / blocked** | Pure policy rejection is green; real TUI reverse-ID wire path not yet integrated | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | -| Authenticated principal | **PASS (L1 @ `34bea40`, pending review)** | principal.ts shared MCP+REST resolver (role union incl node/child per freeze Δ14); 9 write sites stamped (grep-audited); real registerTools handler matrix `17/0`; real Bun.serve+utok HTTP REST `3/0`; pump dead-letter + LIMIT starvation test green | -| Phase 1 read-only / approval never | **PASS (L2 @ `ed45f4d`, pending review)** | Enforced in openCodexAppServerRuntime BEFORE spawn/socket; argv always explicit pins; shared/adopt attach refused (typed `codex_gateway_phase1_shared_unverified`); marker-binary proof: dangerous config → zero invocations | -| TUI policy default-deny | **PASS (L2 @ `ed45f4d`, pending review)** | Explicit Phase-1 allowlist + default deny (`tui_method_not_allowed`); 12 dangerous/unknown methods × 3 reservations 0-forward sweep; adapts to A's async TuiRequestAuthorizer at L3 | -| Owner lease fail-closed | **PASS (L2 @ `ed45f4d`, pending review)** | `ownerAttached` now REQUIRED; no-owner → refused_no_owner; owner-drop-during-queue parks (no dispatch) + re-attach resumes; in-flight turn never auto-interrupted; A lifecycle/lease wiring lands at L3 | +| Authenticated principal | **FAIL (L1 @ `34bea40`)** | Principal resolver direction is useful, but production pump/ACK/dead-letter is not wired, raw token-prefix branching remains, and handler tests fabricate impossible auth contexts | +| Phase 1 read-only / approval never | **FAIL in integrated path** | Spawn/profile gates pass in isolation; real UDS reverse requests bypass the never-mode coordinator and can reach an attached TUI | +| TUI policy default-deny | **Partial / blocked** | Unknown methods deny correctly, but thread-bound methods do not consistently require a present bound `threadId`; integrate only after A correction | +| Owner lease fail-closed | **FAIL in integrated path** | Scheduler probe exists, but the UDS admits multiple TUI clients and does not wire coordinator attach/detach/reverse routing as the single source of truth | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | -| Reply lifecycle and SSE wake | **PASS (L3 @ `57e45ce`, pending review)** | Integrated E2E: real handlers + real pump + real Bun.serve SSE; retry-crossing canonical hit + owner-visible replied + new_reply wake asserted | -| Human interrupt race | **PASS (L3 @ `ed827b3`, pending review)** | noteHumanInterruptForwarded wire hook; abort-completion reclassified interrupted_by_human; dispatch-response race via sentinel; completed-first never falsely interrupted — 2 wire-race tests | -| Retry/reassign state consistency | **PASS (L3 @ `c950e30`, pending review)** | Attempt-per-messageId ledger rows; (taskId,messageId) pair dedup exactly-once; cancelled state + roundtrip; queuePosition race fixed; canonical E2E via R7 | +| Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | +| Human interrupt race | **Partial / blocked** | Unit race tests pass; current interrupt marker is not yet proven to be tied to one active turn only after upstream acceptance | +| Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -184,6 +184,20 @@ fixture with the same name—proves every row. | 2026-07-12 | A Segment B `04560c0` | `bun test agent-node/src/runtime/codex-policy-gateway/human-owner.test.ts` | `16 pass / 0 fail / 43 expect` | HumanOwnerCoordinator sole holder of ReverseRequestNamespace; Phase 1 `approvalMode="never"` refuses regardless of TUI attach; Phase 2 `passthrough` with TUI → forward_tui / no TUI → NoOwner / collision → InvalidArg; detachTui drains proxied_tui + reverseNs, internal pending untouched; reconnect cannot re-approve stale ids | | 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/lifecycle.test.ts` | `19 pass / 0 fail / 59 expect` | `PreflightRunner` throw → no socket path on disk, state=stopped; mid-run fs inspection proves preflight runs before bind; makeNoThrowInitializeProvider degrades to undefined + logs sink; makeNoThrowDiagnostics newCorrelationId throw / non-string return → "cid-fallback"; reportInternalError throw swallowed; `DEFAULT_DENY_ALLOWLIST.size === 0`; every method → verdict=deny + code=Busy with explicit reason; state gating rejects sendInternal/sendProxiedTui outside `running`; shutdown drains mux + reverseNs + cleans sockets | | 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `232 pass / 0 fail / 729 expect` | Full gateway suite after A/B/C combined — no regression against frozen contract/protocol test count (169 → 197 after A → 213 after B → 232 after C) | +| 2026-07-12 | B frozen candidate `090ce12` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server*.test.ts` | `351 pass / 0 fail / 2634 expect` | Independent rerun is green but **not a checkpoint PASS**: real-path A lifecycle and L1 production-pump failures remain outside the asserted paths | + +### Independent checkpoint failures recorded 2026-07-12 + +- A UDS/lifecycle: wire `HumanOwnerCoordinator` into the real reverse-request + path; require one authenticated/capability-separated TUI; reject all pending + origins exactly once on close; add lifecycle-owned transport close/abort and + a start generation fence; harden rollback, path identity and frame sizing. +- B L1: classify enqueue outcomes for ACK/backoff/dead-letter; add a real + production pump/demux and atomic validated dead-letter; carry server-resolved + token kind through MCP auth; test real bearer contexts; clean every delivery + attempt by canonical task ID; enforce origin write-once at the database layer. +- Candidate `090ce12` was pushed after the L3 pause. It is preserved for audit + and must not be treated as approval, release, merge or production evidence. Do not count uncommitted worktree changes, claimed-but-missing commits, baseline failures without an independently reproduced baseline, or tests whose fixture @@ -191,9 +205,10 @@ bypasses the production path. ## 9. Review and release sequence -1. Accept Wave 1A UDS segments A/B/C independently. -2. Accept Wave 1B L1 and L2 as separate commits with production-entry tests. -3. Re-estimate and explicitly release L3; consume `90d1e58`, delete stale +1. Correct and independently re-accept Wave 1A UDS segments A/B/C. +2. Correct and independently re-accept Wave 1B L1 and L2 as separate commits + with production-entry tests. +3. Only then re-estimate and explicitly re-release L3; consume `90d1e58`, delete stale contract/mux/authorizer copies, and run the integrated hard-gate matrix. 4. 通信龙 reviews the complete Wave-1 checkpoint evidence. Only an explicit checkpoint release starts Wave 2 runtime/product plumbing. From c7a25571352d7dfeca73bff0343e9216cbf88828 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:45:25 +0800 Subject: [PATCH 07/29] docs(rfc030-plan): clarify R6 provenance and audit --- docs/plans/RFC-030-implementation-plan.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index dfb536c9..08f63d12 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -46,7 +46,7 @@ after every checkpoint. | Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — corrective work required** | PR #431 @ `00d4ea8` (A `98676f1` / B `04560c0` / C `00d4ea8`) | `232/0/729` is retained as unit evidence only; real-path audit found coordinator bypass, unresolved pending requests, transport teardown and lifecycle-race failures | Separate P0 integration + P1 hardening commits, then independent reproduction | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — corrective work required** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but valid pump rows are not ACKed, pump has no production wiring, MCP auth still branches on raw token prefix, and canonical-attempt cleanup is incomplete | Real auth/pump/dead-letter/canonical-attempt production E2E | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | -| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Candidate was pushed after an explicit L3 pause; `351/0/2634` remains unit evidence only and does not override A/L1 blockers | No further changes until coordinator re-releases a scoped tranche; full integrated evidence required | +| Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | | Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | | Wave 2 — product/runtime plumbing | Owners assigned after checkpoint | **Locked** | TBD | Not started | §3 scope complete; Docker tests green | | Wave 3 — independent security review and release decision | 通信评审牛 + 通信龙 + Vincent | **Locked** | TBD | Not started | §8 PASS, Vincent explicitly authorizes release/deploy/latest | @@ -161,7 +161,7 @@ fixture with the same name—proves every row. | Owner lease fail-closed | **FAIL in integrated path** | Scheduler probe exists, but the UDS admits multiple TUI clients and does not wire coordinator attach/detach/reverse routing as the single source of truth | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | -| Human interrupt race | **Partial / blocked** | Unit race tests pass; current interrupt marker is not yet proven to be tied to one active turn only after upstream acceptance | +| Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | @@ -185,6 +185,7 @@ fixture with the same name—proves every row. | 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/lifecycle.test.ts` | `19 pass / 0 fail / 59 expect` | `PreflightRunner` throw → no socket path on disk, state=stopped; mid-run fs inspection proves preflight runs before bind; makeNoThrowInitializeProvider degrades to undefined + logs sink; makeNoThrowDiagnostics newCorrelationId throw / non-string return → "cid-fallback"; reportInternalError throw swallowed; `DEFAULT_DENY_ALLOWLIST.size === 0`; every method → verdict=deny + code=Busy with explicit reason; state gating rejects sendInternal/sendProxiedTui outside `running`; shutdown drains mux + reverseNs + cleans sockets | | 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `232 pass / 0 fail / 729 expect` | Full gateway suite after A/B/C combined — no regression against frozen contract/protocol test count (169 → 197 after A → 213 after B → 232 after C) | | 2026-07-12 | B frozen candidate `090ce12` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server*.test.ts` | `351 pass / 0 fail / 2634 expect` | Independent rerun is green but **not a checkpoint PASS**: real-path A lifecycle and L1 production-pump failures remain outside the asserted paths | +| 2026-07-12 | B frozen candidate `090ce12` | targeted lifecycle/UDS/owner/assembly + full gateway audit | `65/0/191` targeted; `322/0/2547` gateway | Runtime probes still reproduced approval-never bypass, two unauthenticated TUIs, pending-Promise loss, preflight resurrection, subscription rollback leak, unbound interrupt state and optional thread IDs | ### Independent checkpoint failures recorded 2026-07-12 @@ -196,8 +197,11 @@ fixture with the same name—proves every row. production pump/demux and atomic validated dead-letter; carry server-resolved token kind through MCP auth; test real bearer contexts; clean every delivery attempt by canonical task ID; enforce origin write-once at the database layer. -- Candidate `090ce12` was pushed after the L3 pause. It is preserved for audit - and must not be treated as approval, release, merge or production evidence. +- Candidate `090ce12` was produced only after 通信龙 issued a written R6 restore + that conflicted with the coordinator pause. 通信龙 later withdrew that restore + after the independent audit invalidated its assumptions. B followed the + instruction chain and bears no process fault. The candidate is preserved for + audit and is not approval, release, merge or production evidence. Do not count uncommitted worktree changes, claimed-but-missing commits, baseline failures without an independently reproduced baseline, or tests whose fixture From 51fc315a2beeebab8aa86cdb9fffe19d37c5f01d Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:50:30 +0800 Subject: [PATCH 08/29] docs(rfc030-plan): record aggregate test isolation blocker --- docs/plans/RFC-030-implementation-plan.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 08f63d12..c0a1dc6d 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -163,6 +163,7 @@ fixture with the same name—proves every row. | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | +| Server aggregate test isolation | **FAIL** | Candidate full suite is `538/12/1638` versus baseline `515/8/1518`; four candidate tests fail before assertions because module-singleton server, port and DB fixtures are shared. Per-file green is partial evidence only | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -177,7 +178,7 @@ fixture with the same name—proves every row. | 2026-07-12 | B L1 `34bea40` | `bun test server/src/rfc030-principal-rest.test.ts` | `3 pass / 0 fail / 14 expect` | Real Bun.serve + issueUserToken mint over HTTP: /api/task stamp+origin+canonical, unauth→null, /api/broadcast | | 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-app-server/boot-gate.test.ts` | `5 pass / 0 fail / 18 expect` | Production-entry gates: dangerous config → zero binary invocations; baseline gate before spawn; shared attach typed refusal with 0 connections | | 2026-07-12 | B L2 `ed45f4d` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `118 pass / 0 fail / 1280 expect` | Full gateway + app-server suites at L2 head | -| 2026-07-12 | B L1 `34bea40` | `bun test server/` (single process, COMMHUB_DB isolated) | `538 pass / 11 fail` vs baseline `d418862` `515 pass / 8 fail` (identical 8× #380) | Pre-existing multi-importer Bun.serve conflict; all rfc030 suites green per-file; delta fully attributed | +| 2026-07-12 | B candidate `090ce12` vs baseline `d418862` | full server suite with separate explicit `COMMHUB_DB` | candidate `538/12/1638`; baseline `515/8/1518` | Root cause is the known module-singleton server/port class, but the candidate adds four aggregate failures; test isolation is a blocker and the previous `538/11` / “zero new regression” claim is withdrawn | | 2026-07-12 | B L3 `ed827b3` (R1–R5,R7,R8) | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server/` | `270 pass / 0 fail / 2387 expect` | Incl. A's frozen 169 contract/protocol tests running in B's tree after verbatim adoption (sha256 == freeze) | | 2026-07-12 | B L3 `57e45ce` | `bun test server/src/rfc030-reply-lifecycle-e2e.test.ts` | `1 pass / 0 fail / 17 expect` | 通信龙硬验收①② integrated E2E: retry→pump(sender_*)→send_reply lands on ORIGINAL canonical task, owner-visible replied+result, originator woken over REAL HTTP SSE new_reply | | 2026-07-12 | A Segment A `98676f1` | `bun test agent-node/src/runtime/codex-policy-gateway/uds-server.test.ts` | `28 pass / 0 fail / 72 expect` | Real UDS bytes-in/out coverage: 0700 dir + 0600 socket + lstat symlink/pre-existing-path refusal; fragmented / coalesced / half-packet / oversize / malformed JSON / blank-line keepalive / slow-loris cap; real no-id `initialized` = 0 wire response; TUI init returns injected upstream snapshot; dual-origin same socket out-of-order; duplicate & unknown upstream response → diagnostic orphan; TUI disconnect preserves internal pending; approval-spoof + duplicate reverse-id fail closed; no-TUI reverse request → NoOwner upstream; connection cap | @@ -197,6 +198,11 @@ fixture with the same name—proves every row. production pump/demux and atomic validated dead-letter; carry server-resolved token kind through MCP auth; test real bearer contexts; clean every delivery attempt by canonical task ID; enforce origin write-once at the database layer. +- Server tests: isolate every real-server fixture from ambient module state, + ports and databases. The current host-supervisors test imports `db` before its + `beforeAll` assigns the advertised temp DB, so a naked per-file run hits the + DB safety guard and combined runs share another suite's database. A selected + three-file run cannot substitute for a deterministic aggregate gate. - Candidate `090ce12` was produced only after 通信龙 issued a written R6 restore that conflicted with the coordinator pause. 通信龙 later withdrew that restore after the independent audit invalidated its assumptions. B followed the From 02241e15a44d1a38c98649f1bf975a2ab4906616 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:52:35 +0800 Subject: [PATCH 09/29] docs(rfc030-plan): split candidate gate from baseline debt --- docs/plans/RFC-030-implementation-plan.