From 31f5501f862cc37d00da44cd63791281056d8538 Mon Sep 17 00:00:00 2001 From: sechmachine <97589681+sechmachine727@users.noreply.github.com> Date: Mon, 10 Aug 2026 08:21:37 +0700 Subject: [PATCH] docs(gateway): close v10 qualification evidence --- .../truthful-fixed-frame-qualification/design.md | 8 +++++++- .../truthful-fixed-frame-qualification/proposal.md | 6 ++++++ .../truthful-fixed-frame-qualification/tasks.md | 10 +++++----- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/openspec/changes/truthful-fixed-frame-qualification/design.md b/openspec/changes/truthful-fixed-frame-qualification/design.md index b51b6b7..7a91a66 100644 --- a/openspec/changes/truthful-fixed-frame-qualification/design.md +++ b/openspec/changes/truthful-fixed-frame-qualification/design.md @@ -8,7 +8,7 @@ Because the bounded fixture uses loopback rather than a physical 1 Gbps link, v8 The retained v6 qualification run passed its then-current checks but is superseded because its tight-loop sender contradicted the pinned Apollo schedule. Private Linux runs 123 and 124 remain failed evidence. One local v8 sustained run passed on Darwin, but it is neither Linux proof nor normative Section 7 evidence. -The later Darwin non-sustained pre-CI invocation was not green and was not retried. Its 1440p120 profile delivered the exact 6,250,000 bytes in 120 frames plus all 6,483 source and warm-up shards with zero drops, but measured 46,973.13 kbps over an implied approximately 1.0644383 seconds and failed the 5% throughput gate. Private Linux full verification/artifact retention and the replacement v10 normative run remain open. +The later Darwin non-sustained pre-CI invocation was not green and was not retried. Its 1440p120 profile delivered the exact 6,250,000 bytes in 120 frames plus all 6,483 source and warm-up shards with zero drops, but measured 46,973.13 kbps over an implied approximately 1.0644383 seconds and failed the 5% throughput gate. At that point, private Linux full verification/artifact retention and the replacement v10 normative run were still open. Private Linux run 125 at the frozen v8 harness head is retained as failed evidence. Its exact 33-datagram gap between successful fixture writes and production `MediaIngress` equaled the Linux socket's 33 measured kernel UDP drops. The complete-frame queue, fair pacer, QUIC fragmentation, and public decoder were downstream and did not account for the loss. @@ -28,6 +28,12 @@ Qualification v10 keeps the logical impairment CSV unchanged and adds only `impa The independent parser's caller explicitly selects smoke or normative authority. Normative validation requires exactly 10,000 sent logical units and always enforces the ten-second convergence and 105% rolling-cap gates; retained `sent` data cannot weaken them. Both wire and fairness readers reject compressed input before hashing when it exceeds a writer-derived bound, feed gzip output through a bounded standard-library reader before CSV parsing, and bound fields, offsets, flows, and encoded lengths from the canonical row count, schema, time horizon, and writer values. Aggregate-only v9 data and malformed schema/hash/count/order/transition/length or oversized inputs remain rejected. +Private Linux run 129/job 483 and artifact 29 at `c0e362c0285d267f8af4087d07943822311f60e1` passed execution, artifact-byte, and at-least-30-elapsed-day retention checks. Its subsequent v9 a2 qualification remains runtime-passing but normative-raw-evidence-incomplete. Exact v10 source `ce3b3079837c5745f95a51c98eb6204363962ae7` then passed its one private Linux push attempt in run 130/job 484: `make verify`, the sustained gate, strict OpenSpec, deterministic artifact build/upload, and clean checkout all passed. The retained run log is SHA-256 `7e23011db2cb3118ca6cd940cfdc59ba4b536de39276d6b6a74c5862c745b0fa`. Artifact 30's ZIP is SHA-256 `59f938f9187255ad015fa5608b49909e89a065e4f5ba515b7450608b8048b1cc` at 12,957,227 bytes; its amd64 binary is `33ecd42cee0e01bc15aa87aa0610bfb165b2a2b379133110271c98d717584cc1` at 12,367,020 bytes, its arm64 binary is `4b6fc560e23fd8e283219f63ac4a33881863d12644676fb6e5a7d9fc4523182b` at 11,525,817 bytes, and its source-correct SPDX is `a1c2ae2bc4a8c0e0dea67ac53dbf8bb6135399cecb8d6fd153e9b59174ec35b9` at 8,090 bytes. The API recorded exactly 2,592,000 seconds of retention. The binaries remain unchanged because v10 changes retained test evidence only; the SPDX