Repository navigation
docs: pkgops VM-gate increment plan - #75
Merged
Merged
Conversation
…ble-VM proof) Pins the broker record schema (version 1, the 16-field allow-list in runix-audit-broker/src/json.c, the reserved-key list, hard-reject of unknown fields), the exact durable fields pkgops writes (verification mapped into observed/changed/state_changed/observed_failed/observed_reason plus authorized_via/scope/preview -- no schema bump), the per-verb observed object shapes, the disposable-VM proof (reuse the canary-apt harness, swap rab-exercise for real pkgops), the evidence requirements, and the teardown procedure. Splits into Part A (durable record grammar, hermetic) and Part B (the destructive VM proof); pkgops PR #9 stays held until Part B is green. Decisions D1-D7 resolved: map into existing allow-list fields; enrich .verify() with observed + mismatch/read-failure; merge Part A first with #9 held; harness edits as their own commit; authorized_via provenance returned by .authorize() (autonomous = machine-mode grant of an autonomous-class verb); state_changed = the observed pre/post pkgstate diff (S-B), never derived from effect_issued.
Two review blockers on Part A (pkgops PR #10) resolved at the contract: 1. Hold observation keying. An unqualified hold record carries no architecture and can match several selection rows (pkg:amd64 + pkg:i386). The prior rule ("bare package when unqualified") collapsed them to one entry, so a change confined to a second architecture was invisible to the state_changed pre/post diff (while .verify_hold, checking every row, still failed). Pinned: one package:arch entry per matched selection row, radix-ordered on architecture; a no-match target keeps its identity with a null selection. 2. apt.update state_changed. Removed the ambiguity in section 1.4 that read as a functional-effect-derived transition. update reads no per-package or index state, so observed / changed / state_changed are all OMITTED, never inferred from effect_issued. Added the wire-realization note: optional nulls are written by omitting the key (absent == null at the broker), so an update record carries only operation/resource/effect_issued/scope/preview + authorized_via + observed_failed=false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reviewed plan for the VM-gated increment that closes the release gate on pkgops PR #9 (cornball-ai/pkgops#9).
Pins, per the review requirements:
RECORD_SCHEMAinrunix-audit-broker/src/json.c); the reserved-key list; hard-reject of unknown fields;changed/state_changedareT_BOOL,observedis the only object field.verified/verify_detailmap into the existingobserved/changed/state_changed/observed_failed/observed_reasonfields (no schema bump), plusauthorized_via/scope/preview. Per-verbobservedobject shapes fixed in §2.4.deploy/canary-apt/harness, swappingrab-exercisefor realpkgops::apt_<verb>(); run from pinned SHAs of runix/pkgexec/broker/pkgstate/pkgops.schema_invalidgate, a verification-mismatch gate).provision.sh destroy, marker-guarded, VM-only, never the troy-g5 host.Decisions D1-D7 resolved in §8. D6:
authorized_viaprovenance returned by.authorize()(autonomous= a machine-mode grant of an autonomous-class verb). D7 = S-B:state_changedis the observed pre/postpkgstatediff, never derived fromeffect_issued.Companion to the approved contract + implementation plan (#73).