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index c0a1dc6d..468049b1 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -163,7 +163,8 @@ fixture with the same name—proves every row. | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | -| Server aggregate test isolation | **FAIL** | Candidate full suite is `538/12/1638` versus baseline `515/8/1518`; four candidate tests fail before assertions because module-singleton server, port and DB fixtures are shared. Per-file green is partial evidence only | +| Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | +| Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -198,11 +199,13 @@ fixture with the same name—proves every row. production pump/demux and atomic validated dead-letter; carry server-resolved token kind through MCP auth; test real bearer contexts; clean every delivery attempt by canonical task ID; enforce origin write-once at the database layer. -- Server tests: isolate every real-server fixture from ambient module state, - ports and databases. The current host-supervisors test imports `db` before its - `beforeAll` assigns the advertised temp DB, so a naked per-file run hits the - DB safety guard and combined runs share another suite's database. A selected - three-file run cannot substitute for a deterministic aggregate gate. +- RFC-030 server tests: isolate the new principal/auth and reply fixtures so the + candidate introduces no failures beyond the baseline eight and every new + security assertion executes in aggregate. The broader historical cleanup is + tracked separately in #434 and does not block RFC-030 after this delta clears. + The current host-supervisors test imports `db` before its `beforeAll` assigns + the advertised temp DB, so it remains useful baseline evidence but not a + waiver for the candidate's four added failures. - Candidate `090ce12` was produced only after 通信龙 issued a written R6 restore that conflicted with the coordinator pause. 通信龙 later withdrew that restore after the independent audit invalidated its assumptions. B followed the From ad1b5890c3a6b0b5ad9fe9acfa5a3d941d1e7227 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:54:33 +0800 Subject: [PATCH 10/29] docs(rfc030-plan): record test database guard boundary --- docs/plans/RFC-030-implementation-plan.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 468049b1..31aa86df 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -165,6 +165,7 @@ fixture with the same name—proves every row. | Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | +| Test production-DB isolation | **Partial / P0 open** | SQLite naked-test guard was syscall-verified before any `~/.commhub` open. However `DATABASE_URL` is evaluated before that guard, so inherited production PostgreSQL configuration must be rejected by default in tests before §8 review | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -206,6 +207,11 @@ fixture with the same name—proves every row. The current host-supervisors test imports `db` before its `beforeAll` assigns the advertised temp DB, so it remains useful baseline evidence but not a waiver for the candidate's four added failures. +- Production-DB guard: the SQLite refusal runs before path calculation, mkdir, + database open and schema execution; `strace` confirmed zero production-path + access. Extend the same fail-closed rule to inherited `DATABASE_URL`, which is + currently selected before the SQLite-only guard. Until fixed, test commands + explicitly unset it unless they run an isolated PostgreSQL test database. - Candidate `090ce12` was produced only after 通信龙 issued a written R6 restore that conflicted with the coordinator pause. 通信龙 later withdrew that restore after the independent audit invalidated its assumptions. B followed the From d91b28520d22792370ce548d59bd2300bedbb431 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 13:56:38 +0800 Subject: [PATCH 11/29] docs(rfc030-plan): track DATABASE_URL P0 separately --- docs/plans/RFC-030-implementation-plan.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 31aa86df..7e05be48 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -165,7 +165,7 @@ fixture with the same name—proves every row. | Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | -| Test production-DB isolation | **Partial / P0 open** | SQLite naked-test guard was syscall-verified before any `~/.commhub` open. However `DATABASE_URL` is evaluated before that guard, so inherited production PostgreSQL configuration must be rejected by default in tests before §8 review | +| Test production-DB isolation | **Partial / P0 [#435](https://github.com/sleep2agi/agent-network/issues/435) open** | SQLite naked-test guard was syscall-verified before any `~/.commhub` open. `DATABASE_URL` is evaluated before that guard; tests must reject it before `PgAdapter` construction/network activity. Owner: 通信测试马; this P0 precedes historical #434 work and §8 review | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -209,9 +209,9 @@ fixture with the same name—proves every row. waiver for the candidate's four added failures. - Production-DB guard: the SQLite refusal runs before path calculation, mkdir, database open and schema execution; `strace` confirmed zero production-path - access. Extend the same fail-closed rule to inherited `DATABASE_URL`, which is - currently selected before the SQLite-only guard. Until fixed, test commands - explicitly unset it unless they run an isolated PostgreSQL test database. + access. P0 #435 extends fail-closed behavior to inherited `DATABASE_URL`, + which is currently selected before the SQLite-only guard. Until fixed, every + test command explicitly unsets it; no PostgreSQL test bypass is authorized. - Candidate `090ce12` was produced only after 通信龙 issued a written R6 restore that conflicted with the coordinator pause. 通信龙 later withdrew that restore after the independent audit invalidated its assumptions. B followed the From c3e8a97226ea4be2cc0b803d25f335b4e132f421 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:12:41 +0800 Subject: [PATCH 12/29] docs(rfc030-plan): record A corrective audit failure --- docs/plans/RFC-030-implementation-plan.md | 48 ++++++++++++++++++++--- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 7e05be48..4124635b 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) — independent checkpoint audit **FAIL** despite green unit suites; A/B corrective work is required and all downstream gates remain hard-locked. +> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A corrective commit `5b18df6` independently remains **FAIL** despite `251/0/771`; the native Codex TUI transport/auth choice is awaiting lead decision and all downstream gates remain hard-locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -29,6 +29,15 @@ after every checkpoint. | Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | | Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | +Open freeze amendment: pinned Codex `0.144.0` speaks WebSocket Upgrade on +`unix://`, not raw newline JSONL, and rejects `--remote-auth-token-env` for a +Unix remote. It does send the bearer header to a loopback `ws://` remote. The +lead must choose between a loopback WebSocket TUI endpoint with bearer +capability, or WebSocket-over-UDS authenticated by a strong peer-process +identity mechanism. Path permissions, path secrecy and same-UID checks are not +an authentication boundary. No owner may implement either option until the +freeze amendment is explicit. + ### Hard locks - No production change, deploy, preview publish, `latest` switch or lead merge. @@ -43,7 +52,7 @@ after every checkpoint. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — UDS / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — corrective work required** | PR #431 @ `00d4ea8` (A `98676f1` / B `04560c0` / C `00d4ea8`) | `232/0/729` is retained as unit evidence only; real-path audit found coordinator bypass, unresolved pending requests, transport teardown and lifecycle-race failures | Separate P0 integration + P1 hardening commits, then independent reproduction | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — frozen pending transport decision** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | `251/0/771` is retained as unit evidence only; real Codex handshake is incompatible, owner lease can be crossed, and teardown/startup probes still fail | Lead transport/auth amendment, then separate P0 integration + P1 hardening commits and independent reproduction | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — corrective work required** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but valid pump rows are not ACKed, pump has no production wiring, MCP auth still branches on raw token prefix, and canonical-attempt cleanup is incomplete | Real auth/pump/dead-letter/canonical-attempt production E2E | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -143,6 +152,24 @@ starve a valid task. Full gateway suite after Segment C: `232 pass / 0 fail / 729 expect()` (`bun test agent-node/src/runtime/codex-policy-gateway/`). +Corrective candidate `5b18df6` added capability hello, per-role connection +counting, coordinator delegation and lifecycle close/fence tests. Its full suite +is `251 pass / 0 fail / 771 expect()`, but the independent checkpoint remains +FAIL: + +- the TUI socket accepts raw newline JSONL while real Codex `0.144.0` starts a + WebSocket HTTP Upgrade; +- the configurable connection cap permits a second authenticated TUI to answer + the incumbent's reverse request and detach the incumbent owner; +- `stop()` during preflight/subscription can finish with zero upstream close + calls, upstream close can leave the lifecycle `running`, and partial-start + clients/callbacks survive rollback; +- close may hang indefinitely, concurrent stops call close more than once, and + synchronous writes can leak mux entries. + +Do not start the listed P1 tranche until the transport/auth freeze amendment and +the P0 lifecycle/owner model have passed independent reproduction. + ## 7. Production hard-gate matrix The checkpoint is green only when the integrated production path—not a helper or @@ -153,12 +180,13 @@ fixture with the same name—proves every row. | Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | | 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | | Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | -| Approval forgery | **Partial / blocked** | Pure policy rejection is green; real TUI reverse-ID wire path not yet integrated | +| Approval forgery | **FAIL in corrective candidate** | With `maxConnectionsPerRole=2`, a second authenticated TUI can consume the incumbent's predictable reverse ID and forward an approval response; reverse IDs must be bound to an owner lease | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | | Authenticated principal | **FAIL (L1 @ `34bea40`)** | Principal resolver direction is useful, but production pump/ACK/dead-letter is not wired, raw token-prefix branching remains, and handler tests fabricate impossible auth contexts | -| Phase 1 read-only / approval never | **FAIL in integrated path** | Spawn/profile gates pass in isolation; real UDS reverse requests bypass the never-mode coordinator and can reach an attached TUI | +| Phase 1 read-only / approval never | **Partial / transport-blocked** | Corrective candidate routes fake-client reverse requests through `approvalMode=never`; the native Codex TUI cannot attach to that raw-JSONL endpoint, so production-path evidence is still absent | | TUI policy default-deny | **Partial / blocked** | Unknown methods deny correctly, but thread-bound methods do not consistently require a present bound `threadId`; integrate only after A correction | -| Owner lease fail-closed | **FAIL in integrated path** | Scheduler probe exists, but the UDS admits multiple TUI clients and does not wire coordinator attach/detach/reverse routing as the single source of truth | +| Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | +| Native Codex TUI transport/auth | **FAIL / decision blocked** | Real `codex 0.144.0 --remote unix://...` sends WebSocket Upgrade, not JSONL; the same CLI rejects bearer auth for `unix://` but sends it to loopback `ws://`. Lead must amend the frozen topology before implementation | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | @@ -189,6 +217,9 @@ fixture with the same name—proves every row. | 2026-07-12 | A Segment C `00d4ea8` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `232 pass / 0 fail / 729 expect` | Full gateway suite after A/B/C combined — no regression against frozen contract/protocol test count (169 → 197 after A → 213 after B → 232 after C) | | 2026-07-12 | B frozen candidate `090ce12` | `bun test agent-node/src/runtime/codex-policy-gateway/ agent-node/src/runtime/codex-app-server*.test.ts` | `351 pass / 0 fail / 2634 expect` | Independent rerun is green but **not a checkpoint PASS**: real-path A lifecycle and L1 production-pump failures remain outside the asserted paths | | 2026-07-12 | B frozen candidate `090ce12` | targeted lifecycle/UDS/owner/assembly + full gateway audit | `65/0/191` targeted; `322/0/2547` gateway | Runtime probes still reproduced approval-never bypass, two unauthenticated TUIs, pending-Promise loss, preflight resurrection, subscription rollback leak, unbound interrupt state and optional thread IDs | +| 2026-07-12 | A corrective candidate `5b18df6` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `251 pass / 0 fail / 771 expect` | Green unit evidence only; independent production-protocol and lifecycle probes below keep checkpoint FAIL | +| 2026-07-12 | A corrective candidate `5b18df6` | `bun test .../uds-server.test.ts .../lifecycle.test.ts` | `66 pass / 0 fail / 173 expect` | Independent targeted rerun green; report's lifecycle-only count was independently `23/0/69`, not `21/0` | +| 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | ### Independent checkpoint failures recorded 2026-07-12 @@ -196,6 +227,13 @@ fixture with the same name—proves every row. path; require one authenticated/capability-separated TUI; reject all pending origins exactly once on close; add lifecycle-owned transport close/abort and a start generation fence; harden rollback, path identity and frame sizing. +- A corrective `5b18df6`: coordinator delegation alone did not close the owner + boundary. Bind each reverse request to one authenticated owner lease, harden + the production invariant to one TUI, and make detach lease-aware. Replace the + raw TUI JSONL endpoint with the lead-approved native WebSocket topology. Use a + single-flight, epoch/abort-aware teardown that closes transport and clients on + every start failure, stop and upstream close; reject new work immediately + once the upstream generation is terminal. - B L1: classify enqueue outcomes for ACK/backoff/dead-letter; add a real production pump/demux and atomic validated dead-letter; carry server-resolved token kind through MCP auth; test real bearer contexts; clean every delivery From b9808b6e0b2cb90c6cd8474088276a32903b4417 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:13:55 +0800 Subject: [PATCH 13/29] docs(rfc030-plan): amend native TUI transport --- docs/plans/RFC-030-implementation-plan.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 4124635b..00d5c6c7 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A corrective commit `5b18df6` independently remains **FAIL** despite `251/0/771`; the native Codex TUI transport/auth choice is awaiting lead decision and all downstream gates remain hard-locked. +> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A corrective commit `5b18df6` independently remains **FAIL** despite `251/0/771`; the lead amended the TUI transport to loopback WebSocket + bearer and all downstream gates remain hard-locked pending a corrected implementation. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -28,15 +28,16 @@ after every checkpoint. | SQLite | No native dependency. Bun uses `bun:sqlite`; Node uses `node:sqlite` only on Node `>=22.13`; older Node fails closed for this runtime only. Global `agent-node` engines stay `>=18.17` | | Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | | Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | +| Local TUI transport (amended 2026-07-12) | Native Codex TUI connects to `ws://127.0.0.1:` and authenticates with a per-start bearer supplied through `--remote-auth-token-env`; never bind `0.0.0.0`, a fixed port, or a non-loopback address. The backend typed face remains owner-only UDS | -Open freeze amendment: pinned Codex `0.144.0` speaks WebSocket Upgrade on +Freeze amendment rationale: pinned Codex `0.144.0` speaks WebSocket Upgrade on `unix://`, not raw newline JSONL, and rejects `--remote-auth-token-env` for a -Unix remote. It does send the bearer header to a loopback `ws://` remote. The -lead must choose between a loopback WebSocket TUI endpoint with bearer -capability, or WebSocket-over-UDS authenticated by a strong peer-process -identity mechanism. Path permissions, path secrecy and same-UID checks are not -an authentication boundary. No owner may implement either option until the -freeze amendment is explicit. +Unix remote. It sends the bearer header to a loopback `ws://` remote. 