morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1942] [MERGED] fix(verification): align Linux Hopper setup lane with current contracts #4925

New issue

Closed

opened 2026-10-31 00:56:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1942
Author: @LuisTaffelli
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/linux-hopper-verification

📝 Commits (10+)

58d23e4 fix(verification): align Linux Hopper setup lane with current contracts
c039dd8 fix(verification): retain orphan checks on clean Linux runners
b88cdc2 fix(verification): detect Hopper through alternate launcher paths
b9d9a47 fix(verification): report identified Hopper leaks before proc errors
8ea0432 fix(verification): distinguish Hopper string recognition from byte fidelity
97b76aa fix(verification): report full literal decoding coverage explicitly
f379bc3 fix(verification): integrate Linux Hopper lane with current contracts
794debe chore(verification): sync Hopper validation with latest main
94f3219 chore: merge main and resolve PR #1942 conflicts
0bb06f8 test(verification): require a clean host before orphan checks

📊 Changes

1 file changed (+3 additions, -0 deletions)

View changed files

📝 tests/process-global/cleanLinuxHopperRuntime.test.ts (+3 -0)

📄 Description

Problem and scope

The Linux clean-setup verifier requests the wrong setup plan, omits source-built fixtures, uses an unscoped doctor, and requests reinstallation while expecting idempotence. The nested Hopper verifier also leaves the launcher environment pointing to a deleted alternate symlink. This PR corrects that verification path and retains orphan-aware clean-runner observations alongside token-verified child lineage.

The native Linux fixture investigation exposed recognition limits in Hopper 6.4.2. The verifier retains all 4,120 original long-literal bytes through a source-owned symbol, binds recognition to that exact address, and reports its decoded-object coverage as unverified on Linux. A separate 548-byte ASCII literal remains mandatory for decoded fragmentation, byte fidelity, shortened native display, tail search and dossier provenance. Missing native non-ASCII objects retain raw-byte proof and explicit unverified decoded coverage; any returned object must pass its value/encoding/extent/filter/search checks. macOS keeps the original full-length recognition requirement.

Related #339 and #340 remain open. No production provider, bridge, installer, domain, CLI/MCP schema or Evidence contract is changed. This is a routine verification correction within existing provider authority; it adds no target execution or mutation capability. The native lane uses existing metadata mutations in owned fixture sessions, with unrelated-process preservation. Installation writes occur only after the explicit setup plan and approval in the disposable VM.

Review corrections

Detached groups: retain a dedicated orphan-aware observer before installation and after teardown. It never signals a process or establishes ownership.
Alternate launchers: inspect executed-file device/inode through /proc, including a removed invoked symlink. Complete inspection before reporting a deferred permission error so an unreadable unrelated process cannot hide an identified orphan. Caller-owned unknowns fail closed.
Full literal: report recognition at the exact source-byte address; Linux decoded coverage stays explicitly unverified even if recognized. macOS additionally requires its decoded object's address to match.

The two regressions use real detached OS processes and production token/identity cleanup. They establish observation behavior, not real-Hopper behavior. The tested candidate uses the current temporary-directory helper and moves this PR's guide additions to docs/client-verification.md, where upstream now owns these instructions.

Exact source and native evidence

Original real-Hopper evidence remains pinned to 8ea0432ffc, run 45930d25-d485-4ff3-a0bf-0e6286f12329. It is not substituted for later executions.

A new execution of the earlier PR revision 97b76aa20a passed in a private disposable Omarchy 4.0.4 x86-64 VM with Hopper 6.4.2-1 and Node 24.18.0/npm 11.16.0. Run ae4de7ff-dd2a-4c73-88dc-6dbf1ad7c537 completed 2026-10-12T22:13:52.319Z: 172 advertised schemas, 181 successful calls, 63 rejected calls, complete 1,205-item inventories, cancellation/deadline recovery, competing launches, unrelated Hopper preservation and clean shutdown. The configured launcher was restored and the dedicated post-run observer passed. All 2,822 source file digests matched before and after; runtime and source fixtures were built inside the guest. A non-root observer preflight failed closed on an unreadable caller-owned /proc executable before Hopper launched; its report is retained separately. The root run passed without changing that check.

Tested candidate, now represented by commit f379bc3882: main ae8051302b plus patch SHA-256 1a7ca61c6cff56730f2855d363d6e93e3c9615016578479722f63f6aa10e5723. Its separate native run 9e7de373-4686-4820-ae48-801e536589b7 completed 2026-10-12T22:17:02.991Z and passed with 187 schemas/181 successful calls/63 rejected calls and the same cleanup/coverage assertions. All 3,175 archived source-file digests matched before and after. The native run preceded commit creation. All 3,175 exported file digests match the later commit's git archive, including checkout normalization declared by .gitattributes. Native evidence is bound to that source snapshot; it is not a native execution of the final PR head. Unmaterialized optional gitlinks are recorded in provenance and outside the Hopper claim.

