Idunn

GameCult/Idunn

Watch

Fork 0

Commit graph

64d63cb417 Merge steward orders 1 (r3): an order is one systemd job; refusal reads the named unit only main Meta Vens 2026-11-02 23:57:39 +01:00
77e2295e97 Steward orders: refuse Upholds and ConsistsOf units, pin the rule's gaps, README names the residuals hands/steward-orders-1 Meta Vens 2026-11-02 23:32:30 +01:00
fb1e7b5dd9 Steward orders: README states the one-job rule; pin the end-to-end argv Meta Vens 2026-11-02 22:42:52 +01:00
8ebe0208a6 Steward orders: pin the one-job rule on the real unit set and a real user manager Meta Vens 2026-11-02 22:41:56 +01:00
a859914b0b Steward orders: run every unit verb as one job and check only the named unit Meta Vens 2026-11-02 22:40:58 +01:00
4894ad20df README: an order's transaction follows emergency actions and OnFailure/OnSuccess; stopped boot units are refused Meta Vens 2026-11-02 21:52:41 +01:00
879b76a842 Steward orders: pin every emergency action spelling to its target Meta Vens 2026-11-02 21:50:23 +01:00
631fb7836b Steward orders: pin the new show properties; the unknown-action probe counts runs instead of expecting none Meta Vens 2026-11-02 21:29:13 +01:00
d29bf93be6 Steward orders: refuse a start or stop whose unit ends by emergency action or isolates; boot and recovery units are never started from stopped Meta Vens 2026-11-02 21:26:29 +01:00
d9710c988a Steward orders: the ledger reads an order only under its own schema too Meta Vens 2026-11-01 06:35:43 +01:00
caacbb4bba Steward orders: the end-to-end test waits 10 s for its posts Meta Vens 2026-11-01 06:35:31 +01:00
9653d270e5 Steward orders: pin the ledger schema guards, invocation ids and post backoff; tests fail fast instead of waiting Meta Vens 2026-11-01 06:16:04 +01:00
8a1beb5c87 README: an order is gated by the steward bound at execution; the socket is the steward's; root reads Meta Vens 2026-11-01 05:35:30 +01:00
7e15bf1a7b Steward orders: the Synapse deadline test fails instead of hanging when the deadline is gone Meta Vens 2026-11-01 05:33:23 +01:00
572f9e6aa4 Steward orders: the end-to-end test keeps serve's umask until it has read control.cc Meta Vens 2026-11-01 05:31:34 +01:00
56edad95c1 Steward orders: one steward gate for fresh and recovered orders; the orders unit leaks no group or umask; root reads; kernel-attested issuer; end-to-end serve test Meta Vens 2026-11-01 05:03:17 +01:00
ca439a29ff Pin the systemctl show property list and unquoted backslashes Meta Vens 2026-11-01 04:17:12 +01:00
27ca875194 Steward orders tests: clear four clippy hits in the module Meta Vens 2026-11-01 03:53:41 +01:00
be3b95bc21 Import BTreeMap for the transaction facts cache Meta Vens 2026-11-01 03:50:20 +01:00
cea17c06a7 README: a unit order is refused by the systemd transaction; a package order installs only what it names Meta Vens 2026-11-01 03:49:36 +01:00
ec6222e2a1 Steward unit orders: refuse by the systemd transaction, install exactly the named packages Meta Vens 2026-11-01 03:49:26 +01:00
7d5cd85728 Reword a test comment so the no-brake-release tripwire reads clean Meta Vens 2026-11-01 02:33:12 +01:00
1a3634e046 Document idunn order and add the idunn-orders unit Meta Vens 2026-11-01 02:33:02 +01:00
e50a721dbc Steward orders: typed package, unit and deploy orders from one steward, in a sibling root unit Meta Vens 2026-11-01 02:33:01 +01:00
e4fd4ae09c Research: steward orders on Windows hosts (JEA, Ansible win_*, Intune Remediations and EPM, Windows OpenSSH, PIM, CyberArk, Teleport) and Starfire/Raven body facts imagination/steward-orders-prior-art Meta Vens 2026-10-31 07:59:13 +01:00