通信龙 +therefore selected the CLI's supported loopback WebSocket path instead of +adding native/FFI peer-credential machinery for a same-UID boundary that is not +otherwise strong. This corrects an implementation premise forced by the pinned +upstream CLI; it does not change the independent-runtime product form or unlock +production. ### Hard locks @@ -52,7 +53,7 @@ freeze amendment is explicit. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — frozen pending transport decision** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | `251/0/771` is retained as unit evidence only; real Codex handshake is incompatible, owner lease can be crossed, and teardown/startup probes still fail | Lead transport/auth amendment, then separate P0 integration + P1 hardening commits and independent reproduction | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — P0 redesign planning** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | `251/0/771` is retained as unit evidence only; lead selected loopback WS + per-start bearer, while owner lease and teardown/startup probes still fail | Reviewed implementation design, separate P0 integration + P1 hardening commits, then independent reproduction | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — corrective work required** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but valid pump rows are not ACKed, pump has no production wiring, MCP auth still branches on raw token prefix, and canonical-attempt cleanup is incomplete | Real auth/pump/dead-letter/canonical-attempt production E2E | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -186,7 +187,7 @@ fixture with the same name—proves every row. | Phase 1 read-only / approval never | **Partial / transport-blocked** | Corrective candidate routes fake-client reverse requests through `approvalMode=never`; the native Codex TUI cannot attach to that raw-JSONL endpoint, so production-path evidence is still absent | | TUI policy default-deny | **Partial / blocked** | Unknown methods deny correctly, but thread-bound methods do not consistently require a present bound `threadId`; integrate only after A correction | | Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | -| Native Codex TUI transport/auth | **FAIL / decision blocked** | Real `codex 0.144.0 --remote unix://...` sends WebSocket Upgrade, not JSONL; the same CLI rejects bearer auth for `unix://` but sends it to loopback `ws://`. Lead must amend the frozen topology before implementation | +| Native Codex TUI transport/auth | **FAIL / redesign authorized** | Real `codex 0.144.0 --remote unix://...` sends WebSocket Upgrade, not JSONL; the same CLI rejects bearer auth for `unix://` but sends it to loopback `ws://`. Lead amended the TUI side to strict `127.0.0.1` OS-ephemeral WS + per-start bearer; corrected implementation and real-CLI E2E remain absent | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | From fc10e67e29172792380ce0ea9ffe3685fa81b4d8 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:21:55 +0800 Subject: [PATCH 14/29] docs(rfc030-plan): record L1 corrective audit failure --- docs/plans/RFC-030-implementation-plan.md | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 00d5c6c7..0d06f232 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -54,7 +54,7 @@ production. | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | | Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — P0 redesign planning** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | `251/0/771` is retained as unit evidence only; lead selected loopback WS + per-start bearer, while owner lease and teardown/startup probes still fail | Reviewed implementation design, separate P0 integration + P1 hardening commits, then independent reproduction | -| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — corrective work required** | `rfc030-gateway-runtime` @ `34bea40`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but valid pump rows are not ACKed, pump has no production wiring, MCP auth still branches on raw token prefix, and canonical-attempt cleanup is incomplete | Real auth/pump/dead-letter/canonical-attempt production E2E | +| Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | | Wave 1 checkpoint | 副指挥 + 通信龙 | **Locked** | #428 | Typed surface frozen; integrated hard-gate evidence incomplete | All rows in §7 green and reproducible | @@ -183,7 +183,7 @@ fixture with the same name—proves every row. | Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | | Approval forgery | **FAIL in corrective candidate** | With `maxConnectionsPerRole=2`, a second authenticated TUI can consume the incumbent's predictable reverse ID and forward an approval response; reverse IDs must be bound to an owner lease | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | -| Authenticated principal | **FAIL (L1 @ `34bea40`)** | Principal resolver direction is useful, but production pump/ACK/dead-letter is not wired, raw token-prefix branching remains, and handler tests fabricate impossible auth contexts | +| Authenticated principal / inbox ownership | **FAIL (L1 @ `b3fabba`)** | Raw-prefix classification was removed, but a real attacker node bearer can read a same-network victim alias's inbox and invoke `gateway_dead_letter`, failing the victim task and ACKing its row. Network-bound get/ack/dead-letter must bind to server-resolved consumer identity | | Phase 1 read-only / approval never | **Partial / transport-blocked** | Corrective candidate routes fake-client reverse requests through `approvalMode=never`; the native Codex TUI cannot attach to that raw-JSONL endpoint, so production-path evidence is still absent | | TUI policy default-deny | **Partial / blocked** | Unknown methods deny correctly, but thread-bound methods do not consistently require a present bound `threadId`; integrate only after A correction | | Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | @@ -191,7 +191,9 @@ fixture with the same name—proves every row. | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | -| Retry/reassign state consistency | **FAIL in server integration** | Gateway attempt tests pass, but server ACK/cancel/reassign still address initial IDs instead of all rows for the canonical task | +| Retry/reassign state consistency | **FAIL in server integration** | Corrective candidate cleans retry/reassign attempts, but cancellation commits the terminal task state before a separate all-attempt ACK; injected ACK failure leaves a permanently consumable stale row | +| Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | +| Database-backend invariants | **FAIL / lead decision required** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Either implement equivalent PostgreSQL atomicity/constraints or fail the RFC runtime closed on that backend | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | | Test production-DB isolation | **Partial / P0 [#435](https://github.com/sleep2agi/agent-network/issues/435) open** | SQLite naked-test guard was syscall-verified before any `~/.commhub` open. `DATABASE_URL` is evaluated before that guard; tests must reject it before `PgAdapter` construction/network activity. Owner: 通信测试马; this P0 precedes historical #434 work and §8 review | @@ -221,6 +223,9 @@ fixture with the same name—proves every row. | 2026-07-12 | A corrective candidate `5b18df6` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `251 pass / 0 fail / 771 expect` | Green unit evidence only; independent production-protocol and lifecycle probes below keep checkpoint FAIL | | 2026-07-12 | A corrective candidate `5b18df6` | `bun test .../uds-server.test.ts .../lifecycle.test.ts` | `66 pass / 0 fail / 173 expect` | Independent targeted rerun green; report's lifecycle-only count was independently `23/0/69`, not `21/0` | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | +| 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | +| 2026-07-12 | B L1 corrective candidate `b3fabba` | real minted attacker ntok → HTTP `/mcp` → `get_inbox(victim)` → `gateway_dead_letter` | both HTTP calls 200; victim task `delivered → failed`; victim inbox row ACKed | P0 same-network cross-alias destructive authorization failure; helper-only tests did not cover the tool entry | +| 2026-07-12 | B L1 corrective candidate `b3fabba` | drop/failure-trigger probes around audit and cancel cleanup | dead-letter returned success with ACK=1/audit=0; cancel left `task=cancelled, inbox.acked=0` and retry could not clean it | P0 transaction claims are false under failure; strict audit and canonical-attempt cleanup must roll back together | ### Independent checkpoint failures recorded 2026-07-12 @@ -239,6 +244,17 @@ fixture with the same name—proves every row. production pump/demux and atomic validated dead-letter; carry server-resolved token kind through MCP auth; test real bearer contexts; clean every delivery attempt by canonical task ID; enforce origin write-once at the database layer. +- B corrective `b3fabba`: bind network-token inbox read, ACK and dead-letter + to the server-resolved consumer alias/node, and test the negative case through + the real minted-bearer HTTP/MCP entry. Use strict audit/event writes inside a + real transaction; any audit failure must leave the inbox and task unchanged. + Move cancellation plus every canonical attempt ACK into one retryable + transaction. Wire the mixed-row demux to one actual production caller rather + than a test-only export, with failure/backoff fairness. The current + PostgreSQL adapter cannot provide these atomicity guarantees and silently + skips the SQLite write-once trigger, so backend support needs an explicit + lead decision and fail-closed capability gate or a real PostgreSQL + implementation before L1 can pass. - RFC-030 server tests: isolate the new principal/auth and reply fixtures so the candidate introduces no failures beyond the baseline eight and every new security assertion executes in aggregate. The broader historical cleanup is From 0d6a85d1dbf906de69c8a2b3484a217ea9b9593a Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:33:07 +0800 Subject: [PATCH 15/29] docs(rfc030-plan): record database guard pass --- docs/plans/RFC-030-implementation-plan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 0d06f232..d8355164 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -196,7 +196,7 @@ fixture with the same name—proves every row. | Database-backend invariants | **FAIL / lead decision required** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Either implement equivalent PostgreSQL atomicity/constraints or fail the RFC runtime closed on that backend | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | -| Test production-DB isolation | **Partial / P0 [#435](https://github.com/sleep2agi/agent-network/issues/435) open** | SQLite naked-test guard was syscall-verified before any `~/.commhub` open. `DATABASE_URL` is evaluated before that guard; tests must reject it before `PgAdapter` construction/network activity. Owner: 通信测试马; this P0 precedes historical #434 work and §8 review | +| Test production-DB isolation | **Coordinator PASS / lead+merge pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. PR remains Draft pending 通信龙 review; canonical runner isolation stays in #434 | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -226,6 +226,7 @@ fixture with the same name—proves every row. | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | | 2026-07-12 | B L1 corrective candidate `b3fabba` | real minted attacker ntok → HTTP `/mcp` → `get_inbox(victim)` → `gateway_dead_letter` | both HTTP calls 200; victim task `delivered → failed`; victim inbox row ACKed | P0 same-network cross-alias destructive authorization failure; helper-only tests did not cover the tool entry | | 2026-07-12 | B L1 corrective candidate `b3fabba` | drop/failure-trigger probes around audit and cancel cleanup | dead-letter returned success with ACK=1/audit=0; cancel left `task=cancelled, inbox.acked=0` and retry could not clean it | P0 transaction claims are false under failure; strict audit and canonical-attempt cleanup must roll back together | +| 2026-07-12 | DB-safety PR #436 `30e811a` | targeted guard + full server + independent Linux `strace -ff -e connect,openat` | `17/0/28`; `532/8/1546`; all connect `0`, PG connect `0`, default SQLite open `0` | Coordinator PASS. Both fake-URL and both-vars-unset real subprocess refusals are committed; no bypass or new aggregate failure. Draft remains lead/merge locked | ### Independent checkpoint failures recorded 2026-07-12 From d61dd11aba63b899dbed0b9a0635b2adf0743cf0 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:34:04 +0800 Subject: [PATCH 16/29] docs(rfc030-plan): fail gateway closed on PostgreSQL --- docs/plans/RFC-030-implementation-plan.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index d8355164..db1441c9 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -26,6 +26,7 @@ after every checkpoint. | Reply lifecycle | `send_reply` plus `new_reply` SSE wake; the Phase-0 origin-aware `send_task` deviation must not enter production | | CommHub token boundary | Codex/app-server environment and argv contain no CommHub token; the gateway owns authenticated CommHub access | | SQLite | No native dependency. Bun uses `bun:sqlite`; Node uses `node:sqlite` only on Node `>=22.13`; older Node fails closed for this runtime only. Global `agent-node` engines stay `>=18.17` | +| CommHub store backend for RFC-030 (amended 2026-07-12) | Security-critical principal, inbox/dead-letter and task-attempt operations require the SQLite-backed server store. If the hub uses `DATABASE_URL` / PostgreSQL, the RFC-030 gateway fails startup closed with an actionable unsupported-backend error. True PostgreSQL transaction/constraint support is separate backlog, not an RFC-030 shortcut | | Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | | Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | | Local TUI transport (amended 2026-07-12) | Native Codex TUI connects to `ws://127.0.0.1:` and authenticates with a per-start bearer supplied through `--remote-auth-token-env`; never bind `0.0.0.0`, a fixed port, or a non-loopback address. The backend typed face remains owner-only UDS | @@ -193,7 +194,7 @@ fixture with the same name—proves every row. | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Corrective candidate cleans retry/reassign attempts, but cancellation commits the terminal task state before a separate all-attempt ACK; injected ACK failure leaves a permanently consumable stale row | | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | -| Database-backend invariants | **FAIL / lead decision required** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Either implement equivalent PostgreSQL atomicity/constraints or fail the RFC runtime closed on that backend | +| Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | | Test production-DB isolation | **Coordinator PASS / lead+merge pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. PR remains Draft pending 通信龙 review; canonical runner isolation stays in #434 | @@ -253,9 +254,11 @@ fixture with the same name—proves every row. transaction. Wire the mixed-row demux to one actual production caller rather than a test-only export, with failure/backoff fairness. The current PostgreSQL adapter cannot provide these atomicity guarantees and silently - skips the SQLite write-once trigger, so backend support needs an explicit - lead decision and fail-closed capability gate or a real PostgreSQL - implementation before L1 can pass. + skips the SQLite write-once trigger. The lead therefore locked RFC-030 to + the SQLite-backed server store: a PostgreSQL-backed hub must return an + explicit unsupported capability and the gateway must refuse startup before + consuming inbox work. Real PostgreSQL transactions and an equivalent + write-once constraint are separate