Both runs report the full literal at 0x402020 as not_observed / decodedObject unverified. The fixture binaries have their own execution-specific digests; no old fixture digest is reused. Public evidence package contains 27 remotely verified files: source manifests, execution-specific fixture digests and receipts, runtime identities, full reports, failed preflight, cleanup observations and CI reproduction logs. Public logs remove terminal ANSI formatting only; the index records original and published SHA-256 values. The originally empty final process receipt is represented by an explicitly labeled JSON observation with its original size and digest. Original local evidence is preserved. No binaries, provider documents, VM disks or credentials are included in Git.

Published revision

Current head is 794debe565, integrating main 653067d799 without conflicts. The subsequent main merge changes 24 JavaScript/Apple files and tests; it changes no Hopper/provider/verifier or dependency files. Its complete path list and commit/tree bindings are in the public evidence package. No new native run was performed on this final merge. The PR diff remains nine verification, fixture and documentation files.

Validation and CI diagnosis

26 selected tests, npm run check, docs:check and the pre-push check passed on final head 794debe5. Earlier candidate validation: 21 selected tests, npm run check, docs:check, verify:fixtures (4 fixtures), verify:test-discovery (996 files exactly once), verify:package and npm pack --dry-run passed on the candidate. Package checks are not native verification of an installed npm artifact. The complete local suite/check:pr was not rerun.

Historical required CI run 38177777058 remains failed on the earlier revision 97b76aa2. The same two Qwen assertions and one browser assertion reproduced in both exact CI merge4893452b55790e4e362e097beb02e076b5ce345a and baseb777e5d4d8a7b60edad7d5c0eaa56408a4b3f610; five relevant test/producer file digests are identical between them. Qwen expects a raw string instead of the successful Result object. The browser fixture lacks required initiator metadata and therefore creates no request; its not.toBeNull assertion fails to reject undefined. Upstream89f5e489a fixes both fixture contracts; d1dcebce2 subsequently strengthens response occurrence ownership. All 13 selected tests passed on pinned main ae8051302b, and all 21 passed with the tested candidate. The expanded final selection passed all 26 tests. No Qwen/browser correction is added to this PR. The historical red gate remains failed. Fresh CI run 38317360262 for published head 794debe565 completed successfully, including CI required, all six test shards and coverage aggregation.

Installation and coverage limits

The earlier two clean installation attempts stopped at download_failed; the previous cached official-package restoration was separate evidence, not a fresh setup pass. The new uninterrupted verify:setup:linux run passed on the private candidate VM: 93584b53-944b-47cf-a6a4-b0d4ff8a4961, completed 2026-10-12T22:19:38.365Z. Hopper was removed with pacman -R (its prerequisites were retained), the lane used a new empty HOME, and the official download/install path ran without cached-package restoration. The verifier required the read-only plan, approved installation, scoped doctor, source CLI/MCP conformance, modified-launcher rejection, empty repeated setup actions and clean teardown. All 3,175 source hashes still matched afterward; the final Hopper/Xvfb observation was empty and the private VM shut down normally (QEMU exit 0). This is an uninterrupted pass with previously provisioned runtime prerequisites, not a claim about every fresh OS image or the older failed attempts.