ecb2ae0995 Research: steward orders prior art (nix-daemon, Postfix pickup, Salt, AWX, deploy-rs, break-glass, two-person rule) Meta Vens 2026-10-31 06:32:06 +01:00
024f2d7a09 Workload: incarnation units are collected when they end, so a failed candidate no longer stays loaded and marks the host degraded Meta Vens 2026-10-29 22:54:26 +01:00
8400d0712f Merge idunn/runner-failure-evidence: a failed runner keeps its evidence Meta Vens 2026-10-25 08:32:18 +01:00
1518cfb13c drivers test: read the kept evidence through show_status, the one status sink idunn/runner-failure-evidence Meta Vens 2026-10-25 07:18:51 +01:00
549f4be093 Runner evidence: one allowlist sink for status, quarantine only on a decode failure, a displaced set-aside is journaled Meta Vens 2026-10-25 07:16:09 +01:00
4a68df520f Runner evidence: set an undecodable store aside; escape bidi and pin C1 in status Meta Vens 2026-10-25 03:15:45 +01:00
134c1fb5a2 drain_tail tests: a scripted reader pins the Interrupted guard Meta Vens 2026-10-25 03:15:45 +01:00
54a75ef9b0 Runner failure regression: a stdout-only report is kept with an empty stderr Meta Vens 2026-10-25 02:36:34 +01:00
7ef31ee699 Runner failure engine tests: declare readiness, read both control stores Meta Vens 2026-10-25 02:18:06 +01:00
22bd904ed9 Runner failure tests: named step, bounded tail, never echoed, private store Meta Vens 2026-10-25 02:16:03 +01:00
ef82355bab Runner failure: a typed, bounded step failure kept in runner-evidence.cc Meta Vens 2026-10-25 02:11:14 +01:00
78086705a0 deploy-provenance map: runner failure evidence (body facts R1-R8) Meta Vens 2026-10-25 02:04:37 +01:00
804ed759c9 Merge idunn/isolation-credential-evidence: delivered credentials, not LoadCredential Meta Vens 2026-10-24 16:05:26 +02:00
dfdc226c25 Idunn credential rule: an unlistable credential directory is a refusal idunn/isolation-credential-evidence Meta Vens 2026-10-24 15:14:15 +02:00
ae6a1bea55 Idunn: judge workload credentials from the delivered directory, not LoadCredential Meta Vens 2026-10-24 14:54:15 +02:00
def0b78378 Fixtures: systemd 257 show captures and pre-cut observation records Meta Vens 2026-10-24 14:53:15 +02:00
69eb3e6d6f deploy-provenance map: isolation credential evidence (body facts I1-I8) Meta Vens 2026-10-24 14:51:10 +02:00
112a7a5ebb Idunn unit: Vili's roots are optional so a missing target cannot stop Idunn Meta Vens 2026-10-24 00:15:16 +02:00
a3c6386aa4 Grant Idunn Vili's runtime, state and release roots Meta Vens 2026-10-24 00:14:39 +02:00
d3222e5724 Merge idunn/tree-executable-members: tree artifacts declare executable members Meta Vens 2026-10-23 23:52:27 +02:00
e8c4c69728 Seal tests: refused links whose targets resolve (absolute, escaping, after-a-name; file and directory) idunn/tree-executable-members Meta Vens 2026-10-23 23:26:50 +02:00
68d6f96808 Seal: one seal_artifact for both targets; link containment decided at seal by a shape rule Meta Vens 2026-10-23 21:57:07 +02:00
07616697af deploy-provenance map: link containment rule, host targets, shared seal path (r2) Meta Vens 2026-10-23 21:54:00 +02:00
fd040f09c1 Tests: an io error other than NotFound is not reported as a missing member Meta Vens 2026-10-23 20:28:15 +02:00
76cec0b540 Tests: the sealed-mode helper no longer redefines the module's existing mode_of Meta Vens 2026-10-23 19:54:35 +02:00
04ff2c8ce3 README: a directory artifact is sealed 0444 except its executable_members Meta Vens 2026-10-23 19:53:16 +02:00