backlog. - RFC-030 server tests: isolate the new principal/auth and reply fixtures so the candidate introduces no failures beyond the baseline eight and every new security assertion executes in aggregate. The broader historical cleanup is From 47cc234930b78ca2337f01d5e3ef8c758829f81c Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:34:46 +0800 Subject: [PATCH 17/29] docs(rfc030-plan): link PostgreSQL backlog --- docs/plans/RFC-030-implementation-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index db1441c9..cee11276 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -26,7 +26,7 @@ after every checkpoint. | Reply lifecycle | `send_reply` plus `new_reply` SSE wake; the Phase-0 origin-aware `send_task` deviation must not enter production | | CommHub token boundary | Codex/app-server environment and argv contain no CommHub token; the gateway owns authenticated CommHub access | | SQLite | No native dependency. Bun uses `bun:sqlite`; Node uses `node:sqlite` only on Node `>=22.13`; older Node fails closed for this runtime only. Global `agent-node` engines stay `>=18.17` | -| CommHub store backend for RFC-030 (amended 2026-07-12) | Security-critical principal, inbox/dead-letter and task-attempt operations require the SQLite-backed server store. If the hub uses `DATABASE_URL` / PostgreSQL, the RFC-030 gateway fails startup closed with an actionable unsupported-backend error. True PostgreSQL transaction/constraint support is separate backlog, not an RFC-030 shortcut | +| CommHub store backend for RFC-030 (amended 2026-07-12) | Security-critical principal, inbox/dead-letter and task-attempt operations require the SQLite-backed server store. If the hub uses `DATABASE_URL` / PostgreSQL, the RFC-030 gateway fails startup closed with an actionable unsupported-backend error. True PostgreSQL transaction/constraint support is tracked separately in [#437](https://github.com/sleep2agi/agent-network/issues/437), not an RFC-030 shortcut | | Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | | Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | | Local TUI transport (amended 2026-07-12) | Native Codex TUI connects to `ws://127.0.0.1:` and authenticates with a per-start bearer supplied through `--remote-auth-token-env`; never bind `0.0.0.0`, a fixed port, or a non-loopback address. The backend typed face remains owner-only UDS | From d26149545dc105a89689a8f48d945314becc0374 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:36:46 +0800 Subject: [PATCH 18/29] docs(rfc030-plan): record database guard lead pass --- docs/plans/RFC-030-implementation-plan.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index cee11276..f841370a 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -196,8 +196,8 @@ fixture with the same name—proves every row. | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | -| Historical server test isolation | **Tracked separately / non-blocking after delta clears** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434) | -| Test production-DB isolation | **Coordinator PASS / lead+merge pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. PR remains Draft pending 通信龙 review; canonical runner isolation stays in #434 | +| Historical server test isolation | **In progress / separate PR** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434). Work resumed after #435 passed; canonical Bun runner must unset `DATABASE_URL`, isolate DB/port/process per manifest entry and run green three times | +| Test production-DB isolation | **Coordinator + lead PASS / Draft merge locked** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. 通信龙 independently checked guard ordering and recorded lead PASS; PR stays Draft and unmerged while RFC gates remain locked | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log From 3253d8aafd41674a50134e45b1ab89cb524ab2e7 Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 14:40:05 +0800 Subject: [PATCH 19/29] docs(rfc030-plan): freeze native TUI bootstrap reads --- docs/plans/RFC-030-implementation-plan.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index f841370a..3c6cf6ab 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -23,6 +23,7 @@ after every checkpoint. | Production topology | One upstream app-server behind one Policy Gateway; Agent and TUI never attach as uncontrolled peer clients | | Codex baseline | Exact CLI version `0.144.0`; schema mismatch fails closed | | Phase 1 policy | `read-only` and `approval=never`; writes and approval enabling remain disabled | +| Native human-TUI bootstrap reads (amended 2026-07-12) | On the bearer-authenticated TUI face only, exact-match allow `account/read`, `hooks/list`, `configRequirements/read` and `model/list`, verified as the pinned `0.144.0` read-only bootstrap sequence. No prefix/regex widening; mutations and the Agent face remain denied | | Reply lifecycle | `send_reply` plus `new_reply` SSE wake; the Phase-0 origin-aware `send_task` deviation must not enter production | | CommHub token boundary | Codex/app-server environment and argv contain no CommHub token; the gateway owns authenticated CommHub access | | SQLite | No native dependency. Bun uses `bun:sqlite`; Node uses `node:sqlite` only on Node `>=22.13`; older Node fails closed for this runtime only. Global `agent-node` engines stay `>=18.17` | @@ -54,7 +55,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — P0 redesign planning** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | `251/0/771` is retained as unit evidence only; lead selected loopback WS + per-start bearer, while owner lease and teardown/startup probes still fail | Reviewed implementation design, separate P0 integration + P1 hardening commits, then independent reproduction | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — corrective Commit 1 authorized** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | Design reviewed: Commit 1 is restricted to exact-pinned WebSocket admission, single-use bearer, hard-one owner/backend and lease binding; lifecycle Commit 2 remains locked | Commit 1 evidence + independent review, then separately release lifecycle teardown tranche | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -186,7 +187,7 @@ fixture with the same name—proves every row. | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | | Authenticated principal / inbox ownership | **FAIL (L1 @ `b3fabba`)** | Raw-prefix classification was removed, but a real attacker node bearer can read a same-network victim alias's inbox and invoke `gateway_dead_letter`, failing the victim task and ACKing its row. Network-bound get/ack/dead-letter must bind to server-resolved consumer identity | | Phase 1 read-only / approval never | **Partial / transport-blocked** | Corrective candidate routes fake-client reverse requests through `approvalMode=never`; the native Codex TUI cannot attach to that raw-JSONL endpoint, so production-path evidence is still absent | -| TUI policy default-deny | **Partial / blocked** | Unknown methods deny correctly, but thread-bound methods do not consistently require a present bound `threadId`; integrate only after A correction | +| TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | | Native Codex TUI transport/auth | **FAIL / redesign authorized** | Real `codex 0.144.0 --remote unix://...` sends WebSocket Upgrade, not JSONL; the same CLI rejects bearer auth for `unix://` but sends it to loopback `ws://`. Lead amended the TUI side to strict `127.0.0.1` OS-ephemeral WS + per-start bearer; corrected implementation and real-CLI E2E remain absent | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | @@ -224,6 +225,7 @@ fixture with the same name—proves every row. | 2026-07-12 | A corrective candidate `5b18df6` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `251 pass / 0 fail / 771 expect` | Green unit evidence only; independent production-protocol and lifecycle probes below keep checkpoint FAIL | | 2026-07-12 | A corrective candidate `5b18df6` | `bun test .../uds-server.test.ts .../lifecycle.test.ts` | `66 pass / 0 fail / 173 expect` | Independent targeted rerun green; report's lifecycle-only count was independently `23/0/69`, not `21/0` | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | +| 2026-07-12 | pinned Codex CLI `0.144.0` loopback handshake progression | real TUI against an instrumented WS server, using sanitized synthetic responses | loopback path `/`; inbound frames omit `jsonrpc`; TUI accepts initialize responses both with and without `jsonrpc:"2.0"`; then requests `account/read` twice, `hooks/list`, `configRequirements/read`, `model/list` | Removes the proposed normalize/denormalize layer and freezes the four exact human-only read methods; fixtures must exclude real account/codex-home/cwd data | | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | | 2026-07-12 | B L1 corrective candidate `b3fabba` | real minted attacker ntok → HTTP `/mcp` → `get_inbox(victim)` → `gateway_dead_letter` | both HTTP calls 200; victim task `delivered → failed`; victim inbox row ACKed | P0 same-network cross-alias destructive authorization failure; helper-only tests did not cover the tool entry | | 2026-07-12 | B L1 corrective candidate `b3fabba` | drop/failure-trigger probes around audit and cancel cleanup | dead-letter returned success with ACK=1/audit=0; cancel left `task=cancelled, inbox.acked=0` and retry could not clean it | P0 transaction claims are false under failure; strict audit and canonical-attempt cleanup must roll back together | From b5e7fa06d9fb3f245cb22295e2a063814df3ab5d Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 15:02:59 +0800 Subject: [PATCH 20/29] docs(rfc-030): record #438 independent checkpoint failure --- docs/plans/RFC-030-implementation-plan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 3c6cf6ab..c724d6e0 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -197,7 +197,7 @@ fixture with the same name—proves every row. | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | -| Historical server test isolation | **In progress / separate PR** | Baseline's eight module-singleton server/DB/port failures are owned by 通信测试马 in [#434](https://github.com/sleep2agi/agent-network/issues/434). Work resumed after #435 passed; canonical Bun runner must unset `DATABASE_URL`, isolate DB/port/process per manifest entry and run green three times | +| Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | | Test production-DB isolation | **Coordinator + lead PASS / Draft merge locked** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. 通信龙 independently checked guard ordering and recorded lead PASS; PR stays Draft and unmerged while RFC gates remain locked | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | @@ -230,6 +230,7 @@ fixture with the same name—proves every row. | 2026-07-12 | B L1 corrective candidate `b3fabba` | real minted attacker ntok → HTTP `/mcp` → `get_inbox(victim)` → `gateway_dead_letter` | both HTTP calls 200; victim task `delivered → failed`; victim inbox row ACKed | P0 same-network cross-alias destructive authorization failure; helper-only tests did not cover the tool entry | | 2026-07-12 | B L1 corrective candidate `b3fabba` | drop/failure-trigger probes around audit and cancel cleanup | dead-letter returned success with ACK=1/audit=0; cancel left `task=cancelled, inbox.acked=0` and retry could not clean it | P0 transaction claims are false under failure; strict audit and canonical-attempt cleanup must roll back together | | 2026-07-12 | DB-safety PR #436 `30e811a` | targeted guard + full server + independent Linux `strace -ff -e connect,openat` | `17/0/28`; `532/8/1546`; all connect `0`, PG connect `0`, default SQLite open `0` | Coordinator PASS. Both fake-URL and both-vars-unset real subprocess refusals are committed; no bypass or new aggregate failure. Draft remains lead/merge locked | +| 2026-07-12 | Test-isolation PR #438 `6260213` | canonical 3× + fake parent DB URL + production-bin/interrupt/merge-order counterexamples | canonical `526/0/1555` stable; checkpoint **FAIL** | Official bin: DB init but `0 bind / 0 listen`; `test:raw` selects PostgreSQL under inherited URL; interrupt can yield `0/0/0` exit 0 or leave child/temp; #435 overlay exits 2 on unregistered guard suite. Review 4679590795; corrective task issued, Draft/merge locked | ### Independent checkpoint failures recorded 2026-07-12 From 49a29168ce0d01acb2b171e087b1306c675e4f9c Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 15:07:42 +0800 Subject: [PATCH 21/29] docs(rfc-030): reopen DB test-entry safety gate --- docs/plans/RFC-030-implementation-plan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index c724d6e0..29f14f25 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -198,7 +198,7 @@ fixture with the same name—proves every row. | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | -| Test production-DB isolation | **Coordinator + lead PASS / Draft merge locked** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: independent targeted `17/0/28`, aggregate `532/8/1546`, and syscall proof `all connect=0`, PostgreSQL connect=0, default SQLite open=0. 通信龙 independently checked guard ordering and recorded lead PASS; PR stays Draft and unmerged while RFC gates remain locked | +| Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Prior PASS is narrowed to the adapter-ordering change; the overall safety gate is reopened until every real test entrypoint is sanitized and a Bun-test-native signal independent of caller-supplied `NODE_ENV` is proven. Draft/merge remain locked | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -231,6 +231,7 @@ fixture with the same name—proves every row. | 2026-07-12 | B L1 corrective candidate `b3fabba` | drop/failure-trigger probes around audit and cancel cleanup | dead-letter returned success with ACK=1/audit=0; cancel left `task=cancelled, inbox.acked=0` and retry could not clean it | P0 transaction claims are false under failure; strict audit and canonical-attempt cleanup must roll back together | | 2026-07-12 | DB-safety PR #436 `30e811a` | targeted guard + full server + independent Linux `strace -ff -e connect,openat` | `17/0/28`; `532/8/1546`; all connect `0`, PG connect `0`, default SQLite open `0` | Coordinator PASS. Both fake-URL and both-vars-unset real subprocess refusals are committed; no bypass or new aggregate failure. Draft remains lead/merge locked | | 2026-07-12 | Test-isolation PR #438 `6260213` | canonical 3× + fake parent DB URL + production-bin/interrupt/merge-order counterexamples | canonical `526/0/1555` stable; checkpoint **FAIL** | Official bin: DB init but `0 bind / 0 listen`; `test:raw` selects PostgreSQL under inherited URL; interrupt can yield `0/0/0` exit 0 or leave child/temp; #435 overlay exits 2 on unregistered guard suite. Review 4679590795; corrective task issued, Draft/merge locked | +| 2026-07-12 | Production hub read-only safety check | `GET http://dm.vansin.top:9200/health` | HTTP 200, `ok=true`, `version=0.9.0-preview.14`, uptime `495640s` | Uptime places the live process start at 2026-07-06 13:22:53 UTC, before #438 commit `6260213` (2026-07-12 06:53:47 UTC). Current production is listening and did not deploy the broken bin seam; no restart or mutation performed | ### Independent checkpoint failures recorded 2026-07-12 From 27768f1efefb8e9c9da8b7a98746a4536ef8b7fc Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 15:10:23 +0800 Subject: [PATCH 22/29] docs(rfc-030): pin Bun test-context safety design --- docs/plans/RFC-030-implementation-plan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 29f14f25..4b561217 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -198,7 +198,7 @@ fixture with the same name—proves every row. | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | -| Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Prior PASS is narrowed to the adapter-ordering change; the overall safety gate is reopened until every real test entrypoint is sanitized and a Bun-test-native signal independent of caller-supplied `NODE_ENV` is proven. Draft/merge remain locked | +| Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Corrective design is explicit `--no-env-file` + safety preload on every supported entrypoint, root/server Bun test config, and a non-configurable in-process marker checked by the adapter; caller-supplied `NODE_ENV` remains only defense in depth. Arbitrary third-party cwd is an explicit Bun limitation; absolute enforcement would require a separate production-positive DB capability. Draft/merge remain locked | | Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | ## 8. Reproducible evidence log @@ -232,6 +232,7 @@ fixture with the same name—proves every row. | 2026-07-12 | DB-safety PR #436 `30e811a` | targeted guard + full server + independent Linux `strace -ff -e connect,openat` | `17/0/28`; `532/8/1546`; all connect `0`, PG connect `0`, default SQLite open `0` | Coordinator PASS. Both fake-URL and both-vars-unset real subprocess refusals are committed; no bypass or new aggregate failure. Draft remains lead/merge locked | | 2026-07-12 | Test-isolation PR #438 `6260213` | canonical 3× + fake parent DB URL + production-bin/interrupt/merge-order counterexamples | canonical `526/0/1555` stable; checkpoint **FAIL** | Official bin: DB init but `0 bind / 0 listen`; `test:raw` selects PostgreSQL under inherited URL; interrupt can yield `0/0/0` exit 0 or leave child/temp; #435 overlay exits 2 on unregistered guard suite. Review 4679590795; corrective task issued, Draft/merge locked | | 2026-07-12 | Production hub read-only safety check | `GET http://dm.vansin.top:9200/health` | HTTP 200, `ok=true`, `version=0.9.0-preview.14`, uptime `495640s` | Uptime places the live process start at 2026-07-06 13:22:53 UTC, before #438 commit `6260213` (2026-07-12 06:53:47 UTC). Current production is listening and did not deploy the broken bin seam; no restart or mutation performed | +| 2026-07-12 | Bun 1.3.14 test-context probes | `NODE_ENV=production bun test`; test preload under overridden environment; root/server/external cwd config probes | `NODE_ENV` remains production; test preload still runs before test modules | Bun exposes no documented cross-platform `isTest` API and config is cwd-selected. Approved near-term gate uses explicit preload plus global marker and sanitized commands; argv/file-name heuristics are not security boundaries | ### Independent checkpoint failures recorded 2026-07-12 From 69096b3a51564b51baaa266e959f7fedcb7c9dea Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 15:23:20 +0800 Subject: [PATCH 23/29] docs(rfc-030): record A Commit-1 independent failure --- docs/plans/RFC-030-implementation-plan.