From 4b6b82d42462635a5296f54524144518db5fa6b6 Mon Sep 17 00:00:00 2001 From: Ryan Breen Date: Sat, 5 Sep 2026 02:55:00 -0400 Subject: [PATCH 1/2] fix(802): the AF_UNIX preflight fails through the gate verdict path #801 added two preflight checks on the operator-controlled BREENIX_GATE_TMP beside the assignments that derive their subjects, and at that point in the script the only way to stop was a bare `exit 1`. tests/teardown_structure.rs::x86_production_profile_gate_verdict_discipline_holds forbids that shape: "No exit may pre-empt the verdict. The trap's re-raise is the only one this gate needs, and it runs after a verdict has already been found false." The sun_path check's line-leading `exit 1` is what the scan sees, and it turned that ratchet red on main at 2a444455 (82 passed / 1 failed). Both checks now run immediately after the ERR trap is installed, as the first command under it, and reject with the `echo` + bare `false` shape this script already uses for its missing-userspace-artifact preflight. A rejection is therefore spent through report_gate_failure: the gate prints its `x86 production-profile gate: FAIL (...)` verdict line, names the failing command, and re-raises the nonzero status, so a verdict line is recorded before the process ends. The assignments the checks judge (OUTPUT_DIR, CONSOLE_SOCK_PATH) stay where they were, because report_gate_failure reads them. The preflight purpose is intact. The absolute-path check still runs ahead of `cd "$BREENIX_ROOT"`, which is what finding F6 on #797 is about, and both checks run ahead of the `rm -f` of the stale UEFI image that opens the build step, so a bad BREENIX_GATE_TMP is still rejected in well under a second, before the build and the boot. The absolute-path check's `exit 1` sat after a `*)` case label, so the scan's `split_whitespace().next()` test does not see it. It is converted here too, rather than left as the same defect in a shape the ratchet cannot read. Mac evidence at this head: `scripts/run-structure-tests.sh teardown_structure` -> exit 0, 83 passed / 0 failed (the failing test now passes); the tests/*_structure.rs sweep -> 29 of 29 suites green, 542 cases, 0 failed. Running the gate with BREENIX_GATE_TMP=relative-not-absolute and with a 133-character socket path each printed the preflight diagnostic followed by `x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:, exit 1)` and exited 1. claim-lint: scripts/claim-lint.py -> exit 0 claim-lint: scripts/claim-lint.py --files -> exit 0 Co-Authored-By: Ryan Breen Co-Authored-By: Claude Code --- docker/qemu/run-x86-prod-profile-boot-test.sh | 60 ++++++++++++++----- 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/docker/qemu/run-x86-prod-profile-boot-test.sh b/docker/qemu/run-x86-prod-profile-boot-test.sh index f95ca7b8d..a7fdc920e 100755 --- a/docker/qemu/run-x86-prod-profile-boot-test.sh +++ b/docker/qemu/run-x86-prod-profile-boot-test.sh @@ -200,31 +200,29 @@ BREENIX_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" # (BUILD_LOG) that only gained quotes -- see # docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md BREENIX_GATE_TMP="${BREENIX_GATE_TMP:-/tmp}" +# Both values derived from it are computed here because report_gate_failure +# below reads them, but neither is JUDGED here: the two preflight checks that +# reject a bad value are spent in the "BASE-DIR PREFLIGHT" block immediately +# after the ERR trap is installed (#802), so a rejection leaves the gate's own +# FAIL verdict line behind instead of a bare `exit`. +# # Must be absolute: OUTPUT_DIR below is computed before `cd "$BREENIX_ROOT"` # (unlike run-x86-boot-tests.sh, which computes its OUTPUT_DIR after its own # cd) and the ERR trap installed further down can fire before that cd too -- # a relative value would resolve inconsistently depending on which of those # points read it (review finding F6 on #797). -case "$BREENIX_GATE_TMP" in - /*) ;; - *) echo "x86 production-profile gate: FAIL (BREENIX_GATE_TMP must be an absolute path, got: $BREENIX_GATE_TMP)" >&2; exit 1 ;; -esac OUTPUT_DIR="$BREENIX_GATE_TMP/breenix_x86_prod_profile" # AF_UNIX sun_path is 108 bytes on Linux including the terminating NUL, so a -# constructed console-socket path over 107 characters cannot be bound -- fail -# loudly here rather than a cryptic error from qemu or the python liveness -# stimulus later, both of which use "$OUTPUT_DIR/console.sock" (review -# finding F7 on #797; the default and the custom value this change was -# tested with are both far under this, but the variable is now -# operator-controlled). +# constructed console-socket path over 107 characters cannot be bound -- the +# preflight below fails on it rather than letting a cryptic error come from +# qemu or the python liveness stimulus later, both of which use +# "$OUTPUT_DIR/console.sock" (review finding F7 on #797; the default and the +# custom value this change was tested with are both far under this, but the +# variable is now operator-controlled). # claim-lint:ok: #797 F7 -- 42/56-char measurements and the beast rejection # test for a deliberately oversized value are in # docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md CONSOLE_SOCK_PATH="$OUTPUT_DIR/console.sock" -if [ "${#CONSOLE_SOCK_PATH}" -gt 107 ]; then - echo "x86 production-profile gate: FAIL (console socket path exceeds the AF_UNIX sun_path limit of 107 chars: \"$CONSOLE_SOCK_PATH\" is ${#CONSOLE_SOCK_PATH} chars -- shorten BREENIX_GATE_TMP)" >&2 - exit 1 -fi QEMU_PID="" # #673 anti-vacuity knob. Empty (default) builds the real shipped profile; # set to "disable_x86_prod_init" to build the pre-fix, zero-userspace kernel @@ -798,6 +796,40 @@ report_gate_failure() { } trap 'report_gate_failure "$LINENO" "$BASH_COMMAND"' ERR +# --- BASE-DIR PREFLIGHT (#797 F6/F7, routed through the verdict path by #802) - +# +# These are the checks on the operator-controlled BREENIX_GATE_TMP, and they run +# HERE -- immediately after the ERR trap is installed, as the first commands to +# run under it -- rather than beside the assignments that derive their subjects. +# #801 put them beside those assignments, where the only way to stop was a bare +# `exit 1`, and a bare `exit` can end this gate with no verdict line at all: +# exactly the shape +# tests/teardown_structure.rs::x86_production_profile_gate_verdict_discipline_holds +# forbids ("No exit may pre-empt the verdict. The trap's re-raise is the only one +# this gate needs, and it runs after a verdict has already been found false"). +# Failing here instead spends the rejection through report_gate_failure: the gate +# prints its `x86 production-profile gate: FAIL (...)` verdict line, names the +# failing command, and re-raises the nonzero status. The `echo` + bare `false` +# shape is the one this script already uses for its missing-userspace-artifact +# preflight further down. +# +# The checks keep the fail-early purpose they were added for: this block runs +# ahead of `cd "$BREENIX_ROOT"` (the point F6 is about) and ahead of the `rm -f` +# of the stale UEFI image that opens the build step further down. And because +# the trap is installed on the line immediately above, this block is the first +# command to run under the handler, so the one path on which the handler can +# read an unvalidated relative OUTPUT_DIR is this block's own rejection -- where +# its use of OUTPUT_DIR is a serial-glob lookup that matches no file. +case "$BREENIX_GATE_TMP" in + /*) ;; + *) echo "x86 production-profile gate preflight: BREENIX_GATE_TMP must be an absolute path, got: $BREENIX_GATE_TMP" >&2 + false ;; +esac +if [ "${#CONSOLE_SOCK_PATH}" -gt 107 ]; then + echo "x86 production-profile gate preflight: console socket path \"$CONSOLE_SOCK_PATH\" is ${#CONSOLE_SOCK_PATH} chars, over the AF_UNIX sun_path limit of 107 -- shorten BREENIX_GATE_TMP" >&2 + false +fi + # Matching-LINE count across both serial files (#673 review, mi7 -- grep -c # counts lines, not substring occurrences, so two matches on one line would # still count once). The x86 console carries init's