From 0f762ad6b67675356389cc546421a1c46ad5a736 Mon Sep 17 00:00:00 2001 From: mptyl Date: Tue, 18 Aug 2026 15:26:23 +0200 Subject: [PATCH] docs(auth): record final review fix round 1 evidence --- .artifacts/task-15/automated-gates.json | 116 +++++++------ .../task-15-report.md | 43 ++--- .../fix-round-1-report.md | 162 ++++++++++++++++++ .../task-4-report.md | 34 +++- PROJECT_STATE.md | 62 ++++--- 5 files changed, 311 insertions(+), 106 deletions(-) create mode 100644 .superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md diff --git a/.artifacts/task-15/automated-gates.json b/.artifacts/task-15/automated-gates.json index d43db3c2..119ecba2 100644 --- a/.artifacts/task-15/automated-gates.json +++ b/.artifacts/task-15/automated-gates.json @@ -2,8 +2,8 @@ "schema": "thothii-task4-certification-v1", "generated_on": "2026-08-18", "started_at_utc": "2026-08-18T09:26:00Z", - "ended_at_utc": "2026-08-18T09:48:36Z", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "ended_at_utc": "2026-08-18T13:18:56Z", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", "source_immutability": { "status": "PASS", "tracked_changes_after_freeze": false, @@ -15,6 +15,7 @@ "task2": "5f9a3ae066a060b43a11a959b60a1efadd1c2425", "task3": "0d8e707533fada938c99eb06f8457150e7ef2b40", "task3_follow_up": "b31b27e5845ffd3adf311429367319beaba263c7", + "fix_round_1_source": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", "historical_task15_final": "74b062f1a737103524cbe706346cfd65f87cdfd1" }, "versions": { @@ -26,39 +27,36 @@ "retained_report": ".superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md", "task4_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md", "workflow": { - "run_id": "32122302381", - "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381", + "run_id": "32141428407", + "url": "https://github.com/mptyl/ThothII/actions/runs/32141428407", "event": "workflow_dispatch", - "head_sha": "b31b27e5845ffd3adf311429367319beaba263c7", + "head_sha": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", "status": "completed", "conclusion": "failure", "windows_job": { "name": "Windows clone and Compose contract", - "job_id": "95665197885", - "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885", + "job_id": "95724751282", + "url": "https://github.com/mptyl/ThothII/actions/runs/32141428407/job/95724751282", "conclusion": "failure", "native_step": "Run native Windows retained-capability tests", - "native_step_conclusion": "failure", - "command": "go test ./internal/safeio ./internal/backup -count=1", - "requested_packages": ["internal/safeio", "internal/backup"], - "executed_packages": ["internal/safeio", "internal/backup"], - "not_executed_packages": ["internal/authstorage"], - "focused_tests_observed": [ - "TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion", - "TestRemoveCanonicalPrivateClaimPreservesOrphan", - "TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup" - ], - "failure_categories": [ - "safeio retained-capability tests failed with unsafe file", - "backup retained-staging tests failed with unsafe file", - "backup TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup timed out after 10m0s", - "some backup fixture tests could not read their external-secret declarations" - ] + "native_step_conclusion": "success", + "command": "go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1", + "requested_packages": ["internal/safeio", "internal/backup", "internal/authstorage"], + "executed_packages": ["internal/safeio", "internal/backup", "internal/authstorage"], + "not_executed_packages": [], + "package_results": { + "internal/safeio": "PASS (8.230s)", + "internal/backup": "PASS (5.195s)", + "internal/authstorage": "PASS (8.383s)" + }, + "failed_step": "Verify Windows clone contract", + "failure_category": "baseline_powershell_parser", + "failure_detail": "scripts/test-windows-clone-contract.ps1:208 parses $remoteYaml: as an invalid variable reference" }, "lf_compose_docs_typescript_job": { "name": "LF, Compose, docs, and TypeScript", - "job_id": "95665197839", - "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197839", + "job_id": "95724751205", + "url": "https://github.com/mptyl/ThothII/actions/runs/32141428407/job/95724751205", "conclusion": "failure", "failed_step": "Verify Compose and installation contracts", "category": "baseline_ci_contract", @@ -67,14 +65,23 @@ }, "linux_docker_job": { "name": "Linux Docker deployment and rollback", - "job_id": "95665197846", - "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197846", + "job_id": "95724751356", + "url": "https://github.com/mptyl/ThothII/actions/runs/32141428407/job/95724751356", "conclusion": "failure", "failed_step": "Run