Native evidence covers this Linux demo build and source CLI/MCP only. macOS and other builds, an installed npm artifact with real Hopper, native decoding of omitted full/non-ASCII literals, internal recognition heuristics, interruption of synchronous native work and saved-database recovery remain unverified. The raw-byte/recognized-fragment observations do not establish a universal native length limit. Passing this PR does not close #339 or #340.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1942 **Author:** [@LuisTaffelli](https://github.com/LuisTaffelli) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/linux-hopper-verification` --- ### 📝 Commits (10+) - [`58d23e4`](https://github.com/morluto/rea/commit/58d23e42b6c82edeb34ee8677d197a87041acb17) fix(verification): align Linux Hopper setup lane with current contracts - [`c039dd8`](https://github.com/morluto/rea/commit/c039dd81d52b7eb049bf6445a0bf21597efe264f) fix(verification): retain orphan checks on clean Linux runners - [`b88cdc2`](https://github.com/morluto/rea/commit/b88cdc248a0589cf6314fc653fc92acae51531b4) fix(verification): detect Hopper through alternate launcher paths - [`b9d9a47`](https://github.com/morluto/rea/commit/b9d9a474cf53615ba60651f429068cf3c69fbbb9) fix(verification): report identified Hopper leaks before proc errors - [`8ea0432`](https://github.com/morluto/rea/commit/8ea0432ffc11d47d2f43fbd4964f48116b4bd4a5) fix(verification): distinguish Hopper string recognition from byte fidelity - [`97b76aa`](https://github.com/morluto/rea/commit/97b76aa20afbe2c654d2309175a708f774373234) fix(verification): report full literal decoding coverage explicitly - [`f379bc3`](https://github.com/morluto/rea/commit/f379bc38824dd061a62d8ae7eb843d9c29551e4e) fix(verification): integrate Linux Hopper lane with current contracts - [`794debe`](https://github.com/morluto/rea/commit/794debe5656f634f54db45eb6b6582be227401bc) chore(verification): sync Hopper validation with latest main - [`94f3219`](https://github.com/morluto/rea/commit/94f3219636a8953e68101073e272a7ddf9c8738c) chore: merge main and resolve PR #1942 conflicts - [`0bb06f8`](https://github.com/morluto/rea/commit/0bb06f8c7a2eedfd827861c4cadbeff32c83a8d5) test(verification): require a clean host before orphan checks ### 📊 Changes **1 file changed** (+3 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `tests/process-global/cleanLinuxHopperRuntime.test.ts` (+3 -0) </details> ### 📄 Description ## Problem and scope The Linux clean-setup verifier requests the wrong setup plan, omits source-built fixtures, uses an unscoped doctor, and requests reinstallation while expecting idempotence. The nested Hopper verifier also leaves the launcher environment pointing to a deleted alternate symlink. This PR corrects that verification path and retains orphan-aware clean-runner observations alongside token-verified child lineage. The native Linux fixture investigation exposed recognition limits in Hopper 6.4.2. The verifier retains all 4,120 original long-literal bytes through a source-owned symbol, binds recognition to that exact address, and reports its decoded-object coverage as unverified on Linux. A separate 548-byte ASCII literal remains mandatory for decoded fragmentation, byte fidelity, shortened native display, tail search and dossier provenance. Missing native non-ASCII objects retain raw-byte proof and explicit unverified decoded coverage; any returned object must pass its value/encoding/extent/filter/search checks. macOS keeps the original full-length recognition requirement. Related #339 and #340 remain open. No production provider, bridge, installer, domain, CLI/MCP schema or Evidence contract is changed. This is a routine verification correction within existing provider authority; it adds no target execution or mutation capability. The native lane uses existing metadata mutations in owned fixture sessions, with unrelated-process preservation. Installation writes occur only after the explicit setup plan and approval in the disposable VM. ## Review corrections - Detached groups: retain a dedicated orphan-aware observer before installation and after teardown. It never signals a process or establishes ownership. - Alternate launchers: inspect executed-file device/inode through /proc, including a removed invoked symlink. Complete inspection before reporting a deferred permission error so an unreadable unrelated process cannot hide an identified orphan. Caller-owned unknowns fail closed. - Full literal: report recognition at the exact source-byte address; Linux decoded coverage stays explicitly unverified even if recognized. macOS additionally requires its decoded object's address to match. The two regressions use real detached OS processes and production token/identity cleanup. They establish observation behavior, not real-Hopper behavior. The tested candidate uses the current temporary-directory helper and moves this PR's guide additions to docs/client-verification.md, where upstream now owns these instructions. ## Exact source and native evidence Original real-Hopper evidence remains pinned to 8ea0432ffc11d47d2f43fbd4964f48116b4bd4a5, run 45930d25-d485-4ff3-a0bf-0e6286f12329. It is not substituted for later executions. A new execution of the earlier PR revision 97b76aa20afbe2c654d2309175a708f774373234 passed in a private disposable Omarchy 4.0.4 x86-64 VM with Hopper 6.4.2-1 and Node 24.18.0/npm 11.16.0. Run ae4de7ff-dd2a-4c73-88dc-6dbf1ad7c537 completed 2026-10-12T22:13:52.319Z: 172 advertised schemas, 181 successful calls, 63 rejected calls, complete 1,205-item inventories, cancellation/deadline recovery, competing launches, unrelated Hopper preservation and clean shutdown. The configured launcher was restored and the dedicated post-run observer passed. All 2,822 source file digests matched before and after; runtime and