022dbece5b Directory artifacts declare executable_members; the seal checks them, the receipt carries them, harden seals exactly those 0555 Meta Vens 2026-10-23 19:53:16 +02:00
332dbd0149 deploy-provenance map: tree executable members (body facts, rationale) Meta Vens 2026-10-23 19:42:34 +02:00
d74ac8da5c Launcher: presence freshness treats a stamp after the reading as age zero; pin the bound literally gamecult-chat/idunn-foreign-workloads Meta Vens 2026-10-23 15:01:56 +02:00
d111986093 Launcher: pin deadline clock sources, read presence freshness in a race-free order, bound declared durations Meta Vens 2026-10-23 14:23:28 +02:00
06782d38f2 idunn-launch tests: the presence tripwire trips on the monotonic read, before any lock is held Meta Vens 2026-10-23 12:27:38 +02:00
5d8f7e18c5 idunn-launch: freshness, deadlines and the probe schedule run on a monotonic clock Meta Vens 2026-10-23 12:26:22 +02:00
b5d13652e1 idunn-launch tests: the first Active probe is also held to the refresh cadence Meta Vens 2026-10-23 04:50:09 +02:00
6b1d14d159 idunn-launch tests: an Active child is probed at the refresh cadence Meta Vens 2026-10-23 04:43:04 +02:00
2ea0572a4c Docs: member connection limit and the cached presence answer Meta Vens 2026-10-23 04:34:28 +02:00
1207f21948 Real-nginx tests report how many challenges were answered Meta Vens 2026-10-23 04:34:14 +02:00
60b64e283d Real-nginx tests stop nginx through nginx so its workers do not hold the test's pipe Meta Vens 2026-10-23 04:33:23 +02:00
d6ebd328e1 Fix route limit bound (nginx allows below 65536); the dead-acceptor test kills the presence thread through the clock Meta Vens 2026-10-23 04:16:44 +02:00
c38bb36560 Fix route limit bound (nginx allows below 65536); the dead-acceptor test kills the presence thread through the clock Meta Vens 2026-10-23 04:15:50 +02:00
e5294db40c idunn-launch: a challenge answers from the lifecycle's last probe, stale or failed reads degraded; tests bound their waits and pin startup timeout and heartbeat cadence Meta Vens 2026-10-23 04:12:57 +02:00
36114b8b7b Idunn routes tests: the rendered member block pins its limit zone; real-nginx flood tests prove presence stays answerable Meta Vens 2026-10-23 04:12:56 +02:00
2218ffb8a8 Idunn routes: the member server block renders a limit_conn on a per-route zone; [route.member].max_connections defaults to 128 Meta Vens 2026-10-23 04:10:12 +02:00
b379fbd700 Tests kill mutation survivors: each owned-name site is pinned alone, the member range below the route's is accepted, a challenge near the frame bound is answered; accept errors share one backoff Meta Vens 2026-10-23 01:45:19 +02:00
9173a0e8e6 idunn-launch answers presence only: the splice, the unix child endpoint and --listener are deleted; the child binds the member bind and the probe reaches it over TCP Meta Vens 2026-10-23 01:28:30 +02:00
7805c0aa9a Idunn routes: an optional [route.member] renders a second nginx server block and sets GAMECULT_IDUNN_MEMBER_BIND; Idunn-owned launch names live in one list Meta Vens 2026-10-23 01:18:26 +02:00
e2dee7c16a idunn-launch tests: the inherited lease lock must stay held for a second, so a concurrent fork cannot mask a missing descriptor Meta Vens 2026-10-23 00:15:33 +02:00
8246de7c37 idunn-launch tests: lock-release wait tolerates a concurrent fork; health probe test reads the request line, not a 64-byte read Meta Vens 2026-10-22 23:26:35 +02:00
d36786f76c idunn-launch: credentials only under CREDENTIALS_DIRECTORY, bounded route acceptor, lease lock inherited by the child, startup probe rules pinned Meta Vens 2026-10-22 23:16:42 +02:00