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 4b561217..3fcb5e7f 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A corrective commit `5b18df6` independently remains **FAIL** despite `251/0/771`; the lead amended the TUI transport to loopback WebSocket + bearer and all downstream gates remain hard-locked pending a corrected implementation. +> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A WebSocket Commit-1 candidate `9e6706c` independently **FAILS** despite `282/0/792`: real owners are killed by the pre-auth timer, token/lease/reverse-request boundaries are bypassable, and the clean-checkout Node/CLI evidence is not reproducible. One Commit-1-only corrective is authorized; lifecycle Commit 2 and every downstream gate remain locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -55,7 +55,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Checkpoint FAIL — corrective Commit 1 authorized** | PR #431 @ corrective candidate `5b18df6` over `00d4ea8` | Design reviewed: Commit 1 is restricted to exact-pinned WebSocket admission, single-use bearer, hard-one owner/backend and lease binding; lifecycle Commit 2 remains locked | Commit 1 evidence + independent review, then separately release lifecycle teardown tranche | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 independent FAIL — one corrective authorized** | PR #431 @ `9e6706c` over `5b18df6` | Frozen hashes and `282/0/792` pass, but a successful real Node WS closes `1006` after the 3-second header timer; the child env helper admits hub/DB/arbitrary secrets; a public no-lease API consumes approval state; invalid WS keys can consume the bearer and strand a fake owner; Phase-1 upstream reverse requests are silently dropped; Node/CLI evidence relies on ignored or hard-coded bundles | Correct only Commit-1 admission, bearer/env, lease/reverse wiring and reproducible Node/PTY evidence; lifecycle Commit 2 remains locked until a new independent PASS | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -186,10 +186,10 @@ fixture with the same name—proves every row. | Approval forgery | **FAIL in corrective candidate** | With `maxConnectionsPerRole=2`, a second authenticated TUI can consume the incumbent's predictable reverse ID and forward an approval response; reverse IDs must be bound to an owner lease | | CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | | Authenticated principal / inbox ownership | **FAIL (L1 @ `b3fabba`)** | Raw-prefix classification was removed, but a real attacker node bearer can read a same-network victim alias's inbox and invoke `gateway_dead_letter`, failing the victim task and ACKing its row. Network-bound get/ack/dead-letter must bind to server-resolved consumer identity | -| Phase 1 read-only / approval never | **Partial / transport-blocked** | Corrective candidate routes fake-client reverse requests through `approvalMode=never`; the native Codex TUI cannot attach to that raw-JSONL endpoint, so production-path evidence is still absent | +| Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | -| Native Codex TUI transport/auth | **FAIL / redesign authorized** | Real `codex 0.144.0 --remote unix://...` sends WebSocket Upgrade, not JSONL; the same CLI rejects bearer auth for `unix://` but sends it to loopback `ws://`. Lead amended the TUI side to strict `127.0.0.1` OS-ephemeral WS + per-start bearer; corrected implementation and real-CLI E2E remain absent | +| Native Codex TUI transport/auth | **FAIL at Commit 1 `9e6706c`** | Strict loopback bind and the one-shot digest check exist, but the raw-socket header timer remains armed after Upgrade and kills the real owner after about three seconds. The env “allowlist” accepts hub tokens, `DATABASE_URL` and arbitrary keys; bearer objects serialize plaintext; malformed WS keys can consume the token and strand the owner slot. The committed CLI harness is non-portable and exits `1/2`; a separate test-only PTY probe proves a real 0.144.0 Upgrade is feasible without implementing the Wave-2 launcher | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | @@ -224,6 +224,8 @@ fixture with the same name—proves every row. | 2026-07-12 | B frozen candidate `090ce12` | targeted lifecycle/UDS/owner/assembly + full gateway audit | `65/0/191` targeted; `322/0/2547` gateway | Runtime probes still reproduced approval-never bypass, two unauthenticated TUIs, pending-Promise loss, preflight resurrection, subscription rollback leak, unbound interrupt state and optional thread IDs | | 2026-07-12 | A corrective candidate `5b18df6` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `251 pass / 0 fail / 771 expect` | Green unit evidence only; independent production-protocol and lifecycle probes below keep checkpoint FAIL | | 2026-07-12 | A corrective candidate `5b18df6` | `bun test .../uds-server.test.ts .../lifecycle.test.ts` | `66 pass / 0 fail / 173 expect` | Independent targeted rerun green; report's lifecycle-only count was independently `23/0/69`, not `21/0` | +| 2026-07-12 | A WebSocket Commit-1 candidate `9e6706c` | full gateway + real Node/ws survival/admission/lease/env/reverse probes | unit `282/0/792`; checkpoint **FAIL** | Real owner: `OPEN=1`, after 3500ms `readyState=3`, close `1006`; invalid WS key consumes bearer and leaves owner held; env helper admits hub/DB/arbitrary keys; no-lease approval returns `forward_reverse_response`; upstream reverse request writes `[]`; `JSON.stringify(TuiBearer.mint())` exposes plaintext | +| 2026-07-12 | A `9e6706c` reproducibility probe | reported Node integration + real CLI commands from clean checkout | Node default `ERR_MODULE_NOT_FOUND`; CLI `1/2`, exit 1 | Bundle is ignored and the Node URL resolves under `scripts/dist`; real-CLI hard-codes `/tmp/wt-rfc030`. With an explicitly built bundle, Node assertions are `14/14`; test-only PTY reaches real Codex 0.144.0 Upgrade + `account/read` | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | | 2026-07-12 | pinned Codex CLI `0.144.0` loopback handshake progression | real TUI against an instrumented WS server, using sanitized synthetic responses | loopback path `/`; inbound frames omit `jsonrpc`; TUI accepts initialize responses both with and without `jsonrpc:"2.0"`; then requests `account/read` twice, `hooks/list`, `configRequirements/read`, `model/list` | Removes the proposed normalize/denormalize layer and freezes the four exact human-only read methods; fixtures must exclude real account/codex-home/cwd data | | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | From 79b8b5d8cdb3097ded63d8d2e82726c953efb3bb Mon Sep 17 00:00:00 2001 From: vansin Date: Sun, 12 Jul 2026 15:26:16 +0800 Subject: [PATCH 24/29] docs(rfc-030): harden credential and evidence gates --- docs/plans/RFC-030-implementation-plan.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 3fcb5e7f..32b5ab69 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -183,19 +183,20 @@ fixture with the same name—proves every row. | Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | | 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | | Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | -| Approval forgery | **FAIL in corrective candidate** | With `maxConnectionsPerRole=2`, a second authenticated TUI can consume the incumbent's predictable reverse ID and forward an approval response; reverse IDs must be bound to an owner lease | -| CommHub token isolation | **Partial PASS** | Owned-spawn argv/env tests are useful; final real spawn capture and all credential forms remain | +| Approval forgery | **FAIL at `9e6706c`** | The lease-aware method rejects mismatches, but `HumanOwnerCoordinator` still exposes a public no-lease `handleTuiResponseFrame`; an independent call consumed the pending reverse ID and returned `forward_reverse_response`. Every response-consume API must require the incumbent lease; there is no deprecated compatibility bypass | +| Child-process credential isolation | **P0 FAIL / §8 hard gate** | Codex/app-server child env is an exact allowlist, never an arbitrary `Record` filtered by a denylist. The accepted key set must equal the reviewed safe set (currently `PATH`, isolated `HOME`/`TMPDIR`/`CODEX_HOME`, plus the single fixed TUI bearer key); every other parent key is absent by construction. Pollution tests inject ntok/utok, every `COMMHUB_*`, `DATABASE_URL`, `AWS_*`, arbitrary `*_TOKEN`, `*_SECRET` and `*_KEY`, then assert child-env set equality—not merely absence of known names. `9e6706c` fails: it admits hub/DB/cloud secrets and permits a forbidden bearer env name | | Authenticated principal / inbox ownership | **FAIL (L1 @ `b3fabba`)** | Raw-prefix classification was removed, but a real attacker node bearer can read a same-network victim alias's inbox and invoke `gateway_dead_letter`, failing the victim task and ACKing its row. Network-bound get/ack/dead-letter must bind to server-resolved consumer identity | | Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | -| Owner lease fail-closed | **FAIL in corrective candidate** | Coordinator is wired, but ownership is still a global boolean: the connection cap is configurable above one, responses are not lease-bound, and a non-incumbent disconnect can detach the incumbent | +| Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | | Native Codex TUI transport/auth | **FAIL at Commit 1 `9e6706c`** | Strict loopback bind and the one-shot digest check exist, but the raw-socket header timer remains armed after Upgrade and kills the real owner after about three seconds. The env “allowlist” accepts hub tokens, `DATABASE_URL` and arbitrary keys; bearer objects serialize plaintext; malformed WS keys can consume the token and strand the owner slot. The committed CLI harness is non-portable and exits `1/2`; a separate test-only PTY probe proves a real 0.144.0 Upgrade is feasible without implementing the Wave-2 launcher | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Corrective candidate cleans retry/reassign attempts, but cancellation commits the terminal task state before a separate all-attempt ACK; injected ACK failure leaves a permanently consumable stale row | | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | -| Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work | +| Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work. Longer-term remote-DB enablement requires a separate production bootstrap that grants an in-process positive capability before DB import; an inheritable env opt-in is not a security boundary and is not part of the current P0 fix | +| Clean-checkout evidence reproducibility | **FAIL / §8 hard gate** | A result counts only when an independent reviewer can run one documented command from the committed SHA in a clean checkout and obtain the stated exit code/assertions. Ignored bundles, hard-coded worktree paths, uncommitted helpers, copied implementations, manual hidden setup and `PASS` counts from an exit-1 command are no evidence. `9e6706c` fails because the Node script resolves a missing `scripts/dist` bundle and the real-CLI script hard-codes `/tmp/wt-rfc030` and exits `1/2` | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | | Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Corrective design is explicit `--no-env-file` + safety preload on every supported entrypoint, root/server Bun test config, and a non-configurable in-process marker checked by the adapter; caller-supplied `NODE_ENV` remains only defense in depth. Arbitrary third-party cwd is an explicit Bun limitation; absolute enforcement would require a separate production-positive DB capability. Draft/merge remain locked | @@ -203,6 +204,13 @@ fixture with the same name—proves every row. ## 8. Reproducible evidence log +Every entry below is admissible only if its command starts from the committed +SHA in a clean checkout, creates all generated artifacts itself, and exits with +the reported status. The reviewer must be able to reproduce the production-path +assertion without an ignored file, an author worktree, an uncommitted helper or +undocumented manual setup. A non-zero command cannot be reported as PASS merely +because one sub-assertion printed a green count. + | Date | Ref | Command / evidence | Result | Interpretation | |---|---|---|---|---| | 2026-07-12 | A `90d1e58` | `bun test agent-node/src/runtime/codex-policy-gateway/` | `169 pass / 0 fail / 555 expect` | Contract/protocol freeze evidence | From 1614de4ef74255fa13d260442c5cf08159a44dcc Mon Sep 17 00:00:00 2001 From: vansin Date: Mon, 13 Jul 2026 07:59:21 +0800 Subject: [PATCH 25/29] docs(rfc030): record fd2399c independent fail --- docs/plans/RFC-030-implementation-plan.