truthfully remains unscanned and unsigned. + +Two subsequent ce3 elevated-execution preflights were denied before `CreateProcess`. No `go test` process started, no target was created, and neither event consumed a qualification attempt; they remain environment/approval history rather than runtime failures. The later owner-approved elevated direct command ran exactly once at ce3 with immutable Protocol RC10, exited zero, and passed `TestSection7Qualification` in 1,917.92 seconds (package 1,918.491 seconds). It produced mode-0750 `gateway-rc10-ce3b307` with 17 files totaling 4,179,714 bytes and a passed v10 manifest SHA-256 `53f1e24a3182887d496b745826af20c7b220a3a0cc2e1682baf1eb746f4c240d`. + +Independent review recomputed 36,000/72,000/36,000 processing frames and 11.25 GB of exact payload, including payload digests, statistics, isolated resources, and all eight logical impairment files. It also recomputed the constrained wire artifact's 15,060 rows as 15,058 ordered 1,200/25-byte deliveries plus canonical 25%/50% transitions, including full-tail convergence and maxima. The fairness artifact retained 70,916 rows; stage-bounded recomputation reproduced Jain index `0.9999999546920958`, maximum share error `0.0003749275708101844`, and the two-second 25%/50% convergence/maxima. Identity, hashes, bounded grammar, and preservation checks found no material mismatch. These results remain deterministic fixture evidence only and do not prove live Apollo, the native macOS client, a physical firewall or route, a real encoder, multi-host operation, Phase 3C-C, vulnerability scanning, signing, deployment, or promotion. + The ingress repair follows reviewed behavior rather than copying implementation source: - Apollo `adc5c5a0bd80831ce495434bb16aee2cd4175fb8`, GPL-3.0, `src/stream.cpp:1463-1474,1573-1627`, supplies the 80%-of-1-Gbps raw-block pacing, 64-KiB/64-packet batch cap, and cross-frame send schedule used by the fixture. diff --git a/openspec/changes/truthful-fixed-frame-qualification/proposal.md b/openspec/changes/truthful-fixed-frame-qualification/proposal.md index e1d1cd5..1fdb158 100644 --- a/openspec/changes/truthful-fixed-frame-qualification/proposal.md +++ b/openspec/changes/truthful-fixed-frame-qualification/proposal.md @@ -14,6 +14,12 @@ Private Linux run 128/job 482 was the single push-triggered attempt at exact sou At exact source `c0e362c0285d267f8af4087d07943822311f60e1`, the first Section 7 attempt created `gateway-rc10-c0e362c` and stopped at the sandbox loopback-bind boundary, leaving that mode-0750 directory empty. The separately authorized escalated attempt `gateway-rc10-c0e362c-a2` then passed the v9 runtime gates and retained 16 files; its manifest has SHA-256 `61ea55140dfe6b37332de03879ac33206dd5d47763d09fb0fc2f65bb1f8e02b4`. Independent review denied normative acceptance because v9 retained only logical impairment rows and aggregate capacity summaries: it did not retain the raw public datagram timestamps/lengths or fairness transition offsets needed to recompute those summaries. Both attempts remain preserved without relabeling; a2 is runtime-passing but normative-raw-evidence-incomplete. +Private Linux run 129/job 483 and artifact 29 at `c0e362c0285d267f8af4087d07943822311f60e1` passed execution, artifact-byte, and at-least-30-elapsed-day retention checks. That Linux result remains valid, while the later v9 a2 qualification remains runtime-passing but normative-raw-evidence-incomplete. Neither classification is relabeled. + +Immutable v10 source `ce3b3079837c5745f95a51c98eb6204363962ae7` passed its single private Linux push attempt, run 130/job 484, including `make verify`, the sustained gate, strict OpenSpec, deterministic build/upload, and the clean-checkout gate. Artifact 30 retained the unchanged amd64 and arm64 binaries plus a source-correct, unscanned, unsigned SPDX for exactly 2,592,000 API-recorded seconds. Two later elevated-execution preflights were denied before `CreateProcess`; neither created the target nor consumed a qualification attempt. The subsequent owner-approved direct command ran exactly once, exited zero, and wrote the 17-file v10 `gateway-rc10-ce3b307` bundle with passed manifest SHA-256 `53f1e24a3182887d496b745826af20c7b220a3a0cc2e1682baf1eb746f4c240d`. + +Independent review recomputed all three processing profiles, 11.25 GB of payload, all eight logical impairment files, the 15,060-row constrained public-wire