From c0dd31d24274778cad1b1acbee43b76fac002b9d Mon Sep 17 00:00:00 2001 From: Dotta Date: Tue, 27 Oct 2026 02:26:48 -0500 Subject: [PATCH] Record exact Docker config custody and qualification proposal --- doc/plans/2026-10-26-chat-catalog-eval-progress.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/doc/plans/2026-10-26-chat-catalog-eval-progress.md b/doc/plans/2026-10-26-chat-catalog-eval-progress.md index 40a38ad855c..d2a9f7b7416 100644 --- a/doc/plans/2026-10-26-chat-catalog-eval-progress.md +++ b/doc/plans/2026-10-26-chat-catalog-eval-progress.md @@ -245,3 +245,11 @@ New immutable remaining-three candidate: `f73390f925edcddd3af977e337adf16d5818fb Campaign `catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference` consumed only comment-with-reference ordinal 1 from reviewed `f73390f925edcddd3af977e337adf16d5818fb41`. Actual CLI doctor reports “PostgreSQL mode selected but no connection string configured” and refuses server start. Source `cli/src/checks/database-check.ts` checks only `config.database.connectionString`; it does not use the server’s `DATABASE_URL` override. The prior custody correction missed this normal-startup contract, so this is an eval-harness startup failure, not feature/model evidence. There were zero browser/scenario/native/model admissions or tokens; the owned PostgreSQL infrastructure did start. No retry was performed. Original fallback result and logs are retained at `tests/runner-e2e/results/catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference/chat-features/runner-codex-subscription/local/tasks.comment-with-reference/attempt-1/`. Result database identity reports pinned PostgreSQL 18.6 and container status `removed`. Overall cleanup nevertheless remains failed/unconfirmed; private root `paperclip-runner-e2e-hZhllt` is retained. This distinction is preserved without inferring all cleanup from Docker removal. Broken-link and profile remain unreserved pending the shared startup/custody correction and explicit admission. + +### Exact persisted-DSN custody correction; infrastructure qualification proposed + +Commit `1fc30a0ed1d3c2d3770b0e70d94710f0b3310589` restores the product-required file DSN and original server environment scrubbing. New `docker-config-custody.ts` validates the independently observed live owned Docker receipt/password/container and exact current-UID canonical private attempt/home/instance directories (0700), regular nonsymlink config (0600), and its single exact `database.connectionString`. The directory scanner removes only that one validated raw JSON string literal from its scan input; it scans all remaining original bytes and all secret roots. Wrong field/path/owner/modes, duplicate DSN, extra password, unrelated provider credentials, symlinks or non-ready lifecycle fail. Native Codex DB environment remains absent; no public/raw report sanitization was relaxed. + +Immutable infrastructure qualification proposal `6beacfe0a94e87b9b834f0f1d46d42e8ec7aec42` overlays only ten owned correction paths on failed snapshot f733. Archived E2E typecheck exited 0 and 120 focused controls across five files passed. Production baseline8373/lock, copied workspace artifacts, native binary and 46 audited dependency links remain unchanged. The health helper now executes the same final persisted-home secret scanner and exact custody policy, recording `sameFinalPersistedStateSecretScan` explicitly. One infrastructure-only health qualification has been proposed to the manager; no new health/canonical launch or reservation occurred while authoring. + +Append-only read-only cleanup evidence `results/chat-catalog-campaign/comment-hZhllt-readonly-cleanup.json` verifies the retained comment root is owned0700, exact recorded Docker container and volume are absent, four known observed PIDs are absent, and no current command references that exact root. This limited census does not establish a complete descendant history; original cleanup failed/unconfirmed remains unchanged and no resource was removed. The CLI doctor’s file-only DSN check versus the server’s supported `DATABASE_URL` override is recorded as a candidate core consistency issue for a later separately qualified PR, with no production edit here.