9c69d00641 Tests kill survivors: grant binding and holder custody, parse fields, credential names, env credentials, Odin endpoint, half-close splice, heartbeat pacing, SIGTERM escalation Meta Vens 2026-10-22 20:48:29 +02:00
0e09488c19 idunn-launch tests: wait_until takes FnMut Meta Vens 2026-10-22 20:09:26 +02:00
d94150d396 idunn-launch: release root is the launcher's own release; docs for foreign workloads; probe, spawner and authority tests Meta Vens 2026-10-22 19:58:21 +02:00
6866d75536 idunn-launch tests: lease gate, foreign lease, lease loss, stateless, route challenge, verbatim splice, closed placeholders, child exit (unbuilt) Meta Vens 2026-10-22 19:10:58 +02:00
b9f27ce1e7 idunn-launch: presence launcher, lease hold, closed-set config renderer, route acceptor (unbuilt) Meta Vens 2026-10-22 18:53:29 +02:00
491459e6a0 State kind external-directory: process-owned directory, lease-gated like external-file Meta Vens 2026-10-22 18:47:20 +02:00
6e2a31cf31 Body map after reincarnation cut 2: two slots, take_target, forward retry, operator-required Meta Vens 2026-10-20 02:40:55 +02:00
2f8671ac35 Reincarnation map: cut 2 installed Meta Vens 2026-10-20 02:36:25 +02:00
dbbdbf12fe Merge idunn/reincarnation-c2: phase-split handover, owner deadlines, forward retry, continuity yields Meta Vens 2026-10-20 02:36:24 +02:00
8760a4fab3 A boot lift that errs fails closed idunn/reincarnation-c2 Meta Vens 2026-10-20 01:51:57 +02:00
c4edc66c48 The boot lift yields to a Deploy by the continuity's own yield test Meta Vens 2026-10-20 01:50:46 +02:00
b993615c69 Negative tests: the lift must not yield to a braked waiting Deploy Meta Vens 2026-10-20 01:47:48 +02:00
b119e500ad c2d fix 2/2: a continuity yields only while unproven, and only to a Deploy that can move Meta Vens 2026-10-19 21:43:34 +02:00
04389e6afc c2d fix 1/2: negative tests, no yield to a serving continuity or a braked Deploy Meta Vens 2026-10-19 21:38:10 +02:00
1beca61ac4 c2c fix 3/3: the refusal table's recorded-withdrawal case ends at the lift Meta Vens 2026-10-19 21:31:36 +02:00
35d9c7fcf8 c2c fix 2/3: the lift defers on an observe error; the retry exit is worded from the driver Meta Vens 2026-10-19 21:30:18 +02:00
11f7fdbf09 c2c fix 1/3: negative test, a lift that cannot observe must not let the abort stop the candidate Meta Vens 2026-10-19 21:28:06 +02:00
81bfb03712 route-continuity-target invariant 5: the continuity yields to a deployment awaiting the handover Meta Vens 2026-10-19 20:11:10 +02:00
4e66a65758 c2d stateful yield test: drop the Fencing half the seeded Deploy cannot honestly assert Meta Vens 2026-10-19 20:10:18 +02:00
09bd127643 c2d: stateful yield test, an Odin-shaped continuity yields its lease to a waiting Deploy Meta Vens 2026-10-19 20:09:28 +02:00
f79deecdb7 c2d tests: the helper stops short of the deadline; each test passes it Meta Vens 2026-10-19 20:07:30 +02:00
fd6e3e65af c2d yield table: show how row (i) ends Meta Vens 2026-10-19 20:06:48 +02:00
a868321259 c2d yield table: name the row an error comes from Meta Vens 2026-10-19 20:06:00 +02:00
196e0dc884 c2d: a resolver write spends the resume backoff; the boot lift leaves a yield Meta Vens 2026-10-19 20:03:48 +02:00
4f68809f0b Continuity yields to a Deploy awaiting the handover (ruling continuity-yields-to-deploy) Meta Vens 2026-10-19 19:59:37 +02:00
a7ad3de559 c2d negative: a waiting Deploy must land over a forward-retrying continuity past its deadline Meta Vens 2026-10-19 19:58:09 +02:00
e5298584a4 Merge origin/main (bounded_detail hotfix) into idunn/reincarnation-c2 Meta Vens 2026-10-19 19:34:20 +02:00