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 32b5ab69..baeae66d 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-12 (Asia/Shanghai) — Wave-1A WebSocket Commit-1 candidate `9e6706c` independently **FAILS** despite `282/0/792`: real owners are killed by the pre-auth timer, token/lease/reverse-request boundaries are bypassable, and the clean-checkout Node/CLI evidence is not reproducible. One Commit-1-only corrective is authorized; lifecycle Commit 2 and every downstream gate remain locked. +> Last updated: 2026-07-13 (Asia/Shanghai) — Wave-1A WebSocket Commit-1 corrective `fd2399c` independently **FAILS** despite `287/0/814`: the real upstream reverse-request path still drops requests, pending bearer/redactor state remains observable, rejected half-open sockets escape admission accounting and can block shutdown, and the reported Node/CLI commands still depend on an ignored bundle. One more Commit-1-only corrective is authorized; lifecycle Commit 2 and every downstream gate remain locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -55,7 +55,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 independent FAIL — one corrective authorized** | PR #431 @ `9e6706c` over `5b18df6` | Frozen hashes and `282/0/792` pass, but a successful real Node WS closes `1006` after the 3-second header timer; the child env helper admits hub/DB/arbitrary secrets; a public no-lease API consumes approval state; invalid WS keys can consume the bearer and strand a fake owner; Phase-1 upstream reverse requests are silently dropped; Node/CLI evidence relies on ignored or hard-coded bundles | Correct only Commit-1 admission, bearer/env, lease/reverse wiring and reproducible Node/PTY evidence; lifecycle Commit 2 remains locked until a new independent PASS | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective independent FAIL — one scoped corrective authorized** | PR #431 @ `fd2399c` over `9e6706c` | Frozen hashes and `287/0/814` pass; the original 3-second owner kill, child-env allowlist and no-lease public consume path are corrected. Remaining hard failures: real upstream reverse requests still write nothing; pending bearer/redactor bytes are observable through runtime introspection; rejected half-open sockets escape the ledger and can block `stop()`; duplicate Host reaches `101`; clean Node/CLI commands require an unreported ignored bundle | Correct only the remaining Commit-1 admission, bearer/redactor, reverse wiring and evidence defects; lifecycle Commit 2 remains locked until a new independent PASS | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -189,14 +189,14 @@ fixture with the same name—proves every row. | Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | -| Native Codex TUI transport/auth | **FAIL at Commit 1 `9e6706c`** | Strict loopback bind and the one-shot digest check exist, but the raw-socket header timer remains armed after Upgrade and kills the real owner after about three seconds. The env “allowlist” accepts hub tokens, `DATABASE_URL` and arbitrary keys; bearer objects serialize plaintext; malformed WS keys can consume the token and strand the owner slot. The committed CLI harness is non-portable and exits `1/2`; a separate test-only PTY probe proves a real 0.144.0 Upgrade is feasible without implementing the Wave-2 launcher | +| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `fd2399c`** | Strict loopback, exact child-env allowlist, bearer-before-owner ordering, provisional reservation and the original 3-second owner-survival regression are now green. Remaining hard failures: rejected upgraded sockets are removed from the admission ledger before authorization and `socket.end()` leaves an allow-half-open peer able to block shutdown; duplicate Host is accepted; rollback tries to send reserved close code `1006`; pending `TuiBearer`/`SecretRedactor` bytes remain observable through runtime inspection. Real 0.144.0 Upgrade is feasible, but the clean command still depends on an ignored generated bundle | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Corrective candidate cleans retry/reassign attempts, but cancellation commits the terminal task state before a separate all-attempt ACK; injected ACK failure leaves a permanently consumable stale row | | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work. Longer-term remote-DB enablement requires a separate production bootstrap that grants an in-process positive capability before DB import; an inheritable env opt-in is not a security boundary and is not part of the current P0 fix | -| Clean-checkout evidence reproducibility | **FAIL / §8 hard gate** | A result counts only when an independent reviewer can run one documented command from the committed SHA in a clean checkout and obtain the stated exit code/assertions. Ignored bundles, hard-coded worktree paths, uncommitted helpers, copied implementations, manual hidden setup and `PASS` counts from an exit-1 command are no evidence. `9e6706c` fails because the Node script resolves a missing `scripts/dist` bundle and the real-CLI script hard-codes `/tmp/wt-rfc030` and exits `1/2` | +| Clean-checkout evidence reproducibility | **FAIL / §8 hard gate** | A result counts only when an independent reviewer can run one documented command from the committed SHA in a clean checkout and obtain the stated exit code/assertions. Ignored bundles, hard-coded worktree paths, uncommitted helpers, copied implementations, manual hidden setup and `PASS` counts from an exit-1 command are no evidence. `fd2399c` fixes path/PTY handling, but `bun run build` creates only `dist/cli.js`; both Node scripts still fail with `ERR_MODULE_NOT_FOUND` until an unreported manual command builds ignored `dist/rfc030-integration.mjs`. A missing/wrong Codex binary must hard-fail the release gate rather than report `PASS: skipped` | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | | Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Corrective design is explicit `--no-env-file` + safety preload on every supported entrypoint, root/server Bun test config, and a non-configurable in-process marker checked by the adapter; caller-supplied `NODE_ENV` remains only defense in depth. Arbitrary third-party cwd is an explicit Bun limitation; absolute enforcement would require a separate production-positive DB capability. Draft/merge remain locked | @@ -234,6 +234,8 @@ because one sub-assertion printed a green count. | 2026-07-12 | A corrective candidate `5b18df6` | `bun test .../uds-server.test.ts .../lifecycle.test.ts` | `66 pass / 0 fail / 173 expect` | Independent targeted rerun green; report's lifecycle-only count was independently `23/0/69`, not `21/0` | | 2026-07-12 | A WebSocket Commit-1 candidate `9e6706c` | full gateway + real Node/ws survival/admission/lease/env/reverse probes | unit `282/0/792`; checkpoint **FAIL** | Real owner: `OPEN=1`, after 3500ms `readyState=3`, close `1006`; invalid WS key consumes bearer and leaves owner held; env helper admits hub/DB/arbitrary keys; no-lease approval returns `forward_reverse_response`; upstream reverse request writes `[]`; `JSON.stringify(TuiBearer.mint())` exposes plaintext | | 2026-07-12 | A `9e6706c` reproducibility probe | reported Node integration + real CLI commands from clean checkout | Node default `ERR_MODULE_NOT_FOUND`; CLI `1/2`, exit 1 | Bundle is ignored and the Node URL resolves under `scripts/dist`; real-CLI hard-codes `/tmp/wt-rfc030`. With an explicitly built bundle, Node assertions are `14/14`; test-only PTY reaches real Codex 0.144.0 Upgrade + `account/read` | +| 2026-07-13 | A Commit-1 corrective `fd2399c` | gateway subtree + independent real-Node boundary probes | unit `287/0/814`; checkpoint **FAIL** | Positive: the previous owner-timer regression is fixed, exact child env allowlist holds, and explicit bundle generation yields Node `30/30` plus real-CLI PTY `4/4`. Hard failures: a real upstream reverse request produces `writes=[]`; pending bearer/redactor state is inspectable; a rejected allow-half-open socket has `preAuth=0` and makes `stop()` wait indefinitely; duplicate Host reaches `101`; two rollback paths use reserved close code `1006` | +| 2026-07-13 | A `fd2399c` clean-checkout evidence probe | `bun run build`; then each reported Node script directly | both scripts `ERR_MODULE_NOT_FOUND` | `build` emits only `dist/cli.js`. After the reviewer manually builds `dist/rfc030-integration.mjs`, Node is `30/30` and PTY smoke is `4/4`; that hidden step is useful diagnostic evidence but not a release gate. The CLI smoke observes `account/read`, not all four documented startup reads or a normal CLI lifecycle exit | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | | 2026-07-12 | pinned Codex CLI `0.144.0` loopback handshake progression | real TUI against an instrumented WS server, using sanitized synthetic responses | loopback path `/`; inbound frames omit `jsonrpc`; TUI accepts initialize responses both with and without `jsonrpc:"2.0"`; then requests `account/read` twice, `hooks/list`, `configRequirements/read`, `model/list` | Removes the proposed normalize/denormalize layer and freezes the four exact human-only read methods; fixtures must exclude real account/codex-home/cwd data | | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | From 5f7564db9e9bfc5676d32da707e425b7c062370b Mon Sep 17 00:00:00 2001 From: vansin Date: Mon, 13 Jul 2026 08:05:40 +0800 Subject: [PATCH 26/29] docs(rfc030): track shared hub consumer lease p0 --- docs/plans/RFC-030-implementation-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index baeae66d..592c767c 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -185,7 +185,7 @@ fixture with the same name—proves every row. | Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | | Approval forgery | **FAIL at `9e6706c`** | The lease-aware method rejects mismatches, but `HumanOwnerCoordinator` still exposes a public no-lease `handleTuiResponseFrame`; an independent call consumed the pending reverse ID and returned `forward_reverse_response`. Every response-consume API must require the incumbent lease; there is no deprecated compatibility bypass | | Child-process credential isolation | **P0 FAIL / §8 hard gate** | Codex/app-server child env is an exact allowlist, never an arbitrary `Record` filtered by a denylist. The accepted key set must equal the reviewed safe set (currently `PATH`, isolated `HOME`/`TMPDIR`/`CODEX_HOME`, plus the single fixed TUI bearer key); every other parent key is absent by construction. Pollution tests inject ntok/utok, every `COMMHUB_*`, `DATABASE_URL`, `AWS_*`, arbitrary `*_TOKEN`, `*_SECRET` and `*_KEY`, then assert child-env set equality—not merely absence of known names. `9e6706c` fails: it admits hub/DB/cloud secrets and permits a forbidden bearer env name | -| Authenticated principal / inbox ownership | **FAIL (L1 @ `b3fabba`)** | Raw-prefix classification was removed, but a real attacker node bearer can read a same-network victim alias's inbox and invoke `gateway_dead_letter`, failing the victim task and ACKing its row. Network-bound get/ack/dead-letter must bind to server-resolved consumer identity | +| Authenticated principal / inbox ownership | **Shared Hub P0 #440 — H0 design/red-test in progress (owner: 通信SDK马)** | Sender-origin stamping is already partly Hub-side, but consumer ownership remains alias-based: a real node bearer can read a same-network peer alias's inbox and invoke ack/reply/dead-letter against that peer. #440 owns the shared `server/src` fix for Codex + Grok: immutable server-resolved consumer principal, atomic self-claim, server-minted delivery lease/epoch, common SQLite/Pg adapter primitive, and explicit privileged legacy access. Gateway local TUI/turn leases remain a separate concept. H1 production implementation is locked until the H0 API/schema contract and real-entry red evidence are independently reviewed | | Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | From 98c0923c4ae0dc548520c73ba80fe40a7a97bfd7 Mon Sep 17 00:00:00 2001 From: vansin Date: Mon, 13 Jul 2026 08:23:08 +0800 Subject: [PATCH 27/29] docs(rfc030): record 3e62297 independent fail --- docs/plans/RFC-030-implementation-plan.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 592c767c..58557866 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -6,7 +6,7 @@ > > Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** > -> Last updated: 2026-07-13 (Asia/Shanghai) — Wave-1A WebSocket Commit-1 corrective `fd2399c` independently **FAILS** despite `287/0/814`: the real upstream reverse-request path still drops requests, pending bearer/redactor state remains observable, rejected half-open sockets escape admission accounting and can block shutdown, and the reported Node/CLI commands still depend on an ignored bundle. One more Commit-1-only corrective is authorized; lifecycle Commit 2 and every downstream gate remain locked. +> Last updated: 2026-07-13 (Asia/Shanghai) — Wave-1A corrective round 2 `3e62297` independently **FAILS** despite `290/0/815` and clean Node `37/37`: steady-state reverse rejection, WeakMap storage and half-open cleanup are corrected, but lifecycle startup still loses upstream request/close events before the second subscriber exists, redactor EOF releases a near-complete bearer prefix, the CLI smoke can false-green without an authorizer request, and reconnect/hard-pin/lease claims remain incomplete. Commit 2 and every downstream gate remain locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -55,7 +55,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective independent FAIL — one scoped corrective authorized** | PR #431 @ `fd2399c` over `9e6706c` | Frozen hashes and `287/0/814` pass; the original 3-second owner kill, child-env allowlist and no-lease public consume path are corrected. Remaining hard failures: real upstream reverse requests still write nothing; pending bearer/redactor bytes are observable through runtime introspection; rejected half-open sockets escape the ledger and can block `stop()`; duplicate Host reaches `101`; clean Node/CLI commands require an unreported ignored bundle | Correct only the remaining Commit-1 admission, bearer/redactor, reverse wiring and evidence defects; lifecycle Commit 2 remains locked until a new independent PASS | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective round 2 independent FAIL** | PR #431 @ `3e62297` | Positive: frozen hashes, `290/0/815`, clean Node `37/37`, steady-state reverse original-id rejection, WeakMap secret storage, singleton headers and half-open reject cleanup. Hard failures: preflight and backend→TUI subscription windows lose reverse/close and can end falsely `running`; two subscribers misdiagnose every normal response and consume proxied origins without delivery; redactor EOF releases 42/43 bearer characters; CLI smoke path/loop false-green; runtime is lifetime-one-shot rather than reattachable; “hard” limits and raw lease still have public access paths | Replace the two subscribers with one lifecycle-owned upstream router registered before any emitting preflight/await; fix EOF scrub, reconnect contract and evidence/public-surface defects without touching Commit 2. A product/security decision separately gates hostile same-UID isolation in Wave 2 | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -189,7 +189,7 @@ fixture with the same name—proves every row. | Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | -| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `fd2399c`** | Strict loopback, exact child-env allowlist, bearer-before-owner ordering, provisional reservation and the original 3-second owner-survival regression are now green. Remaining hard failures: rejected upgraded sockets are removed from the admission ledger before authorization and `socket.end()` leaves an allow-half-open peer able to block shutdown; duplicate Host is accepted; rollback tries to send reserved close code `1006`; pending `TuiBearer`/`SecretRedactor` bytes remain observable through runtime inspection. Real 0.144.0 Upgrade is feasible, but the clean command still depends on an ignored generated bundle | +| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `3e62297`** | Strict loopback/header singleton/canonical-key checks, WeakMap bearer storage, valid rollback close behavior, allow-half-open cleanup and real-owner survival are green. Remaining failures: `SecretRedactor.finish()` releases a near-complete credential prefix at EOF; public test overrides can change claimed hard limits in the production bundle; first attach permanently closes the listener and consumes the only bearer, so owner detach cannot reattach despite the B park/re-attach contract; CLI smoke can pass without an authorizer call. Environment bearer delivery also cannot defend against hostile same-UID `/proc` readers, so either the threat claim must be narrowed for Commit 1 or Wave-2 OS isolation must provide the real boundary | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | @@ -236,6 +236,7 @@ because one sub-assertion printed a green count. | 2026-07-12 | A `9e6706c` reproducibility probe | reported Node integration + real CLI commands from clean checkout | Node default `ERR_MODULE_NOT_FOUND`; CLI `1/2`, exit 1 | Bundle is ignored and the Node URL resolves under `scripts/dist`; real-CLI hard-codes `/tmp/wt-rfc030`. With an explicitly built bundle, Node assertions are `14/14`; test-only PTY reaches real Codex 0.144.0 Upgrade + `account/read` | | 2026-07-13 | A Commit-1 corrective `fd2399c` | gateway subtree + independent real-Node boundary probes | unit `287/0/814`; checkpoint **FAIL** | Positive: the previous owner-timer regression is fixed, exact child env allowlist holds, and explicit bundle generation yields Node `30/30` plus real-CLI PTY `4/4`. Hard failures: a real upstream reverse request produces `writes=[]`; pending bearer/redactor state is inspectable; a rejected allow-half-open socket has `preAuth=0` and makes `stop()` wait indefinitely; duplicate Host reaches `101`; two rollback paths use reserved close code `1006` | | 2026-07-13 | A `fd2399c` clean-checkout evidence probe | `bun run build`; then each reported Node script directly | both scripts `ERR_MODULE_NOT_FOUND` | `build` emits only `dist/cli.js`. After the reviewer manually builds `dist/rfc030-integration.mjs`, Node is `30/30` and PTY smoke is `4/4`; that hidden step is useful diagnostic evidence but not a release gate. The CLI smoke observes `account/read`, not all four documented startup reads or a normal CLI lifecycle exit | +| 2026-07-13 | A corrective round 2 `3e62297` | gateway subtree + clean Node command + lifecycle/secret/CLI adversarial probes | unit `290/0/815`; Node `37/37`; checkpoint **FAIL** | Steady-state reverse and prior WS admission defects are fixed. Lifecycle preflight/gap probes emit reverse+close and still end `running` with no write; start has two frame/close subscribers, every internal response creates a false WS diagnostic, and a proxied origin is consumed without delivery. Redactor EOF returns a 42/43-character bearer prefix. Direct CLI smoke false-greens `3/3` when owner attaches before any authorizer call; the canonical npm command selects local Codex 0.133 and exits 1 | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | | 2026-07-12 | pinned Codex CLI `0.144.0` loopback handshake progression | real TUI against an instrumented WS server, using sanitized synthetic responses | loopback path `/`; inbound frames omit `jsonrpc`; TUI accepts initialize responses both with and without `jsonrpc:"2.0"`; then requests `account/read` twice, `hooks/list`, `configRequirements/read`, `model/list` | Removes the proposed normalize/denormalize layer and freezes the four exact human-only read methods; fixtures must exclude real account/codex-home/cwd data | | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | From ff364c8ef8356c1b5f187c2faaeb14a3a5006811 Mon Sep 17 00:00:00 2001 From: vansin Date: Mon, 13 Jul 2026 08:31:49 +0800 Subject: [PATCH 28/29] docs(rfc030): freeze same-uid threat model --- docs/plans/RFC-030-implementation-plan.