stdout on the same From b47099dab2dd48e03c2ee60e7c79e51c661fd59e Mon Sep 17 00:00:00 2001 From: Ryan Breen Date: Sat, 5 Sep 2026 03:05:15 -0400 Subject: [PATCH 2/2] docs(802): the beast record for the preflight-verdict fix Adds docs/planning/green-program/gates/GATE-PREFLIGHT-VERDICT-802-2026-09-05.md and the serials directory it reads. The document quotes the ratchet rule that went red, shows what replaced the two bare `exit 1` preflights, states why F6's cd-order property and F7's fail-before-the-build property still hold at the new placement, and discloses that the other seven #797 scripts keep the shape this one is moving away from. Beast record (clone /root/breenix-health, head 4b6b82d4, gate-script sha256 131d1304db8a1a78b4d36db06022a311d6a007458c5ba72d192a953c29ba0764, matching this branch's working tree): - `cargo build --release --features testing,external_test_bins --bin qemu-uefi` returned 0 with `grep -E "^(warning|error)"` printing no line. - The production-profile gate with BREENIX_GATE_TMP=/root/gate-tmp-802, 1 run: exit 0, verdict line "PASS: x86 production profile reached steady state with the teardown census at rest", booted image sha256 d1b3eb0e4461845bcb01381e8c6a66439c54924f7641df9ccfc242ac21abd71e (R17), console prompt count 1 -> 2 over the 60s liveness window. - Over-length BREENIX_GATE_TMP (147-char socket path): the preflight diagnostic followed by "x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:830, exit 1)", exit 1. - Relative BREENIX_GATE_TMP: the preflight diagnostic followed by the same FAIL verdict line at line 826, exit 1. - A timed repeat of the two rejection legs: 0.030 s and 0.029 s, with `ls -d` reporting no such directory for either output path afterwards. Also adds a short "Superseded for run-x86-prod-profile-boot-test.sh (#802)" subsection to GATE-TMP-BASEDIR-2026-09-05.md, whose F6/F7 code snippets are this gate's pre-#802 shape. claim-lint: scripts/claim-lint.py -> exit 0 claim-lint: scripts/claim-lint.py --files -> exit 0 Co-Authored-By: Ryan Breen Co-Authored-By: Claude Code --- .../GATE-PREFLIGHT-VERDICT-802-2026-09-05.md | 199 ++++++++++++++++++ .../gates/GATE-TMP-BASEDIR-2026-09-05.md | 12 ++ .../gates/serials/802-2026-09-05/README.md | 19 ++ .../802-2026-09-05/driver-transcript.txt | 27 +++ .../serials/802-2026-09-05/gate-run1-head.txt | 30 +++ .../serials/802-2026-09-05/gate-run1-tail.txt | 80 +++++++ .../802-2026-09-05/preflight-timing.txt | 13 ++ 7 files changed, 380 insertions(+) create mode 100644 docs/planning/green-program/gates/GATE-PREFLIGHT-VERDICT-802-2026-09-05.md create mode 100644 docs/planning/green-program/gates/serials/802-2026-09-05/README.md create mode 100644 docs/planning/green-program/gates/serials/802-2026-09-05/driver-transcript.txt create mode 100644 docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-head.txt create mode 100644 docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-tail.txt create mode 100644 docs/planning/green-program/gates/serials/802-2026-09-05/preflight-timing.txt diff --git a/docs/planning/green-program/gates/GATE-PREFLIGHT-VERDICT-802-2026-09-05.md b/docs/planning/green-program/gates/GATE-PREFLIGHT-VERDICT-802-2026-09-05.md new file mode 100644 index 000000000..f661a2b74 --- /dev/null +++ b/docs/planning/green-program/gates/GATE-PREFLIGHT-VERDICT-802-2026-09-05.md @@ -0,0 +1,199 @@ +# The x86 production-profile gate's base-dir preflight now fails through the verdict path (#802) + +## What was red + +`tests/teardown_structure.rs::x86_production_profile_gate_verdict_discipline_holds` +failed on `main` at `2a444455` (the #801 merge): 82 passed, 1 failed. The test +prints its reason on stderr before it panics: + +``` +x86 production-profile gate gained a pre-empting exit: exit 1 +``` + +#801 added two preflight checks on the operator-controlled `BREENIX_GATE_TMP` +to `docker/qemu/run-x86-prod-profile-boot-test.sh`, next to the assignments +that derive their subjects (review findings F6 and F7 on #797). At that point +in the script — line 208 