unified deployment smoke", "category": "infrastructure_prerequisite", "detail": "Task 13 smoke failed before deployment because rg is required", "cleanup": "PASS", "image_manifest": "not_generated" + }, + "windows_docker_startup_job": { + "name": "Native Windows Docker Desktop/WSL2 startup", + "job_id": "95724752028", + "url": "https://github.com/mptyl/ThothII/actions/runs/32141428407/job/95724752028", + "status": "NOT_RUN", + "classification": "BLOCKED", + "workflow_conclusion": "skipped", + "reason": "workflow conditions skipped the job; no Windows Docker Desktop/WSL2 command executed" } }, "docker_image_evidence": { @@ -85,9 +92,9 @@ }, "unified_docker_smoke": { "status": "FAIL", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", - "run_id": "32122302381", - "workflow_job_id": "95665197846", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", + "run_id": "32141428407", + "workflow_job_id": "95724751356", "manifest": ".artifacts/task-15/unified-docker-images.json", "reason": "workflow attempt stopped before deployment because rg is required", "cleanup": "PASS", @@ -113,10 +120,15 @@ "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", "evidence": "focused safeio/backup tests, Go race suite, and Unix ancestor-swap coverage" }, + "windows_stagearchive_retained_capability": { + "status": "PASS", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", + "evidence": "native Windows backup package passed, including the two-file shared retained-root staging test" + }, "windows_claim_retained_capability": { - "status": "FAIL", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", - "evidence": "native Windows workflow step failed" + "status": "PASS", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", + "evidence": "native Windows safeio and authstorage packages passed concurrent claim/consume coverage" }, "workflow_lf_compose_docs_typescript": { "status": "FAIL", @@ -130,7 +142,7 @@ }, "go_security_build": { "status": "PASS", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", "focused_packages": 3, "race_packages": 18, "focused_test": "PASS", @@ -140,8 +152,8 @@ }, "windows_cross_compile": { "status": "PASS", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", - "focused_test_packages": 2, + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", + "focused_test_packages": 3, "cli_build": "PASS", "execution": "cross_compile_only_not_native_execution" }, @@ -203,8 +215,8 @@ }, "unified_docker_smoke": { "status": "FAIL", - "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", - "workflow_run_id": "32122302381", + "source_commit": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4", + "workflow_run_id": "32141428407", "reason": "remote workflow attempted the smoke but stopped before deployment because rg is required", "cleanup": "PASS", "image_manifest": "not_generated" @@ -215,29 +227,29 @@ "classification": "known_baseline" }, "mkdocs_strict": { - "status": "FAIL", - "classification": "not_reached_after_stop", + "status": "NOT_RUN", + "classification": "BLOCKED", "historical_status": "FAIL", "historical_warnings": 69 }, "canonical_install_docs": { - "status": "FAIL", - "classification": "not_reached_after_stop", + "status": "NOT_RUN", + "classification": "BLOCKED", "historical_status": "FAIL" }, "workspace_install_docs": { - "status": "FAIL", - "classification": "not_reached_after_stop", + "status": "NOT_RUN", + "classification": "BLOCKED", "historical_status": "FAIL" }, "pi_user_auth_compose": { - "status": "FAIL", - "classification": "not_reached_after_stop", + "status": "NOT_RUN", + "classification": "BLOCKED", "historical_status": "FAIL" }, "deployment_coupling": { - "status": "FAIL", - "classification": "not_reached_after_stop", + "status": "NOT_RUN", + "classification": "BLOCKED", "historical_status": "FAIL" }, "l2": { @@ -254,11 +266,11 @@ } }, "review": { - "three_important_findings_closed": false, - "verdict": "CHANGES_REQUIRED", - "reason": "native Windows retained-capability tests failed; the frozen workflow omits internal/authstorage from its native command" + "four_important_findings_closed": true, + "verdict": "ADDRESSED", + "reason": "the exact-source native Windows step passed safeio, backup, and authstorage; cleanup and deadlock tests are green and the workflow command includes all three packages" }, "release_complete": false, - "authentication_implementation_complete": false, + "authentication_implementation_complete": true, "release_readiness": "FAIL" } diff --git a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md index 38549610..88d3661e 100644 --- a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md +++ b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md @@ -1,30 +1,33 @@ # Task 15 retained release-gate report — fix round 5 (sanitized) -## Task 4 recertification addendum — frozen source `b31b27e5845ffd3adf311429367319beaba263c7` +## Final-review fix-round-1 addendum — frozen source `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` -This addendum supersedes the earlier source-bound matrix for current certification while preserving -the fix-round-5 material below as historical provenance. +This addendum supersedes the earlier Task 4 pre-fix certification for current authentication +remediation status while preserving the fix-round-5 material below as historical provenance. -- Certification status: `FAIL` / `CHANGES_REQUIRED`; no tracked source changed after the freeze. -- Native Windows workflow run `32122302381` was dispatched on the exact frozen SHA and concluded - `failure`. Job `Windows clone and Compose contract` (`95665197885`) executed the native - `safeio`/`backup` test command, which failed; `internal/authstorage` was not part of that frozen - workflow command. -- Local current results: Go focused/race/vet/build and Windows cross-compile PASS; Node 24 backend - `76 files / 1092 tests`, frontend `61 files / 444 tests`, typechecks/builds and authentication - smoke PASS; harness `951 passed / 1 failed / 4 skipped`, Ruff `192` errors, and Compose contracts - FAIL; authentication docs and shell syntax PASS. -- The same run's `LF, Compose, docs, and TypeScript` job (`95665197839`) failed on an unset `TMPDIR` - in the deployment-coupling scope script after its unified Compose contract passed; this is a - baseline/CI contract issue. Its Linux Docker job (`95665197846`) stopped before deployment because - `rg` was unavailable; cleanup proof passed and no image manifest was generated, so this is an - infrastructure prerequisite issue rather than a source-bound Docker result. -- The remote unified Docker smoke attempt therefore failed before deployment; the existing image - manifest below remains historical and is not evidence for the new source. +- Authentication remediation status: implementation `PASS`; all four final-review Important + findings are addressed. Overall branch/release readiness remains `FAIL` with external gates + `PENDING`. +- Completed exact-source workflow run `32141428407` concluded `failure` on baseline release jobs. + Its `Windows clone and Compose contract` job (`95724751282`) executed the unfiltered command + `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`; the native step + passed all three packages: safeio `8.230s`, backup `5.195s`, authstorage `8.383s`. +- The Windows job failed only afterward in the baseline clone-contract script at + `scripts/test-windows-clone-contract.ps1:208`, where PowerShell rejects the undelimited + `$remoteYaml:` variable reference. +- `LF, Compose, docs, and TypeScript` job `95724751205` reproduced the baseline unset-`TMPDIR` + failure after unified Compose passed. Linux Docker job `95724751356` reproduced the missing-`rg` + prerequisite failure; cleanup passed and no image manifest was generated. +- The skipped Windows Docker Desktop/WSL2 job is recorded as `NOT_RUN` / `BLOCKED`, not FAIL. + Downstream commands skipped after executed baseline failures use the same classification. The + matrix contains an explicit native `windows_stagearchive_retained_capability` PASS row. +- Historical Node/auth/browser/docs PASS and harness/Ruff/Compose FAIL evidence remains bound to + its recorded source where not rerun. L2, real PSD/manual acceptance, and provider readiness + remain `PENDING`. - Current machine-readable evidence and the requested Task 4 report are recorded in `.artifacts/task-15/automated-gates.json` and `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`. -- Current automated-gates SHA-256: `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`. +- Current automated-gates SHA-256: `5c110b7b2607693de078def441b10290c5a29024c83b7e5a0ced894b72b7507f`. - Historical unified Docker manifest SHA-256: `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`. The complete sanitized Task 4 matrix and the separate remediation/release verdicts are in the diff --git a/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md new file mode 100644 index 00000000..92d2a4cd --- /dev/null +++ b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md @@ -0,0 +1,162 @@ +# Final-review fix round 1 report (sanitized) + +## Verdict + +- Base: `fa499a9bdd37011833691b0f447470d8b7e8a3a6`. +- Final frozen source: `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` on + `feat/thoth-auth`. +- Authentication remediation: **PASS / ADDRESSED**. All four final-review Important findings are + resolved relative to the remediation brief. +- Terra Minor evidence corrections: **ADDRESSED**. +- Branch/release readiness: **FAIL**. The completed exact-source workflow still contains executed + baseline clone-contract, LF/Compose, and Linux Docker failures. Unavailable external/manual + gates remain **PENDING**. +- Source and evidence remain separate commits. No workflow was dispatched from the evidence-only + phase. + +## Finding disposition + +| Finding | Disposition | Evidence | +|---|---|---| +| Important 1 — exhaustive Windows cleanup | RESOLVED | Cleanup now attempts close/delete/validation operations in deterministic order and returns sanitized `ErrUnsafeFile` after aggregating failures. `TestWindowsPrivateRegularCleanupClosesAfterDeleteDispositionFailure` and `TestWindowsClaimCleanupAttemptsLaterOperationsAfterEarlierFailure` cover the non-short-circuit contract. Global no-delete sharing remains unchanged. | +| Important 2 — usable native Windows authority | RESOLVED | Owner-only descriptors use the current user SID, protected/non-defaulted DACL semantics, valid NT attributes/access masks, self-relative creation descriptors, and semantic full-control validation. Equal-or-stronger Windows fixture adaptations retain no-delete handles instead of weakening ACL/identity checks. The final native three-package gate passes. | +| Important 3 — restore-test deadlock | RESOLVED | Lifecycle-stage release observes the buffered worker outcome, uses a bounded/cancellable release, reports premature completion directly, and never waits indefinitely on `done`. `TestReleaseLifecycleStageReturnsPrematureWorkerOutcome` and the lifecycle-lock terminal-cleanup test are green. | +| Important 4 — complete native package gate | RESOLVED | Workflow and remediation plan both use the exact unfiltered command `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`. Final logs prove all three packages executed natively. | +| Minor — non-executed gate classification | RESOLVED | Non-executed/skipped commands are `NOT_RUN` / `BLOCKED`; `FAIL` is reserved for commands that ran and failed. Historical results remain separately labelled. | +| Minor — explicit Windows StageArchive row | RESOLVED | `.artifacts/task-15/automated-gates.json` contains `windows_stagearchive_retained_capability` = PASS, bound to the final source and native backup result. | + +Additional failures exposed by the required unfiltered gate were fixed without narrowing the +workflow: Windows secret-bearing archive reservation is protected before use; StageArchive shares +one retained root capability across both staged files; claim/consume transitions serialize the +complete public validation and retained-handle operation while preserving ACL, hard-link identity, +reparse rejection, and no-delete invariants. + +## RED → GREEN record + +### Initial RED + +- Run `32122302381`: + https://github.com/mptyl/ThothII/actions/runs/32122302381 +- Source: `b31b27e5845ffd3adf311429367319beaba263c7`. +- Windows job: `95665197885`. +- Result: native `safeio`/`backup` failure, including the 10-minute restore lifecycle timeout; + `authstorage` was absent from the command. This established the RED for Important 2–4 and the + required native authority. +- Cleanup failure-injection tests added for Important 1 first exposed the short-circuit behavior + before the implementation was changed. + +### Final concurrency RED + +- Run `32140481263`: + https://github.com/mptyl/ThothII/actions/runs/32140481263 +- Source: `b48e9e9189dd0e8083db9bd0378704524e670edb`. +- Windows job: `95721724645`. +- Native results: backup PASS (`20.757s`), authstorage PASS (`104.180s`), safeio FAIL + (`63.502s`). The only failures were: + - `TestCanonicalPrivateClaimWaitsForRetainedRemoveOperation`: the concurrent claim returned + `false, unsafe file` before retained removal completed; + - `TestCanonicalPrivateClaimConsumeHasOneConcurrentWinner`: iteration 8 returned `unsafe file`. +- Diagnosis: the process mutex started below `validateClaimPaths`; a concurrent caller could fail + while reopening the retained no-delete directory before reaching the lock. + +### GREEN implementation and local gates + +The lock boundary was moved to the three public claim/read/remove APIs, covering validation, +relative operation, and handle close. The Unix implementation uses a no-op boundary and retains its +existing descriptor-relative semantics. + +Final-source local commands passed: + +```text +go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1 +go test -race ./... +go vet ./... +go build -o /tmp/thothii-tht-host ./cmd/tht +GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o /tmp/thothii-tht-windows.exe ./cmd/tht +GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c ... ./internal/{safeio,backup,authstorage} +``` + +- Focused host package times: safeio `8.750s`, backup `8.378s`, authstorage `8.854s`. +- Race suite and vet: PASS. +- Host CLI: Mach-O arm64; Windows CLI and all three Windows test binaries: PE32+ x86-64. +- Cross-compilation remains compile-only and is not used as native proof. + +## Exact-source native certification + +- Run: `32141428407` +- URL: https://github.com/mptyl/ThothII/actions/runs/32141428407 +- Event/status/conclusion: `workflow_dispatch` / `completed` / `failure`. +- Head SHA: `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` — exact final source match. +- Windows job: `Windows clone and Compose contract`, job `95724751282`: + https://github.com/mptyl/ThothII/actions/runs/32141428407/job/95724751282 +- Native step: `Run native Windows retained-capability tests` — **PASS**. +- Exact command: `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`. +- Native package results: + - safeio PASS (`8.230s`); + - backup PASS (`5.195s`); + - authstorage PASS (`8.383s`). +- Job conclusion: `failure` only because the following `Verify Windows clone contract` baseline + step failed with a PowerShell `ParserError` at + `scripts/test-windows-clone-contract.ps1:208`; `$remoteYaml:` is not delimited before `:`. + +## Remaining branch/release blockers + +| Gate | Classification | Exact outcome | +|---|---|---| +| Windows native authentication packages | PASS | All three required packages executed on final source. | +| Windows clone contract | FAIL / baseline | Executed after native PASS; PowerShell parser error at line 208. | +| LF, Compose, docs, and TypeScript | FAIL / baseline CI contract | Job `95724751205`; unified Compose passed, then `test-no-deployment-coupling-scope.sh` failed because `TMPDIR` was unset. Downstream skipped commands are `NOT_RUN` / `BLOCKED`. | +| Linux Docker deployment and rollback | FAIL / infrastructure prerequisite | Job `95724751356`; executed smoke stopped because `rg` was unavailable. Cleanup proof passed; no new image manifest was generated. | +| Native Windows Docker Desktop/WSL2 startup | NOT_RUN / BLOCKED | Job `95724752028` was skipped by workflow conditions; no Docker/WSL2 command executed. | +| Harness/Ruff/other historical baseline gates | FAIL | Retained with their recorded source and results; not rewritten as final-source proof. | +| L2, real PSD/manual acceptance, provider readiness | PENDING | Required secrets, identity/access, or provider prerequisites remain unavailable. | + +The historical Docker image manifest remains bound to source +`74b062f1a737103524cbe706346cfd65f87cdfd1`; it was not reused as proof for the final source. + +## Principal source commits + +- `cd5f505` — exhaustive cleanup, Windows authority foundation, restore deadlock tests/fix, and + complete workflow/plan package command. +- `a0e05ad` through `b6396e6` — effective full-control DACL semantics, valid NT attributes/access, + self-relative descriptors, retained no-delete fixture ordering, and Windows installation fixture + protection. +- `824245d` — preserve existing lifecycle ACL trees instead of mutating inherited authority. +- `455fffb`, `2d1670e`, `c01482c`, `9fc1a15` — concurrent claim/consume and settled-loss handling. +- `6474118` — one retained StageArchive root capability shared across staged files. +- `feee4ee` — unified Windows path wrappers on the retained primitive. +- `b261dd4` — bounded private-root sharing contention handling. +- `b48e9e9` — deterministic retained-remove concurrency regression and claim-operation lock. +- `10cd66f` — final lock boundary includes public path validation; frozen source. + +## Files changed + +Source changes relative to the fix-round base: + +- `.github/workflows/deployment.yml`; +- `docs/superpowers/plans/2026-08-18-thothii-authentication-remediation.md`; +- `tools/tht/internal/authstorage/storage_test.go`; +- `tools/tht/internal/backup/{create.go,create_test.go,fixture_security_unix_test.go,fixture_security_windows_test.go,preflight.go,preflight_test.go,preflight_windows_test.go,restore.go,restore_test.go}`; +- `tools/tht/internal/safeio/{claim_unix.go,claim_windows.go,claim_windows_test.go,files.go,files_test.go,private_root_windows.go,private_windows.go,private_windows_test.go}`. + +Evidence/status changes are restricted to: + +- `.artifacts/task-15/automated-gates.json`; +- `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`; +- `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md`; +- `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md`; +- `PROJECT_STATE.md`. + +Machine-readable