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 58557866..49eec27b 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -31,6 +31,7 @@ after every checkpoint. | Human/Agent reservation | Human owns human turns. While Agent owns the reservation, human start/steer is busy; human interrupt is the emergency path, returns `interrupted_by_human`, and never auto-replays | | Canonical request mux | The frozen Wave-1A `UpstreamRequestMux` is the only upstream ID allocator for internal scheduler and proxied TUI requests | | Local TUI transport (amended 2026-07-12) | Native Codex TUI connects to `ws://127.0.0.1:` and authenticates with a per-start bearer supplied through `--remote-auth-token-env`; never bind `0.0.0.0`, a fixed port, or a non-loopback address. The backend typed face remains owner-only UDS | +| Local same-UID threat model (frozen 2026-07-13) | The default deployment treats arbitrary code running under the same OS UID as trusted. The high-entropy, 30-second, single-use bearer defends against guessing, stale/accidental peers and peers without same-UID process inspection; it does **not** claim isolation from a hostile same-UID process that can read `/proc`, ptrace the child, inspect memory or read the user's config. Tests/docs must use `accidental/stale-peer defense`, never `same-UID impersonation defense`. Separate UID/user namespace, `/proc` isolation or a verified non-dumpable wrapper is an optional Wave-2 high-security profile, not a default release blocker | Freeze amendment rationale: pinned Codex `0.144.0` speaks WebSocket Upgrade on `unix://`, not raw newline JSONL, and rejects `--remote-auth-token-env` for a @@ -55,7 +56,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective round 2 independent FAIL** | PR #431 @ `3e62297` | Positive: frozen hashes, `290/0/815`, clean Node `37/37`, steady-state reverse original-id rejection, WeakMap secret storage, singleton headers and half-open reject cleanup. Hard failures: preflight and backend→TUI subscription windows lose reverse/close and can end falsely `running`; two subscribers misdiagnose every normal response and consume proxied origins without delivery; redactor EOF releases 42/43 bearer characters; CLI smoke path/loop false-green; runtime is lifetime-one-shot rather than reattachable; “hard” limits and raw lease still have public access paths | Replace the two subscribers with one lifecycle-owned upstream router registered before any emitting preflight/await; fix EOF scrub, reconnect contract and evidence/public-surface defects without touching Commit 2. A product/security decision separately gates hostile same-UID isolation in Wave 2 | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective round 2 independent FAIL** | PR #431 @ `3e62297` | Positive: frozen hashes, `290/0/815`, clean Node `37/37`, steady-state reverse original-id rejection, WeakMap secret storage, singleton headers and half-open reject cleanup. Hard failures: preflight and backend→TUI subscription windows lose reverse/close and can end falsely `running`; two subscribers misdiagnose every normal response and consume proxied origins without delivery; redactor EOF releases 42/43 bearer characters; CLI smoke path/loop false-green; runtime is lifetime-one-shot rather than reattachable; “hard” limits and raw lease still have public access paths | Replace the two subscribers with one lifecycle-owned upstream router registered before any emitting preflight/await; fix EOF scrub, reconnect contract and evidence/public-surface defects without touching Commit 2. Hostile same-UID isolation is explicitly outside the default profile; A only corrects the claim/test wording | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -189,7 +190,7 @@ fixture with the same name—proves every row. | Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | | Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | -| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `3e62297`** | Strict loopback/header singleton/canonical-key checks, WeakMap bearer storage, valid rollback close behavior, allow-half-open cleanup and real-owner survival are green. Remaining failures: `SecretRedactor.finish()` releases a near-complete credential prefix at EOF; public test overrides can change claimed hard limits in the production bundle; first attach permanently closes the listener and consumes the only bearer, so owner detach cannot reattach despite the B park/re-attach contract; CLI smoke can pass without an authorizer call. Environment bearer delivery also cannot defend against hostile same-UID `/proc` readers, so either the threat claim must be narrowed for Commit 1 or Wave-2 OS isolation must provide the real boundary | +| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `3e62297`** | Strict loopback/header singleton/canonical-key checks, WeakMap bearer storage, valid rollback close behavior, allow-half-open cleanup and real-owner survival are green. Remaining failures: `SecretRedactor.finish()` releases a near-complete credential prefix at EOF; public test overrides can change claimed hard limits in the production bundle; first attach permanently closes the listener and consumes the only bearer, so owner detach cannot reattach despite the B park/re-attach contract; CLI smoke can pass without an authorizer call. Threat-model wording is now settled: same-UID is trusted in the default profile, so Commit 1 must remove any stronger claim; optional OS isolation is documented for Wave 2 but does not block the default release | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | From 628ea05b6ce4d18de9a5807c2cd01583e20d1183 Mon Sep 17 00:00:00 2001 From: vansin Date: Mon, 13 Jul 2026 10:46:13 +0800 Subject: [PATCH 29/29] docs(rfc030): record current gate status --- docs/plans/RFC-030-implementation-plan.md | 58 ++++++++++++++++++----- 1 file changed, 46 insertions(+), 12 deletions(-) diff --git a/docs/plans/RFC-030-implementation-plan.md b/docs/plans/RFC-030-implementation-plan.md index 49eec27b..99c7e2f8 100644 --- a/docs/plans/RFC-030-implementation-plan.md +++ b/docs/plans/RFC-030-implementation-plan.md @@ -4,9 +4,9 @@ > > Authoritative RFC: [`docs/rfcs/RFC-030-codex-tui-bridge.md`](../rfcs/RFC-030-codex-tui-bridge.md) > -> Status: **Wave 1 in progress; Wave 2, security sign-off, merge, deployment, production and `latest` are locked** +> Status: **Wave 1 in progress. Commit 1 is frozen through internal review; Commit 2 is under corrective review. Wave 2, §8 security sign-off, merge, deployment, production and `latest` are locked.** > -> Last updated: 2026-07-13 (Asia/Shanghai) — Wave-1A corrective round 2 `3e62297` independently **FAILS** despite `290/0/815` and clean Node `37/37`: steady-state reverse rejection, WeakMap storage and half-open cleanup are corrected, but lifecycle startup still loses upstream request/close events before the second subscriber exists, redactor EOF releases a near-complete bearer prefix, the CLI smoke can false-green without an authorizer request, and reconnect/hard-pin/lease claims remain incomplete. Commit 2 and every downstream gate remain locked. +> Last updated: 2026-07-13 (Asia/Shanghai) — Wave-1A P0.2 Commit 1 is **FINAL FREEZE PASS** at `bd0dfd7`; this is an internal code/evidence freeze, not release approval. Commit 2 candidate `d2ca6f0` is **REQUEST CHANGES / corrective review in progress**. §8, Wave 2, merge, production deployment and `latest` remain locked. This is the engineering master plan for moving `codex-app-server` from an opt-in preview to the independently launched Codex TUI runtime approved by @@ -14,6 +14,17 @@ Vincent on 2026-07-10. Issue #428 is the chronological external log; this file is the current decomposition, ownership, evidence and gate state. Update both after every checkpoint. +### Current gate snapshot (authoritative) + +| Gate | Current state | Evidence and exact meaning | +|---|---|---| +| Wave-1A P0.2 Commit 1 | **Frozen through internal review** | `bd0dfd7`. Frozen contract/protocol hashes match; the reviewed A-layer path covers strict loopback WebSocket admission, the single human-owner lease, the sole upstream router, exact child-environment allowlisting, and the streaming credential-redaction/detector evidence. Reproduced evidence: gateway `321/0/978`, Node integration `60/60`, real Codex `0.144.0` PTY bootstrap smoke `12/12`. This does **not** authorize merge or release. | +| Wave-1A P0.2 Commit 2 | **Review in progress / corrective work required** | First candidate `d2ca6f0` has positive unit evidence (`329/0/1005`) but independently reproduced teardown failures remain: local backend/TUI stop failures can be reported as `stopped` while listeners remain reachable; local stop can remain pending; abort/single-flight/timeout-winner/error-preservation contracts require correction. No Commit-2 PASS is claimed. | +| Wave-1 checkpoint | **Locked** | Commit 1 alone is not the integrated Wave-1 checkpoint. Commit 2, corrected B integration and every production hard-gate row must pass independently first. | +| Wave 2 | **Locked** | Not started. An explicit Wave-1 checkpoint release is required. | +| Independent §8 review | **Locked / not started** | Runs only against the corrected, integrated committed SHA. Commit-1 freeze review does not substitute for §8. | +| Merge / deploy / production / `latest` | **Locked** | No merge, deployment, production enablement, package promotion or `latest` switch is authorized. Vincent must authorize these separately after all preceding gates pass. | + ## 1. Frozen product and security decisions | Decision | Frozen value | @@ -56,7 +67,7 @@ production. |---|---|---|---|---|---| | Wave 0 — decisions and baseline | 副指挥 + 通信龙 | **Complete** | #428 | Decisions above frozen; Codex `0.144.0` selected | No unresolved product decision | | Wave 1A — typed contract and protocol | 通信工程马 | **Frozen** | `rfc030-gateway-protocol`, draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431) | Freeze `90d1e58`; `169 pass / 0 fail / 555 expect` | B consumes exact shape; no unreviewed shape change | -| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 corrective round 2 independent FAIL** | PR #431 @ `3e62297` | Positive: frozen hashes, `290/0/815`, clean Node `37/37`, steady-state reverse original-id rejection, WeakMap secret storage, singleton headers and half-open reject cleanup. Hard failures: preflight and backend→TUI subscription windows lose reverse/close and can end falsely `running`; two subscribers misdiagnose every normal response and consume proxied origins without delivery; redactor EOF releases 42/43 bearer characters; CLI smoke path/loop false-green; runtime is lifetime-one-shot rather than reattachable; “hard” limits and raw lease still have public access paths | Replace the two subscribers with one lifecycle-owned upstream router registered before any emitting preflight/await; fix EOF scrub, reconnect contract and evidence/public-surface defects without touching Commit 2. Hostile same-UID isolation is explicitly outside the default profile; A only corrects the claim/test wording | +| Wave 1A — TUI transport / human owner / lifecycle | 通信工程马 | **Commit 1 frozen; Commit 2 under corrective review** | draft PR [#431](https://github.com/sleep2agi/agent-network/pull/431); Commit 1 `bd0dfd7`; Commit 2 candidate `d2ca6f0` | Commit 1 internal freeze evidence: gateway `321/0/978`, Node `60/60`, real Codex `0.144.0` PTY `12/12`; strict admission, owner lease, sole router, child-env allowlist and detector path passed. Commit 2 is not through review: local stop truthfulness/boundedness, synchronous abort enforcement, timeout winner, public single-flight identity and rollback/error preservation remain corrective items | Independently PASS corrected Commit 2, then consume the frozen A surface in B and rerun the integrated matrix. Commit-1 freeze is not a Wave-1 checkpoint or release authorization | | Wave 1B L1 — authenticated principal and task identity | 通信SDK马 | **Checkpoint FAIL — second corrective design required** | `rfc030-gateway-runtime` @ corrective candidate `b3fabba`, draft PR [#432](https://github.com/sleep2agi/agent-network/pull/432) | Targeted suites are green, but real HTTP/MCP proves cross-alias dead-letter; audit failure is swallowed; cancel cleanup is non-atomic; the claimed production demux is not wired; PostgreSQL does not provide the claimed transaction/trigger invariants | Server-auth consumer binding, strict atomic audit/cancel, real production demux/auth E2E and an explicit SQLite/PostgreSQL capability decision | | Wave 1B L2 — runtime hardening | 通信SDK马 | **Paused — corrective audit pending** | PR #432 @ `ed45f4d` | Boot/profile gates are useful partial evidence; TUI bound-thread validation and diagnostics/lifecycle integration remain open | Rebase on corrected A/L1 and independently reproduce all real-entry gates | | Wave 1B L3 — canonical mux/client/pump integration | 通信SDK马 | **Frozen — candidate is not an approved checkpoint** | PR #432 @ `090ce12` | Built under a conflicting written R6 restore from 通信龙, later withdrawn after the audit disproved its assumptions; B bears no process fault; `351/0/2634` remains unit evidence only | No further R work until the coordinator re-releases a scoped tranche; full integrated evidence required | @@ -147,6 +158,26 @@ starve a valid task. ## 6. Wave-1A UDS/lifecycle checkpoints +### Current superseding status — 2026-07-13 + +- **Commit 1 is FINAL FREEZE PASS at `bd0dfd7`.** The internally reviewed + A-layer path includes strict loopback WebSocket admission, lease-aware human + ownership, one upstream router, an exact child-environment allowlist and the + streaming redaction/detector evidence. Reproduced evidence is gateway + `321/0/978`, Node integration `60/60` and real Codex `0.144.0` PTY bootstrap + smoke `12/12`. This is a code/evidence freeze only—not an integrated + checkpoint, §8 sign-off, merge approval or release approval. +- **Commit 2 candidate `d2ca6f0` is REQUEST CHANGES.