and line 224 on `main` — the only way to stop was a +bare `exit 1`, because `report_gate_failure` is defined ~550 lines further +down and the `ERR` trap that calls it is installed after that definition. + +## The rule + +The ratchet's scan reads, verbatim (`tests/teardown_structure.rs:15336-15346`): + +```rust + // No exit may pre-empt the verdict. The trap's re-raise is the only one this + // gate needs, and it runs after a verdict has already been found false. + for line in script.lines() { + let statement = line.trim(); + if statement.split_whitespace().next() == Some("exit") + && statement != "exit \"$exit_code\"" + { + eprintln!("x86 production-profile gate gained a pre-empting exit: {statement}"); + return Err(()); + } + } +``` + +It sits inside `validate_x86_prod_profile_harness`, whose doc comment says why +this gate in particular is pinned this way: it "is the only x86 boot that ever +executes the shipped zero-feature kernel, so a silent abort inside it is worse +than in the boot-test harness: there is no second x86 gate that would catch the +same regression." + +The rule is about the *verdict*, not about the token `exit`. The gate records +`reached=false`, raises `reached=true`, and spends the verdict at +`test "$reached" = true`; the machinery that turns a red into readable output +is `report_gate_failure`, which prints the `x86 production-profile gate: FAIL +(...)` line, names the failing command, preserves the serial and re-raises the +status. An `exit` that runs outside that machinery can end the gate with no +verdict line behind it, which is the state the rule exists to keep out. + +## The fix + +The two checks moved to a `BASE-DIR PREFLIGHT` block placed immediately after +the `ERR` trap is installed, so they are the first commands to run under the +handler, and they reject with the `echo` + bare `false` shape this script +already uses for its missing-userspace-artifact preflight further down: + +```bash +trap 'report_gate_failure "$LINENO" "$BASH_COMMAND"' ERR + +# --- BASE-DIR PREFLIGHT (#797 F6/F7, routed through the verdict path by #802) - +... +case "$BREENIX_GATE_TMP" in + /*) ;; + *) echo "x86 production-profile gate preflight: BREENIX_GATE_TMP must be an absolute path, got: $BREENIX_GATE_TMP" >&2 + false ;; +esac +if [ "${#CONSOLE_SOCK_PATH}" -gt 107 ]; then + echo "x86 production-profile gate preflight: console socket path \"$CONSOLE_SOCK_PATH\" is ${#CONSOLE_SOCK_PATH} chars, over the AF_UNIX sun_path limit of 107 -- shorten BREENIX_GATE_TMP" >&2 + false +fi +``` + +A bare `false` under `set -e`/`set -E` fires the `ERR` trap, so the rejection +is spent through `report_gate_failure`: the operator sees the specific +diagnostic (which value, how long, what to shorten) followed by the gate's own +`FAIL` verdict line and a nonzero status. The script now carries one `exit`, +the trap's re-raise `exit "$exit_code"`, which the rule admits by name. + +The assignments the checks judge (`BREENIX_GATE_TMP`, `OUTPUT_DIR`, +`CONSOLE_SOCK_PATH`) stay where #801 put them, because `report_gate_failure` +reads `OUTPUT_DIR` and `BREENIX_GATE_TMP` in its own failure path and must see +them defined. + +## The preflight purpose is unchanged + +F6 is about cd-order: `OUTPUT_DIR` is computed before this script's +`cd "$BREENIX_ROOT"`, so a relative `BREENIX_GATE_TMP` would resolve +differently depending on which side of that `cd` read it. The preflight block +sits at line 799-831 and the `cd` is at line 944, so the absolute-path check +still runs on the same side of the `cd` it did before. F7 is about failing +before a wasted build: the first `rm` in this script is the `rm -f` of the +stale UEFI image at line 965, immediately ahead of the `cargo build`, so both +checks still reject a bad value ahead of the build and the boot. A second, timed pass over the +same two invocations (`date +%s.