evidence SHA-256: +`5c110b7b2607693de078def441b10290c5a29024c83b7e5a0ced894b72b7507f`. + +## Git and protection status + +- The evidence commit contains only the five evidence/status files listed above; no source is + changed after frozen source `10cd66fe6a5b484a4dc569326a228c1c5484a5d4`. +- After the evidence commit and push, the intended status is synchronized + `feat/thoth-auth...origin/feat/thoth-auth` with only protected untracked `.playwright-cli/` and + `.thothctl/`. +- `AGENTS.md`, `CLAUDE.md`, and `docs/agents/` are untouched. No generated `tools/tht/tht` exists. +- Evidence commit SHA is reported externally after commit creation because a commit cannot contain + its own final hash. diff --git a/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md index d01a831d..de58efa5 100644 --- a/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md +++ b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md @@ -1,6 +1,36 @@ # Task 4 authentication remediation recertification (sanitized) -## Result +## Fix-round-1 recertification — Windows remediation PASS + +- Exact source: `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` on `feat/thoth-auth`. +- Authorized workflow: completed run `32141428407`, + https://github.com/mptyl/ThothII/actions/runs/32141428407, exact matching head SHA. +- Native job: `Windows clone and Compose contract`, job `95724751282`. +- Required native step: `Run native Windows retained-capability tests` — **PASS**. +- Exact unfiltered command: + `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`. +- Package evidence: `internal/safeio` PASS (`8.230s`), `internal/backup` PASS (`5.195s`), + `internal/authstorage` PASS (`8.383s`). This includes explicit native Windows + StageArchive retained-capability and concurrent claim-consume coverage. +- The later `Verify Windows clone contract` step failed independently at + `scripts/test-windows-clone-contract.ps1:208`: PowerShell parsed `$remoteYaml:` as an invalid + variable reference. This baseline deployment-contract failure does not change the native Go + package result. +- The optional `Native Windows Docker Desktop/WSL2 startup` job was skipped by workflow + conditions. It is `NOT_RUN` / `BLOCKED`, because no Docker Desktop/WSL2 command executed. +- The workflow reached `completed` with conclusion `failure`: the native authentication step is + PASS, while the later clone-contract, LF/Compose, and Linux Docker baseline steps are FAIL. +- Existing LF/Compose and Linux Docker failures repeated before downstream work. Skipped commands + are `NOT_RUN` / `BLOCKED`, not executed failures. External L2/PSD/provider gates remain + `PENDING`. + +All four final-review Important findings are addressed. Authentication implementation is complete +for this fix round; overall release readiness remains `FAIL` because the unrelated deployment, +Compose, harness/Ruff, Docker-runner, and external/manual gates above are not green. + +The section below is retained as historical evidence for the pre-fix frozen source. + +## Historical pre-fix result - Frozen source under test: `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`. - Freeze check: PASS. No tracked source changed during certification. The only untracked paths @@ -74,7 +104,7 @@ was run locally after the failure. ## Evidence and provenance - Current machine-readable matrix: `.artifacts/task-15/automated-gates.json`; SHA-256 - `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`. + `5c110b7b2607693de078def441b10290c5a29024c83b7e5a0ced894b72b7507f`. - Current requested report: this file (SHA-256 recorded after the evidence commit if needed for external indexing). - Historical Docker image manifest: `.artifacts/task-15/unified-docker-images.json`, unchanged diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md index 1477cc68..4f589734 100644 --- a/PROJECT_STATE.md +++ b/PROJECT_STATE.md @@ -7,41 +7,39 @@ > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato. -> Last updated: 2026-08-18 (Task 4 recertification recorded; native Windows authority failed and -> the authentication feature is not implementation- or release-complete). +> Last updated: 2026-08-18 (final-review fix round 1 recorded; native Windows authentication gate +> passed, implementation is complete, and unrelated release gates remain open). > Point a fresh session here ("read PROJECT_STATE.md") before substantial work. -### Task 4 authentication recertification — FAIL, native Windows CHANGES REQUIRED (2026-08-18) +### Authentication final-review fix round 1 — implementation PASS, release gates remain (2026-08-18) -- Frozen