** Its positive + `329/0/1005` unit evidence does not close independently reproduced teardown + failures. Corrective review remains open for truthful listener shutdown, + bounded local stop, synchronous abort, single-flight identity, timeout-winner + handling and error preservation. +- The Wave-1 checkpoint, Wave 2, §8 review, merge, deployment, production and + `latest` remain **locked**. + +The segment table and corrective notes below are retained as chronological +history; the status above supersedes their earlier FAIL labels. + | Segment | Scope | Committed SHA | Required evidence | Status | |---|---|---|---|---| | A | Agent UDS + TUI UDS + framing | `98676f1` | Unix socket only; 0700 directory; 0600 socket; no symlink/raw endpoint; bounded fragmented/coalesced/malformed/oversize frame tests; real no-ID `initialized` notification; two origins on one mux/socket; duplicate response orphaning | **FAIL after independent review** — no role capability handshake/single TUI, incomplete rollback/path hardening, escaped 128 KiB payload can exceed the frame cap | @@ -183,25 +214,25 @@ fixture with the same name—proves every row. |---|---|---| | Typed contract and protocol | **PASS** | Freeze `90d1e58`, independent `169/0/555` | | 100 task one-to-one race and dedup | **Partial** | Scheduler→fake app-server test is green; it bypasses UDS, inbox, principal and reply delivery | -| Single mux, collisions and out-of-order routing | **Partial / blocked** | Unit routing tests are green; corrected A lifecycle must own the sole allocator and settle every origin on close before this can pass | -| Approval forgery | **FAIL at `9e6706c`** | The lease-aware method rejects mismatches, but `HumanOwnerCoordinator` still exposes a public no-lease `handleTuiResponseFrame`; an independent call consumed the pending reverse ID and returned `forward_reverse_response`. Every response-consume API must require the incumbent lease; there is no deprecated compatibility bypass | -| Child-process credential isolation | **P0 FAIL / §8 hard gate** | Codex/app-server child env is an exact allowlist, never an arbitrary `Record` filtered by a denylist. The accepted key set must equal the reviewed safe set (currently `PATH`, isolated `HOME`/`TMPDIR`/`CODEX_HOME`, plus the single fixed TUI bearer key); every other parent key is absent by construction. Pollution tests inject ntok/utok, every `COMMHUB_*`, `DATABASE_URL`, `AWS_*`, arbitrary `*_TOKEN`, `*_SECRET` and `*_KEY`, then assert child-env set equality—not merely absence of known names. `9e6706c` fails: it admits hub/DB/cloud secrets and permits a forbidden bearer env name | +| Single mux, collisions and out-of-order routing | **A Commit 1 frozen; Commit 2/integration locked** | `bd0dfd7` freezes the sole-router path and one-shot origin routing at the A layer. Corrected Commit-2 teardown and B production integration must still prove every origin settles once; this is not an integrated PASS | +| Approval forgery | **A Commit 1 frozen; integrated gate locked** | `bd0dfd7` removes the no-lease response path and requires the incumbent owner lease for reverse-response consumption. The production-integrated B path and final §8 matrix have not run, so only the reviewed A-layer capability is frozen | +| Child-process credential isolation | **A Commit 1 frozen PASS; integrated §8 gate locked** | At `bd0dfd7`, the reviewed child path accepts exactly `PATH`, isolated `HOME`/`TMPDIR`/`CODEX_HOME`, and the one fixed TUI bearer key; the streaming detector is per output stream and waits for close. Real Codex PTY evidence is `12/12`. This A-layer freeze does not substitute for integrated §8 review | | Authenticated principal / inbox ownership | **Shared Hub P0 #440 — H0 design/red-test in progress (owner: 通信SDK马)** | Sender-origin stamping is already partly Hub-side, but consumer ownership remains alias-based: a real node bearer can read a same-network peer alias's inbox and invoke ack/reply/dead-letter against that peer. #440 owns the shared `server/src` fix for Codex + Grok: immutable server-resolved consumer principal, atomic self-claim, server-minted delivery lease/epoch, common SQLite/Pg adapter primitive, and explicit privileged legacy access. Gateway local TUI/turn leases remain a separate concept. H1 production implementation is locked until the H0 API/schema contract and real-entry red evidence are independently reviewed | -| Phase 1 read-only / approval never | **FAIL at `9e6706c`** | The WS split removed the previously tested upstream reverse-request router: the sole subscriber handles responses only, so a real upstream `approval/request` produces no rejection write. Lifecycle also still exposes `approvalMode=passthrough` although a successful reverse response is consumed and then dropped. Production must hard-pin `never` and restore original-id `approval_mode_never` replies before the Phase-2 transport exists | +| Phase 1 read-only / approval never | **A Commit 1 frozen; integrated gate locked** | `bd0dfd7` hard-pins the A lifecycle to `approval=never`; upstream reverse requests traverse the sole router and receive an original-ID `NoOwner` / `approval_mode_never` response. The production authorizer/B integration and final §8 matrix remain locked | | TUI policy default-deny | **Partial / blocked** | Lead approved four exact native bootstrap reads on the authenticated human face after real CLI capture; all mutations and Agent-side calls remain denied. B's candidate authorizer still blocks those reads and thread-bound methods do not consistently require a present bound `threadId`; corrective integration remains | -| Owner lease fail-closed | **FAIL at `9e6706c`** | Hard-one WS reservation and the matching/mismatch lease path are useful, but the public no-lease response method bypasses the side map; malformed WS keys can also consume the bearer and strand `owner=held` while the human coordinator is unattached. Admission must use a provisional lease with rollback on every failed handshake, and all response/detach paths must present that lease | -| Native Codex TUI transport/auth | **FAIL at Commit 1 corrective `3e62297`** | Strict loopback/header singleton/canonical-key checks, WeakMap bearer storage, valid rollback close behavior, allow-half-open cleanup and real-owner survival are green. Remaining failures: `SecretRedactor.finish()` releases a near-complete credential prefix at EOF; public test overrides can change claimed hard limits in the production bundle; first attach permanently closes the listener and consumes the only bearer, so owner detach cannot reattach despite the B park/re-attach contract; CLI smoke can pass without an authorizer call. Threat-model wording is now settled: same-UID is trusted in the default profile, so Commit 1 must remove any stronger claim; optional OS isolation is documented for Wave 2 but does not block the default release | +| Owner lease fail-closed | **A Commit 1 frozen; integrated gate locked** | `bd0dfd7` freezes provisional admission rollback, hard-one owner reservation and lease-required response/detach paths at the A layer. Production/B integration and final §8 review remain outstanding | +| Native Codex TUI transport/auth | **Commit 1 FINAL FREEZE PASS at `bd0dfd7`** | Internally reviewed path: strict `127.0.0.1` WebSocket admission, canonical singleton headers/key, single-use bearer lifecycle, owner survival, one upstream router, exact child-env allowlist and streaming redaction/detector evidence. Gateway `321/0/978`, Node `60/60`, real Codex `0.144.0` PTY `12/12`. This is an internal freeze only; Commit 2, integration, §8 and release remain locked | | Codex/schema/SQLite startup gate | **Partial (L2)** | assertCodexBaseline now wired into openCodexAppServerRuntime before spawn (same-binary proof); REMAINING: digest algorithm path+NUL+length+content domain separation (P1-4) + SQLite gate at gateway production startup — scheduled with L3 | | Reply lifecycle and SSE wake | **Partial / blocked** | Real SSE wake is useful evidence, but the E2E manually ACKs and does not prove the production pump ACKs a valid retry attempt | | Human interrupt race | **FAIL in integrated candidate** | Authorizer arms a global boolean before upstream write succeeds; it is not bound to a specific active turn and can misclassify another turn's normal completion | | Retry/reassign state consistency | **FAIL in server integration** | Corrective candidate cleans retry/reassign attempts, but cancellation commits the terminal task state before a separate all-attempt ACK; injected ACK failure leaves a permanently consumable stale row | | Atomic dead-letter / cancellation | **FAIL (L1 @ `b3fabba`)** | Dead-letter calls audit helpers that swallow write failures, so ACK/task mutation can commit with no audit. Fault injection also leaves a task cancelled while its delivery attempt remains unacked. All writes and strict audit must share one real transaction | | Database-backend invariants | **FAIL / redesign authorized** | SQLite trigger/transaction tests are green, but `PgAdapter.transaction()` uses a fresh connection per statement and the SQLite write-once trigger is invalid on PostgreSQL and silently skipped. Lead locked RFC-030 production to the SQLite-backed server store; an explicit preflight/capability must reject PostgreSQL before gateway work. Longer-term remote-DB enablement requires a separate production bootstrap that grants an in-process positive capability before DB import; an inheritable env opt-in is not a security boundary and is not part of the current P0 fix | -| Clean-checkout evidence reproducibility | **FAIL / §8 hard gate** | A result counts only when an independent reviewer can run one documented command from the committed SHA in a clean checkout and obtain the stated exit code/assertions. Ignored bundles, hard-coded worktree paths, uncommitted helpers, copied implementations, manual hidden setup and `PASS` counts from an exit-1 command are no evidence. `fd2399c` fixes path/PTY handling, but `bun run build` creates only `dist/cli.js`; both Node scripts still fail with `ERR_MODULE_NOT_FOUND` until an unreported manual command builds ignored `dist/rfc030-integration.mjs`. A missing/wrong Codex binary must hard-fail the release gate rather than report `PASS: skipped` | +| Clean-checkout evidence reproducibility | **A Commit 1 PASS; integrated §8 gate locked** | `bd0dfd7` carries documented build-and-run commands that independently reproduce Node `60/60` and real Codex PTY `12/12`; missing/wrong Codex binaries fail the smoke. Wider B/integrated/release evidence remains incomplete and must be rerun on the final committed SHA | | Candidate aggregate test delta | **FAIL** | Candidate is `538/12/1638` versus baseline `515/8/1518`. RFC-030 must remove its four added failures and prove every new principal/auth assertion runs in aggregate; exit requires candidate failures `<= 8` | | Historical server test isolation | **Independent FAIL / corrective pending** | Draft [#438](https://github.com/sleep2agi/agent-network/pull/438) @ `6260213` reproduces `526/0/1555` three times, but is not Ready/mergeable: the official `commhub-server` bin performs zero bind/listen behind the new `import.meta.main` gate; `test:raw` still inherits `DATABASE_URL`; signal handling can green-wash/orphan children; its env self-test tests a copied helper; and overlaying #435 makes the exhaustive manifest reject `db-adapter-guard.test.ts`. 通信测试马 owns one corrective commit; #434/#438 remain separate from RFC-030 code and all production/merge gates stay locked | | Test production-DB isolation | **Ordering PASS / end-to-end FAIL; hardening pending** | [#435](https://github.com/sleep2agi/agent-network/issues/435), draft PR [#436](https://github.com/sleep2agi/agent-network/pull/436) @ `30e811a`: its `NODE_ENV=test` ordering and syscall proofs remain green (`17/0/28`, aggregate `532/8/1546`, all connect/PG/default-SQLite open `0`), but #438 exposed that `test:raw` neither sets test context nor removes `DATABASE_URL`, so fake PG reaches the PostgreSQL selector. Corrective design is explicit `--no-env-file` + safety preload on every supported entrypoint, root/server Bun test config, and a non-configurable in-process marker checked by the adapter; caller-supplied `NODE_ENV` remains only defense in depth. Arbitrary third-party cwd is an explicit Bun limitation; absolute enforcement would require a separate production-positive DB capability. Draft/merge remain locked | -| Independent §8 security review | **Not started** | Run only on corrected committed SHA; author cannot self-review | +| Independent §8 security review | **Locked / not started** | Run only on the corrected integrated committed SHA; author cannot self-review. Commit-1 internal freeze is not §8 sign-off | ## 8. Reproducible evidence log @@ -238,6 +269,8 @@ because one sub-assertion printed a green count. | 2026-07-13 | A Commit-1 corrective `fd2399c` | gateway subtree + independent real-Node boundary probes | unit `287/0/814`; checkpoint **FAIL** | Positive: the previous owner-timer regression is fixed, exact child env allowlist holds, and explicit bundle generation yields Node `30/30` plus real-CLI PTY `4/4`. Hard failures: a real upstream reverse request produces `writes=[]`; pending bearer/redactor state is inspectable; a rejected allow-half-open socket has `preAuth=0` and makes `stop()` wait indefinitely; duplicate Host reaches `101`; two rollback paths use reserved close code `1006` | | 2026-07-13 | A `fd2399c` clean-checkout evidence probe | `bun run build`; then each reported Node script directly | both scripts `ERR_MODULE_NOT_FOUND` | `build` emits only `dist/cli.js`. After the reviewer manually builds `dist/rfc030-integration.mjs`, Node is `30/30` and PTY smoke is `4/4`; that hidden step is useful diagnostic evidence but not a release gate. The CLI smoke observes `account/read`, not all four documented startup reads or a normal CLI lifecycle exit | | 2026-07-13 | A corrective round 2 `3e62297` | gateway subtree + clean Node command + lifecycle/secret/CLI adversarial probes | unit `290/0/815`; Node `37/37`; checkpoint **FAIL** | Steady-state reverse and prior WS admission defects are fixed. Lifecycle preflight/gap probes emit reverse+close and still end `running` with no write; start has two frame/close subscribers, every internal response creates a false WS diagnostic, and a proxied origin is consumed without delivery. Redactor EOF returns a 42/43-character bearer prefix. Direct CLI smoke false-greens `3/3` when owner attaches before any authorizer call; the canonical npm command selects local Codex 0.133 and exits 1 | +| 2026-07-13 | A Commit 1 final freeze `bd0dfd7` | gateway subtree; committed Node integration command; real Codex `0.144.0` PTY bootstrap smoke | gateway `321/0/978`; Node `60/60`; CLI `12/12`; **FINAL FREEZE PASS** | The reviewed A-layer admission/lease/router/child-env/redaction path is frozen. This is internal code/evidence freeze only, not Wave-1 checkpoint, §8, merge or release approval | +| 2026-07-13 | A Commit 2 first candidate `d2ca6f0` | gateway subtree plus independent teardown/listener probes | unit `329/0/1005`; **REQUEST CHANGES** | Positive unit counts do not override reproduced lifecycle failures: local stop errors can leave a reachable listener while reporting `stopped`, local stop can remain pending, and abort/single-flight/timeout/error-preservation contracts require corrective work. No PASS claimed | | 2026-07-12 | pinned Codex CLI `0.144.0` real socket capture | `codex --remote unix://` and loopback `ws://127.0.0.1:` with `--remote-auth-token-env` | Unix first packet is HTTP WebSocket Upgrade; Unix bearer flag is rejected; loopback WS Upgrade carries the bearer header | Proves current raw-JSONL TUI endpoint is not product-compatible and the UDS-only bearer design cannot be implemented with the pinned native CLI | | 2026-07-12 | pinned Codex CLI `0.144.0` loopback handshake progression | real TUI against an instrumented WS server, using sanitized synthetic responses | loopback path `/`; inbound frames omit `jsonrpc`; TUI accepts initialize responses both with and without `jsonrpc:"2.0"`; then requests `account/read` twice, `hooks/list`, `configRequirements/read`, `model/list` | Removes the proposed normalize/denormalize layer and freezes the four exact human-only read methods; fixtures must exclude real account/codex-home/cwd data | | 2026-07-12 | B L1 corrective candidate `b3fabba` | targeted principal/REST/stamp/reply plus gateway+app-server suites | `23/0/115`; `4/0/16`; `6/0/16`; `1/0/17`; `335/0/2587` | Green suite evidence only; the production-entry and failure-injection probes below keep L1 FAIL | @@ -302,7 +335,8 @@ bypasses the production path. ## 9. Review and release sequence -1. Correct and independently re-accept Wave 1A UDS segments A/B/C. +1. Keep Commit 1 frozen at `bd0dfd7`; correct and independently PASS Commit 2, + then re-accept the integrated Wave-1A lifecycle path. 2. Correct and independently re-accept Wave 1B L1 and L2 as separate commits with production-entry tests. 3. Only then re-estimate and explicitly re-release L3; consume `90d1e58`, delete stale