%N` either side, transcript +`serials/802-2026-09-05/preflight-timing.txt`) returned in 0.030 s and +0.029 s, and neither left its `$OUTPUT_DIR` behind (`ls -d` on each reported +"No such file or directory" afterwards), so the build step was not reached. + +## The sibling `exit` the scan cannot see + +The absolute-path check's `exit 1` was on a line beginning with the case label +`*)`, so `split_whitespace().next()` returned `Some("*)")` and the scan did not +report it — only the `sun_path` check's line-leading `exit 1` reddened the +test. Both are converted here. Leaving the first one in place would have kept +the same defect in the gate in a shape this ratchet happens not to read, which +is a worse state than the red that was filed. + +## Scope disclosure: the seven sibling scripts + +#797 put the same absolute-path guard into eight gate scripts, and the +`sun_path` guard into two. This change converts the two guards in +`run-x86-prod-profile-boot-test.sh` only. The other seven scripts keep the +`case ... exit 1` / `if ... exit 1` shape #797 gave them (claim-lint:ok: #802, +`grep -c 'BREENIX_GATE_TMP must be an absolute path'` returns 1 in each of the +8 files, of which 1 is this gate). That is a scope statement, not a claim that +those seven are correct: `x86_production_profile_gate_verdict_discipline_holds` +is the one ratchet in `tests/` that pins verdict discipline for a gate script, +and it names this gate alone, so whether each sibling's preflight should also +print that gate's own `FAIL` line is a judgement about that gate's verdict +model rather than a red this branch is carrying. + +## Evidence + +### Mac (this branch's head) + +| command | result | +|---|---| +| `scripts/run-structure-tests.sh teardown_structure` | exit 0, 83 passed / 0 failed | +| `tests/*_structure.rs` sweep, 29 files | 29 of 29 green, 542 cases, 0 failed | +| `scripts/claim-lint.py` | exit 0 | + +The single test named in #802 is inside that 83 and passes at this head; the +82/1 split quoted at the top is `main` at `2a444455`. + +### Beast (`breenix-x86` Incus VM, clone `/root/breenix-health`) + +Head `4b6b82d42462635a5296f54524144518db5fa6b6`; the gate script's sha256 in +the clone, `131d1304db8a1a78b4d36db06022a311d6a007458c5ba72d192a953c29ba0764`, +matches this branch's working tree. Full transcript: +`serials/802-2026-09-05/driver-transcript.txt`. + +1. **Clean build.** `cargo build --release --features + testing,external_test_bins --bin qemu-uefi` returned 0 and + `grep -E "^(warning|error)"` over its log printed no line (grep exit 1 = + no match), per the driver transcript's STEP 1 block. + +2. **Default gate run**, `BREENIX_GATE_TMP=/root/gate-tmp-802`, 1 run: exit 0 + with the verdict line + + ``` + PASS: x86 production profile reached steady state with the teardown census at rest + ``` + + sha256 of the image it booted (R17): + `d1b3eb0e4461845bcb01381e8c6a66439c54924f7641df9ccfc242ac21abd71e` + (`target/release/build/breenix-a14bb21948d9e08d/out/breenix-uefi.img`). + Liveness sample in the same run: console prompt count 1 -> 2 over 60s. + Framing and marker census: `serials/802-2026-09-05/gate-run1-head.txt` and + `gate-run1-tail.txt`. + +3. **Simulated preflight failure, over-length path.** `BREENIX_GATE_TMP` set + to a 109-character directory, which makes the console socket path 147 + characters: + + ``` + x86 production-profile gate preflight: console socket path "/root/gate-tmp-802-ggg...ggg/breenix_x86_prod_profile/console.sock" is 147 chars, over the AF_UNIX sun_path limit of 107 -- shorten BREENIX_GATE_TMP + x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:830, exit 1) + failing command: false + ``` + + exit status 1; the timed repeat of this invocation took 0.030 s. This is + the condition the F7 preflight checks, and the gate's `FAIL` verdict line + is now on the way out. + +4. **Simulated preflight failure, relative path.