source under test is `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`. - No tracked source changed during certification; only `.playwright-cli/` and `.thothctl/` remain - untracked. -- Local PASS: Go focused security tests for `safeio`, `backup`, and `authstorage`; Go race across - 18 packages; `go vet`; host build; Windows amd64 cross-compile; Node `v24.16.0` backend - `76/1092` and frontend `61/444` with typecheck/build; authentication/F1 smoke and sentinel - scan; authentication docs smoke; shell syntax. -- Local FAIL: harness `951 passed / 1 failed / 4 skipped` (the F4 column-decision test cannot find - `workflow.yaml` from its test cwd); Ruff `192` errors; default Compose missing its required - workspace-remote variable; unified Compose references absent `compose.unified.yaml`. -- Authorized workflow run `32122302381` (URL in the Task 4 report) has the exact frozen SHA and - conclusion `failure`. Its `Windows clone and Compose contract` job `95665197885` really ran the - native `safeio`/`backup` command and failed, including a 10-minute backup lifecycle-lock - timeout. The frozen workflow does not request `internal/authstorage`, so that native evidence is - absent rather than inferred from cross-compilation. -- The same run's LF/Compose/docs/TS job failed on an unset `TMPDIR` after its unified Compose - contract passed (baseline/CI contract). Its Linux Docker job failed before deployment because - `rg` was unavailable; cleanup proof passed and no new image manifest was generated (runner - prerequisite). The historical five-image manifest remains bound to source - `74b062f1a737103524cbe706346cfd65f87cdfd1` and was not rewritten for this candidate. L2, real - PSD/manual acceptance, and provider readiness remain `PENDING` where prerequisites are unavailable. -- Durable current evidence is tracked in `.artifacts/task-15/automated-gates.json` and - `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`; the historical - Task 15 report contains a separate Task 4 addendum. Current automated-gates SHA-256 is - `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`; the unchanged historical - Docker manifest SHA-256 is `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`. -- **Implementation/release state: NOT COMPLETE.** The three Important findings remain - `CHANGES_REQUIRED`; overall release readiness is `FAIL` with additional `PENDING` gates. No - source fix was attempted in Task 4. +- Frozen source is `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` on `feat/thoth-auth`. + Source and evidence are separate commits; `.playwright-cli/` and `.thothctl/` remain the only + untracked paths. +- Local PASS on the frozen source: exact `safeio`/`backup`/`authstorage` tests, full Go race suite, + `go vet`, macOS host build, Windows amd64 package cross-compiles, and Windows CLI build. +- Authorized exact-source workflow run `32141428407` completed on the exact frozen SHA and + executed the unfiltered native command + `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`. The required step + passed: safeio `8.230s`, backup `5.195s`, authstorage `8.383s`. Native Windows StageArchive and + concurrent claim-consume evidence are therefore PASS, not inferred from cross-compilation. +- The same Windows job later failed the unrelated clone-contract script at + `scripts/test-windows-clone-contract.ps1:208` because `$remoteYaml:` is not a valid PowerShell + variable reference. LF/Compose and Linux Docker baseline failures also repeated. The optional + Windows Docker startup job was skipped without executing and is `NOT_RUN` / `BLOCKED`; the + overall completed run conclusion is `failure` because the baseline jobs remain red. +- Historical Node/auth/browser/docs PASS and harness/Ruff/Compose FAIL evidence remains bound to + its recorded source where not rerun. L2, PSD/manual, and provider prerequisites remain + `PENDING`; no new Docker image manifest was generated. +- Durable evidence: `.artifacts/task-15/automated-gates.json`, + `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`, and + `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md`. +- Current automated-gates SHA-256 is + `5c110b7b2607693de078def441b10290c5a29024c83b7e5a0ced894b72b7507f`; the historical Docker + manifest remains bound to its recorded older source and was not reused for this candidate. +- **State:** all four final-review Important findings are addressed and authentication + implementation is complete. Overall release readiness remains `FAIL` until the unrelated + deployment, Docker-runner, baseline, and external/manual gates are resolved. ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)