source fixtures were built inside the guest. A non-root observer preflight failed closed on an unreadable caller-owned /proc executable before Hopper launched; its report is retained separately. The root run passed without changing that check. Tested candidate, now represented by commit f379bc38824dd061a62d8ae7eb843d9c29551e4e: main ae8051302b5834322fa00cfa31c968ae74ab6ed9 plus patch SHA-256 1a7ca61c6cff56730f2855d363d6e93e3c9615016578479722f63f6aa10e5723. Its separate native run 9e7de373-4686-4820-ae48-801e536589b7 completed 2026-10-12T22:17:02.991Z and passed with 187 schemas/181 successful calls/63 rejected calls and the same cleanup/coverage assertions. All 3,175 archived source-file digests matched before and after. The native run preceded commit creation. All 3,175 exported file digests match the later commit's git archive, including checkout normalization declared by .gitattributes. Native evidence is bound to that source snapshot; it is not a native execution of the final PR head. Unmaterialized optional gitlinks are recorded in provenance and outside the Hopper claim. Both runs report the full literal at 0x402020 as not_observed / decodedObject unverified. The fixture binaries have their own execution-specific digests; no old fixture digest is reused. [Public evidence package](https://gist.github.com/LuisTaffelli/afcb77e914ebaee191c4f59da57a359a) contains 27 remotely verified files: source manifests, execution-specific fixture digests and receipts, runtime identities, full reports, failed preflight, cleanup observations and CI reproduction logs. Public logs remove terminal ANSI formatting only; the index records original and published SHA-256 values. The originally empty final process receipt is represented by an explicitly labeled JSON observation with its original size and digest. Original local evidence is preserved. No binaries, provider documents, VM disks or credentials are included in Git. ## Published revision Current head is 794debe5656f634f54db45eb6b6582be227401bc, integrating main 653067d799591ce2b8fdc84e99c160ac17e2860f without conflicts. The subsequent main merge changes 24 JavaScript/Apple files and tests; it changes no Hopper/provider/verifier or dependency files. Its complete path list and commit/tree bindings are in the public evidence package. No new native run was performed on this final merge. The PR diff remains nine verification, fixture and documentation files. ## Validation and CI diagnosis 26 selected tests, npm run check, docs:check and the pre-push check passed on final head 794debe5. Earlier candidate validation: 21 selected tests, npm run check, docs:check, verify:fixtures (4 fixtures), verify:test-discovery (996 files exactly once), verify:package and npm pack --dry-run passed on the candidate. Package checks are not native verification of an installed npm artifact. The complete local suite/check:pr was not rerun. Historical required CI run 38177777058 remains failed on the earlier revision 97b76aa2. The same two Qwen assertions and one browser assertion reproduced in both exact CI merge4893452b55790e4e362e097beb02e076b5ce345a and baseb777e5d4d8a7b60edad7d5c0eaa56408a4b3f610; five relevant test/producer file digests are identical between them. Qwen expects a raw string instead of the successful Result object. The browser fixture lacks required initiator metadata and therefore creates no request; its not.toBeNull assertion fails to reject undefined. Upstream89f5e489a fixes both fixture contracts; d1dcebce2 subsequently strengthens response occurrence ownership. All 13 selected tests passed on pinned main ae8051302b5834322fa00cfa31c968ae74ab6ed9, and all 21 passed with the tested candidate. The expanded final selection passed all 26 tests. No Qwen/browser correction is added to this PR. The historical red gate remains failed. Fresh [CI run 38317360262](https://github.com/morluto/rea/actions/runs/38317360262) for published head 794debe5656f634f54db45eb6b6582be227401bc completed successfully, including CI required, all six test shards and coverage aggregation. ## Installation and coverage limits The earlier two clean installation attempts stopped at download_failed; the previous cached official-package restoration was separate evidence, not a fresh setup pass. The new uninterrupted verify:setup:linux run passed on the private candidate VM: 93584b53-944b-47cf-a6a4-b0d4ff8a4961, completed 2026-10-12T22:19:38.365Z. Hopper was removed with pacman -R (its prerequisites were retained), the lane used a new empty HOME, and the official download/install path ran without cached-package restoration. The verifier required the read-only plan, approved installation, scoped doctor, source CLI/MCP conformance, modified-launcher rejection, empty repeated setup actions and clean teardown. All 3,175 source hashes still matched afterward; the final Hopper/Xvfb observation was empty and the private VM shut down normally (QEMU exit 0). This is an uninterrupted pass with previously provisioned runtime prerequisites, not a claim about every fresh OS image or the older failed attempts. Native evidence covers this Linux demo build and source CLI/MCP only. macOS and other builds, an installed npm artifact with real Hopper, native decoding of omitted full/non-ASCII literals, internal recognition heuristics, interruption of synchronous native work and saved-database recovery remain unverified. The raw-byte/recognized-fragment observations do not establish a universal native length limit. Passing this PR does not close #339 or #340. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:49 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:42:14 +00:00

[PR #4925] [CLOSED] fix(process): retain kernel-limit descriptor cleanup leases #6678

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4925

No description provided.

Rows
Columns