test(runtime): measure disposable profile conformance in native images

toasterson commented

2026-10-16 18:40:46 +00:00

Owner

The native image harness did not produce PR 3's three disposable-profile checks, so a rebuilt image could not supply the evidence required before native profile cutover. Add installed-runtime measurements for cold_profile_bootstrap, missing_history_refused, and warm_profile_no_rewrite for Codex and Claude, alongside the existing wire/cancellation probes.

The full native image builder requests the measurements for both architectures, records runtime/profile/provider hashes, and refuses collection if a check is missing or belongs to another runtime artifact. The probe uses explicitly permissioned synthetic auth, bounded fixture files, loopback-only authenticated HTTP, and a controlled child umask. A cold stale continuation must return HTTP 409 before admission, leave no job receipt, and create no provider state. Warm preparation must retain refreshed auth/cache/config without inode, content, mtime, or ctime changes. No cache rebuild, account login, live model call, version pin, or production behavior change is introduced.

This is measurement tooling, not a production profile conformance certificate. The legacy provider-only updater still measures wire/cancel behavior only; its receipts cannot pass the full image-set disposable gate. Runtime private-slot CAS writeback and live subscription acceptance remain separate prerequisites. All Codex/Claude profiles remain on retained PVCs.

DISPOSABLE-RUNTIMES.md now records Astra 1's controlled refresh result: both refresh and access tokens rotated, observed Codex 0.163.0, refreshed 0600 auth retained on the original PVC. It documents the agreed ESO seed path, ownership/modes, slot-first ordering, and fail-closed rule. No secret values are included.

Validation: 47 image-tool tests plus 5 probe witness/failure-path tests passed locally; git diff --check passed. Local Rust/Docker builds were not run: no Rust changes, and armini remains below the 25 GiB build headroom guard. Actual Linux image measurements are not yet claimed; the merged-main home image build must execute them on both architectures before native cutover. All 52 targeted tests also passed in the Linux CI job. All 15 CI checks passed on head 0178a53d: Forgejo run 4308. PR image jobs validate the pipeline without publishing; actual two-architecture image measurements remain a merged-main release gate. The local Docker daemon returned a containerd blob I/O error, so it was left untouched.

Sequence: talos #221 (PR 7/9) is merged. This is the requested small conformance prerequisite before PR 8 / native cutover. Deploy nothing from this branch; do not merge automatically.

The native image harness did not produce PR 3's three disposable-profile checks, so a rebuilt image could not supply the evidence required before native profile cutover. Add installed-runtime measurements for `cold_profile_bootstrap`, `missing_history_refused`, and `warm_profile_no_rewrite` for Codex and Claude, alongside the existing wire/cancellation probes. The full native image builder requests the measurements for both architectures, records runtime/profile/provider hashes, and refuses collection if a check is missing or belongs to another runtime artifact. The probe uses explicitly permissioned synthetic auth, bounded fixture files, loopback-only authenticated HTTP, and a controlled child umask. A cold stale continuation must return HTTP 409 before admission, leave no job receipt, and create no provider state. Warm preparation must retain refreshed auth/cache/config without inode, content, mtime, or ctime changes. No cache rebuild, account login, live model call, version pin, or production behavior change is introduced. This is measurement tooling, not a production profile conformance certificate. The legacy provider-only updater still measures wire/cancel behavior only; its receipts cannot pass the full image-set disposable gate. Runtime private-slot CAS writeback and live subscription acceptance remain separate prerequisites. All Codex/Claude profiles remain on retained PVCs. `DISPOSABLE-RUNTIMES.md` now records Astra 1's controlled refresh result: both refresh and access tokens rotated, observed Codex 0.163.0, refreshed 0600 auth retained on the original PVC. It documents the agreed ESO seed path, ownership/modes, slot-first ordering, and fail-closed rule. No secret values are included. Validation: 47 image-tool tests plus 5 probe witness/failure-path tests passed locally; `git diff --check` passed. Local Rust/Docker builds were not run: no Rust changes, and armini remains below the 25 GiB build headroom guard. Actual Linux image measurements are not yet claimed; the merged-main home image build must execute them on both architectures before native cutover. All 52 targeted tests also passed in the Linux CI job. All 15 CI checks passed on head 0178a53d: [Forgejo run 4308](https://code.aopc.cloud/toasterson/akh-medu/actions/runs/4308). PR image jobs validate the pipeline without publishing; actual two-architecture image measurements remain a merged-main release gate. The local Docker daemon returned a containerd blob I/O error, so it was left untouched. Sequence: talos #221 (PR 7/9) is merged. This is the requested small conformance prerequisite before PR 8 / native cutover. Deploy nothing from this branch; do not merge automatically.

toasterson added 1 commit

2026-10-16 18:40:47 +00:00