** `BREENIX_GATE_TMP` set to + `relative-not-absolute`: + + ``` + x86 production-profile gate preflight: BREENIX_GATE_TMP must be an absolute path, got: relative-not-absolute + x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:826, exit 1) + failing command: false + ``` + + exit status 1; the timed repeat took 0.029 s. This is the F6 leg, which the + ratchet's scan could not see before. + +Both rejection legs returned before the build step, so neither produced a +serial for `report_gate_failure` to preserve; the handler's `compgen -G` +lookup over `$OUTPUT_DIR/serial_*.txt` matches no file and the handler skips +its preservation block, which is why the transcripts above are three lines +rather than a serial tail. + +## Claim-lint + +``` +claim-lint: scripts/claim-lint.py -> exit 0 +``` diff --git a/docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md b/docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md index 46f7d195d..b95d7d1f3 100644 --- a/docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md +++ b/docs/planning/green-program/gates/GATE-TMP-BASEDIR-2026-09-05.md @@ -230,6 +230,18 @@ second, before either script reached its build step (claim-lint:ok: #797 F7 rejected commands and their output, both a real run captured firsthand this round). +### Superseded for `run-x86-prod-profile-boot-test.sh` (#802) + +The two snippets above are the shape #797 landed, and they are what the other +seven scripts still carry. In `run-x86-prod-profile-boot-test.sh` the bare +`exit 1` tripped +`tests/teardown_structure.rs::x86_production_profile_gate_verdict_discipline_holds`, +which forbids an `exit` that can end that gate before its verdict line is +printed; both of its checks were moved under the gate's `ERR` trap and now +reject through `report_gate_failure` instead. What replaced them, and the +beast evidence for the replacement, is in +`GATE-PREFLIGHT-VERDICT-802-2026-09-05.md`. + ## The evidence-capture driver at `docs/planning/713-x86-spawn/serials/run-leg1.sh` (review finding F4) This checked-in script is a historical record of a 12-boot evidence-capture diff --git a/docs/planning/green-program/gates/serials/802-2026-09-05/README.md b/docs/planning/green-program/gates/serials/802-2026-09-05/README.md new file mode 100644 index 000000000..45b03d0cc --- /dev/null +++ b/docs/planning/green-program/gates/serials/802-2026-09-05/README.md @@ -0,0 +1,19 @@ +# #802 preflight-verdict evidence, 2026-09-05 + +Beast (`breenix-x86` Incus VM) evidence for branch +`fix/802-prod-gate-preflight-verdict`, head `4b6b82d4`, clone +`/root/breenix-health`, with `BREENIX_GATE_TMP=/root/gate-tmp-802` for the +default run (R18). The narrative that reads these files is +`../../GATE-PREFLIGHT-VERDICT-802-2026-09-05.md`. + +| file | what it is | +|---|---| +| `driver-transcript.txt` | The whole run: head, gate-script sha256, clean-build grep, the default gate run's verdict line and booted-image sha256, and both preflight-rejection legs with their exit codes. | +| `gate-run1-head.txt` | First 30 lines of the default gate run — the zero-feature build and the ext2 image assembly. | +| `gate-run1-tail.txt` | Last 80 lines of the default gate run — the marker census, the two production censuses, and the liveness prompt-count sample. | +| `preflight-timing.txt` | A second, timed pass over the two rejection legs (`date +%s.%N` either side), plus the `ls -d` check that neither leg created its output directory. | + +The default run's own serial files stay in the container at +`/root/gate-tmp-802/breenix_x86_prod_profile/`; the gate PASSed, so +`report_gate_failure` did not run and this directory holds no preserved +failure serial. diff --git a/docs/planning/green-program/gates/serials/802-2026-09-05/driver-transcript.txt b/docs/planning/green-program/gates/serials/802-2026-09-05/driver-transcript.txt new file mode 100644 index 000000000..615dac7d7 --- /dev/null +++ b/docs/planning/green-program/gates/serials/802-2026-09-05/driver-transcript.txt @@ -0,0 +1,27 @@ +=== START 2026-09-05T06:56:10Z === +head=4b6b82d42462635a5296f54524144518db5fa6b6 +sha256_script=131d1304db8a1a78b4d36db06022a311d6a007458c5ba72d192a953c29ba0764 docker/qemu/run-x86-prod-profile-boot-test.sh +=== STEP 1: clean-build check (testing,external_test_bins) === +build_rc=0 +--- grep -E '^(warning|error)' output (expect empty) --- +--- grep_rc=1 (1 = no match = clean) --- +=== STEP 2: production-profile gate, default run === +qemu_before=0 +gate_rc=0 +--- verdict lines --- +PASS: x86 production profile reached steady state with the teardown census at rest +--- booted image sha256 --- +d1b3eb0e4461845bcb01381e8c6a66439c54924f7641df9ccfc242ac21abd71e target/release/build/breenix-a14bb21948d9e08d/out/breenix-uefi.img +=== STEP 3: preflight failure (over-length BREENIX_GATE_TMP) === +longdir_len=109 +preflight_rc=1 +--- preflight-fail output --- +x86 production-profile gate preflight: console socket path "/root/gate-tmp-802-gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg/breenix_x86_prod_profile/console.sock" is 147 chars, over the AF_UNIX sun_path limit of 107 -- shorten BREENIX_GATE_TMP +x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:830, exit 1) + failing command: false +=== STEP 4: preflight failure (relative BREENIX_GATE_TMP) === +preflight_rel_rc=1 +x86 production-profile gate preflight: BREENIX_GATE_TMP must be an absolute path, got: relative-not-absolute +x86 production-profile gate: FAIL (set -e abort at docker/qemu/run-x86-prod-profile-boot-test.sh:826, exit 1) + failing command: false +=== END 2026-09-05T06:58:22Z === diff --git a/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-head.txt b/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-head.txt new file mode 100644 index 000000000..161626420 --- /dev/null +++ b/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-head.txt @@ -0,0 +1,30 @@ +Building the shipped x86_64 production kernel profile... + Compiling kernel v0.1.0 (/root/breenix-health/kernel) + Compiling breenix v0.1.0 (/root/breenix-health) + Finished `release` profile [optimized] target(s) in 17.23s + Compiling kernel v0.1.0 (/root/breenix-health/kernel) + Compiling breenix v0.1.0 (/root/breenix-health) + Finished `release` profile [optimized] target(s) in 15.54s + Running `target/release/qemu-uefi` +[qemu-uefi] Using UEFI image: /root/breenix-health/target/release/build/breenix-a14bb21948d9e08d/out/breenix-uefi.img (7405568 bytes) +Creating ext2 disk image... + Arch: x86_64 + Output: /root/breenix-health/target/ext2.img + Size: 256MB + busybox.elf not found, attempting to build... +Error: x86_64-linux-musl-gcc not found in PATH + +Install with: + brew tap filosottile/musl-cross + brew install musl-cross + WARNING: BusyBox build failed (see build-busybox.sh for prerequisites) + WARNING: busybox.elf not found, skipping coreutils +Installing other binaries... + Installed 45 binaries in /bin + Installed 3 binaries in /sbin + Installed 0 C binaries in /usr/local/cbin + Installed 101 test binaries in /usr/local/test/bin + Installed 29 fonts in /usr/share/fonts + Created /etc/fonts.conf + Created /etc/hotkeys.conf + Created /etc/init.js diff --git a/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-tail.txt b/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-tail.txt new file mode 100644 index 000000000..d04d631ee --- /dev/null +++ b/docs/planning/green-program/gates/serials/802-2026-09-05/gate-run1-tail.txt @@ -0,0 +1,80 @@ + steady state reached: 1 + console prompt: 2 + tombstone census lines: 1 + tombstone census at rest: 1 + root custody lines: 1 + root custody at rest: 1 + crash markers: 0 + test-only marker 'TEST_TALLY:': 0 + test-only marker '[TEST:': 0 + test-only marker 'TEST RUNNER:': 0 + test-only marker '[BOOT_TESTS:': 0 + test-only marker 'RING3_SMOKE: creating': 0 + test-only marker '[TOMBSTONE_QUIESCE:': 0 + test-only marker '[RECLAIM_DRAIN:': 0 + test-only marker '[TOMBSTONE_JOIN_ORACLE:': 0 + test-only marker '[KSTACK_OWNER_ORACLE:': 0 + test-only marker '[KSTACK_QUIESCE_LEAK:': 0 + test-only marker '[PT_CUSTODY_COUNTERS:': 0 + test-only marker '[FRAME_CUSTODY_COUNTERS:': 0 + test-only marker '[PT_RETIRE_COHORT:': 0 + test-only marker '[PT_EXEC_COHORT:': 0 + test-only marker '[EXEC_DETACH_ORACLE:': 0 + test-only marker '[CLONE_ADMISSION_ORACLE:': 0 + test-only