feat(memory): harden jail hydration evidence and readback #227

Closed

clawdie wants to merge 0 commits from clawdie/jail-hydration-lifecycle-metadata into main AGit

pull from: clawdie/jail-hydration-lifecycle-metadata

merge into: clawdie:main

clawdie:main

clawdie:feat/sysctl-posture-oxy-hydration-0.15.1

Conversation 0 Commits - Files changed -

clawdie commented 2026-10-28 21:18:38 +01:00

Owner

Copy link

Summary

Hardens jail hydration evidence and completes the readback path into the Jev-facing envelope.

• Read lineage stamps only after verifying an exact, mounted jail root; unmounted root datasets and unowned parent directories stay unreadable.
• Reject ambiguous ZFS mountpoint matches instead of attaching a parent dataset or its lifecycle tags.
• Use documented plain bastille list output, reconcile jls with the Bastille State column, and fail closed to unknown on unrecognized/conflicting states.
• Make the Bastille config/directory fallback reachable with default configuration, validate listing output, and report discovery failures distinctly from known-empty inventory.
• Read current hasJailObservation links through QueryNodeCapacity, preserve observation timestamps/boot epoch/provenance/uncertainty, and carry them into CapacitySummary and the Boundary 1 envelope.

Regression coverage

• mounted parent dataset with an unmounted separate root dataset: no parent tags or lineage leak
• ambiguous ZFS mountpoints
• unrecognized Bastille state with a running jls entry
• unparseable Bastille listing falling back to a directory or reporting unavailable inventory
• foreign/unmounted lineage files
• failed vs known-empty discovery
• config precedence and explicit config failures
• current-link observation readback through capacity and envelope serialization
• replacement deletion remains covered by the refresh test

Verification

go test ./..., go test -race ./..., go vet ./..., staticcheck ./..., CGO_ENABLED=0 go test ./..., FreeBSD cross-build, git diff --check, and docs gates pass locally.

Known limits

No live FreeBSD/ZFS host execution or complete Oxigraph round trip has been run for this head. The Bastille table parser is covered by fixtures based on the documented 1.4.x format; capture the installed version's bastille list output before merge.

## Summary Hardens jail hydration evidence and completes the readback path into the Jev-facing envelope. - Read lineage stamps only after verifying an exact, mounted jail root; unmounted root datasets and unowned parent directories stay `unreadable`. - Reject ambiguous ZFS mountpoint matches instead of attaching a parent dataset or its lifecycle tags. - Use documented plain `bastille list` output, reconcile `jls` with the Bastille `State` column, and fail closed to `unknown` on unrecognized/conflicting states. - Make the Bastille config/directory fallback reachable with default configuration, validate listing output, and report discovery failures distinctly from known-empty inventory. - Read current `hasJailObservation` links through `QueryNodeCapacity`, preserve observation timestamps/boot epoch/provenance/uncertainty, and carry them into `CapacitySummary` and the Boundary 1 envelope. ## Regression coverage - mounted parent dataset with an unmounted separate root dataset: no parent tags or lineage leak - ambiguous ZFS mountpoints - unrecognized Bastille state with a running `jls` entry - unparseable Bastille listing falling back to a directory or reporting unavailable inventory - foreign/unmounted lineage files - failed vs known-empty discovery - config precedence and explicit config failures - current-link observation readback through capacity and envelope serialization - replacement deletion remains covered by the refresh test ## Verification `go test ./...`, `go test -race ./...`, `go vet ./...`, `staticcheck ./...`, `CGO_ENABLED=0 go test ./...`, FreeBSD cross-build, `git diff --check`, and docs gates pass locally. ## Known limits No live FreeBSD/ZFS host execution or complete Oxigraph round trip has been run for this head. The Bastille table parser is covered by fixtures based on the documented 1.4.x format; capture the installed version's `bastille list` output before merge.

clawdie added 3 commits 2026-10-28 21:18:38 +01:00

feat(memory): hydrate stopped Bastille jails, verified ZFS dataset tags, and uncertainty states into Oxigraph db1f58660e

fix(memory): harden jail discovery and jail observation readback ... eabb8afae8

Gate lineage reads on verified mounted jail roots, reconcile jls and Bastille state conservatively, make the default Bastille config fallback reachable, and carry jail observations plus inventory certainty through QueryNodeCapacity into the Boundary 1 envelope.

Adds regression coverage for foreign/unmounted lineage files, ambiguous mountpoints, conflicting/unknown jail status, failed and known-empty discovery, config precedence, current-link observation readback, and replacement deletion.

fix(memory): close jail discovery uncertainty gaps ... 5278fef707

Require exact root mount ownership before accepting a parent dataset, treat unrecognized Bastille states as unknown even when jls reported the jail, and reject unparseable Bastille listing output so discovery falls back or reports inventory unavailable instead of claiming a known-empty inventory.

Adds regression coverage for a mounted parent dataset with an unmounted separate root dataset, unrecognized Bastille states, and unparseable listing fallback/failure.

clawdie added 1 commit 2026-10-28 21:23:46 +01:00

chore(tokens): refresh Go production token badge 3a5f87854a

clawdie added 1 commit 2026-10-28 22:10:24 +01:00

fix(memory): reject ambiguous Bastille rows without losing valid observations ... 4f77f1408a

Reject whitespace-ambiguous or malformed Bastille rows instead of silently skipping them, preserve already-parsed rows when the table is incomplete, retry the Bastille 1.4.4 all table for Path, and prefer a unique exact jail-root dataset over its container dataset when both are visible.

Adds regression coverage for partial-row preservation, successful and failed fallback, whitespace paths, 1.4.4 default/all formats, VNET IP continuations, and exact-root precedence. Refreshes the Go token badge.

clawdie force-pushed clawdie/jail-hydration-lifecycle-metadata from 4f77f1408a to 53c535b80b 2026-10-28 22:17:37 +01:00 Compare

clawdie closed this pull request 2026-10-30 13:30:44 +01:00

All checks were successful

Hide checks

CI / markdown (pull_request) Successful in 9s

Details

CI / packaging (pull_request) Successful in 1s

Details

CI / python-tests (pull_request) Successful in 20s

Details

CI / mcp-cross-language (pull_request) Successful in 25s

Details

CI / go (pull_request) Successful in 38s

Details

leak-guard / guard (pull_request) Successful in 23s

Details

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/colibri!227

No description provided.