From 68e8c1439a1c900b5b84e639dc7f29adddf2a06e Mon Sep 17 00:00:00 2001 From: Peter van Tol Date: Tue, 29 Sep 2026 16:03:26 +0200 Subject: [PATCH 1/2] Record published EP 2.3.106 receipt and pending native proof --- .../ENGINEERING_PLATFORM_ROADMAP.md | 9 ++-- .../EP_SERVER_MACOS_NONROOT_2_3_105.md | 8 ++-- .../EP_SERVER_MACOS_NONROOT_2_3_106.md | 43 +++++++++++++++++++ 3 files changed, 54 insertions(+), 6 deletions(-) create mode 100644 docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md diff --git a/docs/development/ENGINEERING_PLATFORM_ROADMAP.md b/docs/development/ENGINEERING_PLATFORM_ROADMAP.md index a3b4bda0..abae6fbd 100644 --- a/docs/development/ENGINEERING_PLATFORM_ROADMAP.md +++ b/docs/development/ENGINEERING_PLATFORM_ROADMAP.md @@ -35,9 +35,12 @@ passed an adapted native preserve/restore rerun under UID 20000 with a real initial foreground Server and a filesystem-only service adapter. Preserve retained identity/data; restore stayed inactive and required provider reverification. The released provisioner had inherited an inaccessible caller -working directory during the first attempt; a source correction binds its venv -and pip children to the account-owned slot. The published 2.3.105 wheel remains -unchanged. Neither rerun claims launchd, reboot or live provider authentication. +working directory during the first attempt. The correction is now in the +[published 2.3.106 release](../engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md), +which binds its venv and pip children to the account-owned slot; native +published-wheel requalification of 2.3.106 is still pending. The 2.3.105 +wheel remains unchanged. Neither 2.3.105 rerun claims launchd, reboot or live +provider authentication. No machine-readable DAG in this repository contains OI-2 or OI-5 IDs; no new DAG node or parallel backlog is created. diff --git a/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_105.md b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_105.md index 4977148d..6ad57caa 100644 --- a/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_105.md +++ b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_105.md @@ -86,9 +86,11 @@ The first native lifecycle attempt under UID 20000 stopped during the product-owned immutable runtime-slot installation, before preserve/restore. The actual pip traceback showed `PermissionError` at `os.getcwd()` because the released provisioner inherited its caller's inaccessible working -directory. The pending source correction runs both venv creation and wheel -installation from the account-owned runtime slot. The exact 2.3.105 wheel is -unchanged; its lifecycle rerun used an accessible disposable working directory. +directory. The correction released in +[2.3.106](EP_SERVER_MACOS_NONROOT_2_3_106.md) runs both venv creation and +wheel installation from the account-owned runtime slot. The exact 2.3.105 +wheel is unchanged; its lifecycle rerun used an accessible disposable working +directory. That rerun executed the released wheel under UID/GID 20000 with a real initial foreground Server and a filesystem-only service adapter. Product preserve diff --git a/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md new file mode 100644 index 00000000..bb016912 --- /dev/null +++ b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md @@ -0,0 +1,43 @@ +# EP Server 2.3.106 published-wheel macOS non-root follow-up + +This is the release follow-up for LANE_2 registration revision 27 and +assignment `L2-EP-NONROOT-RUNTIME-CONFORMANCE-V1-20260929`. The owning +operator record is [Forge #142](https://github.com/pcvantol/forge/issues/142). +The [2.3.105 qualification](EP_SERVER_MACOS_NONROOT_2_3_105.md) established +the original native foreground/API and adapted lifecycle boundary. This page +binds the corrected immutable release to its own registry and native evidence. + +## Published artifact identity + +| Field | Readback | +| --- | --- | +| Source | Protected main `7b99b578153ae5d72372a09db194306b49ec9f9c` (EP PR #325) | +| Release | `engineering-platform-v2.3.106`, `RELEASE_COMPLETE` | +| Release-complete receipt SHA-256 | `8ac24fcc41fbf41d8e30efbba1578a95599f50f1cd665d72fc96fe402d260d05` | +| PyPI wheel SHA-256 | `9d25a53d75b61d43d665d9f8290a968dc3e63d12d2037eae8ef31ee810eb6694` | +| PyPI sdist SHA-256 | `df74342e729f5f98378c40ffc35cb12b3ad53d0d4de0c602e260ff697c880058` | +| Runtime | macOS arm64, Python 3.14.7; wheel requires `>=3.14,<3.15` | + +The exact-main [production release workflow](https://github.com/pcvantol/engineering-platform/actions/runs/36577447405) +completed production-wheel, dashboard, API, security, coverage, PyPI +publication, registry readback and cleanup jobs. Its terminal receipt records +`RELEASE_COMPLETE`, matching wheel/sdist registry digests and completed +cleanup. An independent direct PyPI wheel download matched the wheel digest +above, and a new noneditable Python 3.14 venv outside the checkout reported +installed version 2.3.106 from site-packages. + +## Corrected boundary + +The released 2.3.105 provisioner passed an inaccessible caller working +directory to its venv/pip children. Under a real non-root UID, pip failed at +`os.getcwd()` with `PermissionError` before any preserve/restore transition. +The 2.3.106 source binds both child working directories to the account-owned +runtime slot. The published wheel contains both `cwd=slot.root` call sites. + +Native foreground/API and adapted lifecycle requalification of these +**published 2.3.106 bytes** is pending. The lifecycle rerun must start from +an intentionally inaccessible, assignment-owned `0700` directory and prove +that the non-root process cannot call `os.getcwd()` there