morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #5357] [MERGED] fix(verification): retain Hopper ownership evidence across owner exit #6893

New issue

Closed

opened 2026-11-01 21:43:52 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:43:52 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5357
Author: @gensokyo-dev
Created: 10/20/2026
Status: ✅ Merged
Merged: 10/20/2026
Merged by: @gensokyo-dev

Base: main ← Head: audit/ci-tests-20261020-round2

📝 Commits (1)

3c50d17 fix(verification): retain Hopper ownership evidence across owner exit

📊 Changes

1 file changed (+13 additions, -11 deletions)

View changed files

📝 scripts/lib/real-hopper-owner-exit.mjs (+13 -11)

📄 Description

Summary

Repair the real Linux Hopper owner-exit verifier: scoped cleanup scans require a persistent ownership ledger, but the JavaScript caller omitted it. This made verification fail before it could establish native ownership, even for an empty process list.

The previous unchanged-main failure reported only “process identity could not be revalidated.” On current baseline 58d604330, the actual API reproduces the underlying diagnostic: persistent process ownership evidence owner is required for scoped token scan. Supplying the required ledger makes the empty-list control succeed; the runtime rejection guard remains intact.

Change and boundary impact

Own one ProcessOwnershipEvidenceOwner for each graceful/SIGKILL session and retain it across the active scan and every post-exit poll.
Require positive token-verified ownership coverage while Hopper is live. The previous cleaned: false assertion also accepted inability to inspect ownership.
Retain the complete structured cleanup failure in assertion diagnostics.

One verifier file. No production runtime, authority, timeout, retry, grace, schema, catalog or installation changes. This ordinary verification repair needs no new capability-scope decision.

Executed validation

87 CI/report/discovery/selection controls passed / nine files, including missing/duplicate inventory and failed source/shard controls. Discovery finds 1,714 files exactly once.
51 process-ownership controls passed / four files. Script syntax and real module import checks pass. npm run check passes all static/module-boundary/architecture gates.
Published head 3c50d17fe: Ubuntu 24.04 clean setup, CLI and MCP passed. It runs the complete real-Hopper verifier, including graceful and SIGKILL owner exit, target reacquisition, unrelated-process sentinel survival, modified-launcher rejection and idempotent setup. Its final report is status: verified, with verified process lineage and zero remaining descendants.

The independent self-hosted job never received a runner; the manual workflow was canceled after retaining the hosted job's success. This is a successful hosted-job qualification, not a claim that the whole manual workflow passed. No local or macOS engine qualification is claimed. Greptile reviewed this exact SHA at 5/5 with no actionable findings. The hosted CI checks record the deterministic matrix results for the same revision; merge remains conditioned on successful required checks. Codex automated review is unavailable because the repository review quota is exhausted; that failure is not a code finding.

Local heavy work is serialized on two CPUs. The 87-case task, including a cold runtime build, took 73.7 s elapsed / 87.3 s CPU / 3,419 MiB peak sampled family RSS; static checking took 116.1 s / 171.1 s / 4,783 MiB. RSS sampled every 100 ms may double-count shared pages and miss brief/reparented children. Cache/host state is uncontrolled; agent tokens are unmeasured. No speedup is claimed.

Author readiness

Human owner: @gensokyo-dev

The owner explicitly delegated these declarations and authorized opening ready, following CI/review and merging in this session. Codex reviewed the final diff and evidence; independent human review was not observed.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5357 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/20/2026 **Status:** ✅ Merged **Merged:** 10/20/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `audit/ci-tests-20261020-round2` --- ### 📝 Commits (1) - [`3c50d17`](https://github.com/morluto/rea/commit/3c50d17fe45dd0fe1544e3774daa5b9ab2472bb0) fix(verification): retain Hopper ownership evidence across owner exit ### 📊 Changes **1 file changed** (+13 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `scripts/lib/real-hopper-owner-exit.mjs` (+13 -11) </details> ### 📄 Description ## Summary Repair the real Linux Hopper owner-exit verifier: scoped cleanup scans require a persistent ownership ledger, but the JavaScript caller omitted it. This made verification fail before it could establish native ownership, even for an empty process list. The [previous unchanged-main failure](https://github.com/morluto/rea/actions/runs/39359253507/job/118421276676) reported only “process identity could not be revalidated.” On current baseline `58d604330`, the actual API reproduces the underlying diagnostic: `persistent process ownership evidence owner is required for scoped token scan`. Supplying the required ledger makes the empty-list control succeed; the runtime rejection guard remains intact. ## Change and boundary impact - Own one `ProcessOwnershipEvidenceOwner` for each graceful/SIGKILL session and retain it across the active scan and every post-exit poll. - Require positive token-verified ownership coverage while Hopper is live. The previous `cleaned: false` assertion also accepted inability to inspect ownership. - Retain the complete structured cleanup failure in assertion diagnostics. One verifier file. No production runtime, authority, timeout, retry, grace, schema, catalog or installation changes. This ordinary verification repair needs no new capability-scope decision. ## Executed validation - **87 CI/report/discovery/selection controls passed / nine files**, including missing/duplicate inventory and failed source/shard controls. Discovery finds **1,714 files exactly once**. - **51 process-ownership controls passed / four files**. Script syntax and real module import checks pass. `npm run check` passes all static/module-boundary/architecture gates. - Published head `3c50d17fe`: [Ubuntu 24.04 clean setup, CLI and MCP](https://github.com/morluto/rea/actions/runs/39375375149/job/118472222633) **passed**. It runs the complete real-Hopper verifier, including graceful and SIGKILL owner exit, target reacquisition, unrelated-process sentinel survival, modified-launcher rejection and idempotent setup. Its final report is `status: verified`, with verified process lineage and zero remaining descendants. The independent self-hosted job never received a runner; the manual workflow was canceled after retaining the hosted job's success. This is a successful hosted-job qualification, not a claim that the whole manual workflow passed. No local or macOS engine qualification is claimed. Greptile reviewed this exact SHA at **5/5 with no actionable findings**. The hosted CI checks record the deterministic matrix results for the same revision; merge remains conditioned on successful required checks. Codex automated review is unavailable because the repository review quota is exhausted; that failure is not a code finding. Local heavy work is serialized on two CPUs. The 87-case task, including a cold runtime build, took **73.7 s elapsed / 87.3 s CPU / 3,419 MiB peak sampled family RSS**; static checking took **116.1 s / 171.1 s / 4,783 MiB**. RSS sampled every 100 ms may double-count shared pages and miss brief/reparented children. Cache/host state is uncontrolled; agent tokens are unmeasured. No speedup is claimed. ## Author readiness Human owner: @gensokyo-dev The owner explicitly delegated these declarations and authorized opening ready, following CI/review and merging in this session. Codex reviewed the final diff and evidence; independent human review was not observed. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:43:52 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6893

No description provided.

Rows
Columns