admin
7714f1f6e4
Full-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline: ONE genuine pilot-critical finding — the non-root agent cannot pct-restore the standard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives, mp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH --selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing VM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated by one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/ dryrun-journal/escrow-blob calibration issues; the product where actually exercised was healthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state (auth off, notifications restored, no scratch leaks). No production code changed. Evidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
33 lines
2.0 KiB
Markdown
33 lines
2.0 KiB
Markdown
# Campaign 2 — evidence snapshot (2026-07-07)
|
|
|
|
Raw evidence for `../CAMPAIGN-2-2026-07-07.md` (read that first — it triages everything here).
|
|
Collected from the throwaway harness on DooPlex (`~/campaign2-nomercy/`); session cookie jars were
|
|
deleted before commit (no secrets). Times are CEST.
|
|
|
|
## Layout
|
|
- `state/` — run-level artifacts:
|
|
- `overnight.out` — the full run log (every phase, every JOURNAL line, all agent errors).
|
|
- `journal.tsv` — per-test verdicts (incl. the 170 `T-SOAK-BREAK-*` — all one artifact, H2).
|
|
- `flightrec.log` — 351 samples (~7 h): pct/docker/cc-latency/load/free + the leak sampler
|
|
(`c_rss/c_fd/c_sock` controller, `a_rss/a_fd/a_sock` agent). The leak headline lives here.
|
|
- `r0_snapshot.txt`, `p9_restore_snap.txt`, `d1_gate_ok`.
|
|
- `evidence/<TEST-ID>/` — per-test evidence (61 dirs).
|
|
|
|
## The pointers that matter
|
|
- **R1 (headline finding — bind-mount restore needs root):**
|
|
`evidence/T-SELFRESTORE/restore-test.out` (`pass:false`, `mp8 … only possible for root`),
|
|
`evidence/T-DR-BRINGUP/bringup.out` (same on the DR path).
|
|
- **R2 (agent VM.Audit/VM.Allocate gaps):** same two files (the `403 VM.Audit` config-read + the
|
|
`403 VM.Allocate` scratch-teardown lines).
|
|
- **H1 (dominant harness bug — auth-session expiry):** `evidence/T-STG-ENROLL/init1.txt`
|
|
(`CSRF token missing or invalid`), `evidence/T-RST-VW/{restore_resp.txt,canary_check.txt}`
|
|
(302→login, empty canary).
|
|
- **H3 (D1 not delivered):** `overnight.out` around the `[D1]` block (`sqlite3: … not found`).
|
|
- **Positives:** `evidence/T-PBS-VERIFY/`, `evidence/T-RESTORE-TEST-CRASH/`,
|
|
`evidence/T-FLT-{KILL9,AGENT,CF}/`, `evidence/T-BAK-FULL/`, `evidence/T-AUTH-1/`, `evidence/T-CSRF/`.
|
|
|
|
## Verdict in one line
|
|
One genuine pilot-critical product finding (R1/R2 — non-root can't restore a bind-mount guest);
|
|
the rest of the FAIL count is a single dominant harness bug (H1) plus a few calibration issues; the
|
|
product, where actually exercised, was healthy with zero resource leaks.
|