before the product +creates its runtime slot. No checkout import, `Requires-Python` bypass, +mocked health response, macOS service installation, reboot or live provider +authentication is acceptable as positive evidence. From 488f248b44ef914866658dd00e5768361f005b34 Mon Sep 17 00:00:00 2001 From: Peter van Tol Date: Tue, 29 Sep 2026 16:19:14 +0200 Subject: [PATCH 2/2] Record published 2.3.106 native non-root qualification --- .../ENGINEERING_PLATFORM_ROADMAP.md | 10 ++-- .../EP_SERVER_MACOS_NONROOT_2_3_106.md | 49 ++++++++++++++++--- 2 files changed, 48 insertions(+), 11 deletions(-) diff --git a/docs/development/ENGINEERING_PLATFORM_ROADMAP.md b/docs/development/ENGINEERING_PLATFORM_ROADMAP.md index abae6fbd..19d2961e 100644 --- a/docs/development/ENGINEERING_PLATFORM_ROADMAP.md +++ b/docs/development/ENGINEERING_PLATFORM_ROADMAP.md @@ -37,10 +37,12 @@ retained identity/data; restore stayed inactive and required provider reverification. The released provisioner had inherited an inaccessible caller working directory during the first attempt. The correction is now in the [published 2.3.106 release](../engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md), -which binds its venv and pip children to the account-owned slot; native -published-wheel requalification of 2.3.106 is still pending. The 2.3.105 -wheel remains unchanged. Neither 2.3.105 rerun claims launchd, reboot or live -provider authentication. +which binds its venv and pip children to the account-owned slot. The actual +published 2.3.106 wheel then passed the same real-UID foreground/API matrix +and an adapted lifecycle rerun from an intentionally inaccessible inherited +cwd, preserving identity/data and leaving restore inactive for provider +reverification. The 2.3.105 wheel remains unchanged. Neither release's native +evidence claims launchd, reboot or live provider authentication. No machine-readable DAG in this repository contains OI-2 or OI-5 IDs; no new DAG node or parallel backlog is created. diff --git a/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md index bb016912..5fe1b2af 100644 --- a/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md +++ b/docs/engineering/EP_SERVER_MACOS_NONROOT_2_3_106.md @@ -34,10 +34,45 @@ directory to its venv/pip children. Under a real non-root UID, pip failed at The 2.3.106 source binds both child working directories to the account-owned runtime slot. The published wheel contains both `cwd=slot.root` call sites. -Native foreground/API and adapted lifecycle requalification of these -**published 2.3.106 bytes** is pending. The lifecycle rerun must start from -an intentionally inaccessible, assignment-owned `0700` directory and prove -that the non-root process cannot call `os.getcwd()` there before the product -creates its runtime slot. No checkout import, `Requires-Python` bypass, -mocked health response, macOS service installation, reboot or live provider -authentication is acceptable as positive evidence. +## Native published-wheel requalification + +Both local rerunners used the exact PyPI wheel digest above in a new +noneditable Python 3.14.7 venv outside the checkout. The foreground/API runner +(SHA-256 `073ff8bfd8b38c52d6140bde782027a28e5c29ad6ba0dd6098b41ffe84bb1b9e`) +returned `PASS_WITH_DECLARED_LIMITS` under actual UID/GID 20000. Live process +inventory showed that UID/GID and the macOS Python 3.14 executable running +`-I -m engineering_platform.server serve`; real HTTP 200 health returned the +expected disposable instance, version 2.3.106 and `OBSERVED` exact PyPI wheel +digest. The installed package resolved from site-packages rather than source. + +The product-created scoped API consumer authenticated exact instance and +consumer readback. Missing bearer, wrong scope and wrong expected instance +were rejected. Two disposable live instances retained distinct identities; +normal exact-child stop/start retained the instance, release and scoped API +identity. Missing Codex/GitHub evidence stayed `UNAVAILABLE`, not `READY`. +The test UID could not mutate the installed package or a synthetic file owned +by another UID; a nonwritable own data parent was rejected. Product config +selected the test account's private HOME, not the interactive user's HOME or +PATH. The cross-UID case used a synthetic `0600` fixture, not another EP +Server. The exact test Server children were stopped. + +The adapted lifecycle runner (SHA-256 +`2c31ba689e73b4e1866bb7bbc8972e7c34cf41c05ec030b5f5d022f299299f93`) +started from an assignment-owned directory with mode `0700` that was +inaccessible to UID 20000. Before product work it required `os.getcwd()` to +raise `PermissionError`; an accessible inherited cwd would have failed the +test. Despite that negative precondition, the published wheel installed the +exact runtime slot and started a real initial foreground Server. Product +preserve returned `UNINSTALLED_DATA_PRESERVED`, retained identity/data and +stopped the child. Both deliberately failing synthetic provider readbacks +were rejected. Restore returned +`RESTORED_REQUIRES_PROVIDER_REVERIFICATION`, `ready=false` and service not +loaded, with no automatic provider-auth promotion. Its result was +`PASS_ADAPTED_LIFECYCLE_WITH_REAL_INITIAL_SERVER` under UID/GID 20000. + +The service adapter wrote only to the disposable testroot; it did not install +a LaunchDaemon or LaunchAgent. No physical reboot or live provider login was +performed. These results do not establish full installer acceptance. An +independent post-run process/listener check found no test-UID process or +EP/Python TCP listener; the tokenless test account was retained safely for +the bounded assignment cleanup/readback.