marker '[INIT_DESIGNATION_ORACLE:': 0 + test-only marker '[SCHED_STRAND_ORACLE:': 0 + test-only marker '[CENSUS_WIDEN_ORACLE:': 0 + test-only marker 'Testing features enabled': 0 + fault marker '[PMGUARD]': 0 + fault marker '[CREATION_LOCK_ORDER:VIOLATION': 0 + fault marker 'DISK LOADING FAILED': 0 + fixed PRECONDITION 5 fail (#673): 0 + fixed PRECONDITION 5 pass (#673): 1 + fixed PRECONDITION 7 fail (#672): 0 + fixed PRECONDITION 7 pass (#672): 1 + preempt census lines: 1 + preempt census at rest: 1 + prod bracket release census: 1 + prod bracket release at rest: 1 + timer resolution window exceeded (#673 MA6/R3-m4): 0 + init designation (#673): 1 + ring3 syscall confirmed (#673): 1 + init first line (#673 M6): 1 + init bsshd-launch warning (must be absent, #713): 0 + bsshd started (#713): 1 + bsshd listening (#713): 1 + spawn-smoke child reaped exit 0 (#713): 1 + spawn-smoke reap failed (must be absent, #713 fix-round-2): 0 + tty oracle exit record (TTY-x86 port): 1 + tty oracle reap failed (must be absent, TTY-x86 port): 0 + tty oracle failed (must be absent, TTY-x86 port): 0 + exec smoke launch (#721): 1 + exec smoke target enter argc=2 (#721): 1 + exec smoke target ok (#721): 1 + exec smoke launcher exit code=0 (#721): 1 + exec smoke spawn failed (must be absent, #721): 0 + exec smoke exec failed (must be absent, #721): 0 + exec smoke target argv fail (must be absent, #721): 0 + exec lock order first commit (#721 K7): 1 + exec lock order PM-held violation (must be absent, #721 K7): 0 + exec lock order unpinned violation (must be absent, #721 K7): 0 + exec lock order no-sched-thread violation (must be absent, #721 K7): 0 + fork smoke launch (#745): 1 + fork smoke child (#745): 1 + fork smoke CoW isolation OK (#745): 1 + fork smoke CoW isolation corrupted (must be absent, #745): 0 + fork smoke parent reaped (#745): 1 + fork smoke launcher exit code=0 (#745): 1 + fork smoke child exit code=37 (#745 review r2 B1): 1 + first CoW fault taken (#745 precheck C3(2)): 1 + fork smoke spawn failed (must be absent, #745): 0 + fork smoke fork failed (must be absent, #745): 0 + fork smoke child unexpected return (must be absent, #745): 0 + fork smoke reap failed (must be absent, #745): 0 +[TOMBSTONE_CENSUS:resident=0:removed=0:reap_second=0:retire_second=0:abandoned_unqueued=0] +[SW][SW][SW][SW]<1>[PT_ROOT_CUSTODY:no_proof=0:no_arch=0:terminated=0:undecided=0:mid_retire=0:retired=0] +[ INFO] kernel: [PREEMPT_BRACKET_CENSUS:underflow=0] +[ INFO] kernel: [PROD_BRACKET_RELEASE_CENSUS:underflow=0] +[INIT_DESIGNATION:x86_64:designated_pid=1:reserved_collisions=0] + console prompt count over 60s: 1 -> 2 + (informational) total serial bytes at exit: 258593 diff --git a/docs/planning/green-program/gates/serials/802-2026-09-05/preflight-timing.txt b/docs/planning/green-program/gates/serials/802-2026-09-05/preflight-timing.txt new file mode 100644 index 000000000..ca1f19ee5 --- /dev/null +++ b/docs/planning/green-program/gates/serials/802-2026-09-05/preflight-timing.txt @@ -0,0 +1,13 @@ +=== over-length leg, timed === +rc=1 elapsed_s=0.030 +x86 production-profile gate preflight: console socket path "/root/gate-tmp-802-gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg/breenix_x86_prod_profile/console.sock" is 147 chars, over the AF_UNIX sun_path limit of 107 -- shorten BREENIX_GATE_TMP +x86 production-profile gate: FAIL (set -e abort at ./docker/qemu/run-x86-prod-profile-boot-test.sh:830, exit 1) + failing command: false +=== relative leg, timed === +rc=1 elapsed_s=0.029 +x86 production-profile gate preflight: BREENIX_GATE_TMP must be an absolute path, got: relative-not-absolute +x86 production-profile gate: FAIL (set -e abort at ./docker/qemu/run-x86-prod-profile-boot-test.sh:826, exit 1) + failing command: false +=== dirs that must NOT exist === +ls: cannot access '/root/gate-tmp-802-gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg': No such file or directory +ls: cannot access '/root/breenix-health/relative-not-absolute': No such file or directory