artifact, and the 70,916-row fairness artifact from the retained v10 evidence. It reproduced ordered 25%/50% transitions, full-tail impairment convergence and maxima, stage-bounded fairness convergence and maxima, Jain index `0.9999999546920958`, maximum share error `0.0003749275708101844`, and every bound manifest identity/hash/grammar value without a material mismatch. This closes only deterministic fixture evidence: live Apollo, the native macOS client, the physical firewall and route, a real encoder, multi-host operation, Phase 3C-C, scanning, signing, deployment, and promotion remain outside this result. + ## What Changes - Generate deterministic variable-size encoded frame units at the named frame rates and target bitrates, including bounded keyframes. diff --git a/openspec/changes/truthful-fixed-frame-qualification/tasks.md b/openspec/changes/truthful-fixed-frame-qualification/tasks.md index 1a1a636..41f3b3c 100644 --- a/openspec/changes/truthful-fixed-frame-qualification/tasks.md +++ b/openspec/changes/truthful-fixed-frame-qualification/tasks.md @@ -23,28 +23,28 @@ - [x] 5.1 Retain the v6 qualification attempt and mark its passing result superseded by the tight-loop source defect - [x] 5.2 Implement v8 post-first-write, non-collapsing complete-frame UDP pacing with persistent cross-frame carry and verify the focused, race, short-resource, and cross-platform compile checks that passed - [x] 5.3 Preserve private Linux runs 123 and 124 as failed evidence, the passing local v8 Darwin sustained run as non-Linux and non-normative, and the un-retried failed Darwin non-sustained pre-CI invocation with its exact throughput evidence -- [ ] 5.4 Run private Linux full verification and retain deterministic Linux artifacts for the frozen v10 evidence descendant -- [ ] 5.5 Run one separately approved replacement v10 normative Section 7 qualification +- [x] 5.4 Run private Linux full verification and retain deterministic Linux artifacts for the frozen v10 evidence descendant +- [x] 5.5 Run one separately approved replacement v10 normative Section 7 qualification ## 6. Native video ingress remediation - [x] 6.1 Preserve run 125 and reproduce its pre-decrypt shortfall with a public 662-shard blocked-AEAD regression - [x] 6.2 Add the video-only 2,195,456-byte socket-buffer request, fixed 2,048-slot drain, single processor, overflow accounting, and bounded cancellation tests -- [ ] 6.3 Freeze the reviewed production repair through the still-open private Linux full-verification and artifact gate before any replacement normative run +- [x] 6.3 Freeze the reviewed production repair through private Linux full verification and artifact retention before running the replacement normative qualification ## 7. Fair-pacer schedule-debt remediation - [x] 7.1 Preserve the consumed failed `55afea72` v8 attempt and its two partial files without retry, relabeling, or modification - [x] 7.2 Reproduce repeated host-stall queue expiry through the public native path and add bounded one-flow/eight-flow debt, fairness, rolling-cap, and capacity-step regressions - [x] 7.3 Retain the 5 ms instantaneous ceiling, carry valid debt within the 250 ms queue horizon, and repay it at no more than 5% above nominal fair share -- [ ] 7.4 Freeze and verify a new executable candidate on private Linux before any separately authorized replacement normative run +- [x] 7.4 Freeze and verify a new executable candidate on private Linux before any separately authorized replacement normative run ## 8. Public-wire capacity measurement correction - [x] 8.1 Preserve run 127/job 481 at `122080ab` as failed evidence with its exact log hash, no artifact, and no retry - [x] 8.2 Observe raw independent-client QUIC datagram lengths/times in-process and derive v9 capacity convergence and caps from configured wire rate while keeping logical payload observations separate; this did not persist sufficient raw evidence for independent proof - [x] 8.3 Preserve run 128/job 482 as passing Linux execution and artifact-byte evidence but retention-nonconforming, with no retry -- [ ] 8.4 Freeze the 31-day-request descendant and prove a future private artifact records at least 30 elapsed days before tasks 5.4, 5.5, 6.3, or 7.4 can close +- [x] 8.4 Freeze the 31-day-request descendant and prove artifact 30 records exactly 30 elapsed days before closing tasks 5.4, 5.5, 6.3, and 7.4 ## 9. Retained public-wire evidence correction