Create a verified VHD on external storage #21
Labels
No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
phg/iodd-tool#21
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Parent
IODD Tool specification
What to build
Integrate the agreed fixed-size VHD creation with the production external-storage adapter. Validate its access, complete host allocation and lifecycle through disposable virtual volumes before enabling the software-validated write path.
Acceptance criteria
Blocked by
Validation contract
Completion requires the applicable independently checked software evidence in Set validation gates and the implementation handoff. A closed policy decision does not establish that implementation tests have passed. Use disposable images/virtual volumes and controlled faults; no hardware-trial or performance gate applies.
Scope
This ticket belongs to the later implementation effort. All planning decisions are resolved; current work covers tracker and documentation updates. The parent specification indexes the authoritative product and software-validation contracts. Forgejo governs live updates; retained local files record the handoff.
The shared, feature-gated host mutation/recovery foundation is integrated and pushed on
implement/iodd-tool-spec-7at863acd577f555daf2ea082338ef33e9e1755fa03(exact candidate08ac15690ff037fc6d121023fbc51f9efe1ca788). Independent focused validation passed 35 test functions / 74 expanded cases, including owned bounded Create and explicit rollback; canonical arm64 app/worker release builds and macOS 15 minimum checks passed. The public session retains bounded storage, checked recovery and locked state, and preserves the existing image workflow.This is an interim foundation milestone: ticket #21 remains open and native mutation/UI enabling remains gated. Production authorization, worker lifetime, native writes, restoration, and both-runtime qualification are still being implemented. Tickets #22 and #23 have resumed their distinct Defrag/Compact integration against this pushed interface; unfinished native working-tree changes were excluded from the milestone.
The shared freshness/recovery correction is integrated and pushed on
implement/iodd-tool-spec-7at0fbe105529b16f692b0e5e02db1655a84be56fc3. Current hardware virtual-drive activity is rechecked before retained-session review or writes. A known-active observation invalidates the old review; clearing that observation alone does not revive its preview.Review also caught and rejected a permanent-latch recovery dead end before integration. The corrected public
renewPreparation(preparationDeclared:)obtains a fresh read-only review under the same held owner, invalidates old preview IDs and preserves recovery-required status until checked replay. The new interrupted-creation regression verifies failed/known-active renewal, unchanged target bytes during renewal, stale-preview refusal, explicit rollback and safe closure.The exact corrected candidate passed independent focused validation: 31 functions / 82 expanded cases, followed by canonical arm64 app/worker release builds, plist/macOS 15 minimum checks and a clean milestone diff check. The final tip preserves the tested product sources; a separate cleanup removed only one extra trailing newline from the new test file. Defrag and Compact retain independent after-preview failure traces and are rerunning them against this pushed correction.
Ticket #21 remains open. Initial signed production-worker FAT32 and exFAT Create probes have passed on the disposable macOS 27 guest with independent VHD/content/surrounding-byte/cache checks; their original mount sets were empty, so these are not mounted-restoration, lifetime, baseline-runtime or final-release gates. All native production operation flags remain gated while broader qualification continues.
Independent review of the pending common-worker candidate found and corrected two issues before integration: imported recovery metadata could influence a native remount destination, and a synchronous public cancellation request from a progress callback could deadlock the sole reply reader. Native restoration now uses freshly captured complete mount bindings; unapproved historical destinations produce separate restoration refusals. Ordered progress delivery now runs independently of reply decoding, with control acknowledgments able to complete while the callback waits.
The callback failure was reproduced with the signed ordinary worker on the disposable macOS 15 guest at
269be86ac5862498502e4659db603d4b59b6d68d. The corrected signed candidate3bc3c8024199b281231bc88dc984c8c350626870acknowledged callback cancellation and returned cancelled/notRequired in order. Independent complete existing-file/allocation/metadata and sibling/outside-selected checks passed, no image was published, and the nonrepairing exFAT checker returned zero with unchanged input bytes. This is scoped Create/cancellation evidence, not final all-operation or distribution qualification.Common integration remains held at the pushed
0fbe105529b16f692b0e5e02db1655a84be56fc3. A new controlled Defrag All failure trace exposed a retained unsafe owner after all file commits but a failed final scan. The completed journal and retirement evidence remain intact; an explicit completed-state verification path and adversarial regression cases are being implemented before the common candidate is merged. Ticket #21 remains open, and all native production operation flags remain gated.The reviewed shared-worker milestone is integrated and pushed at
ecbee7b9ec43e9197f3f8092b74d77411b131913onimplement/iodd-tool-spec-7. The merged tree exactly matches validated candidateaac0651e8f8f33a153cbafd5f52ba7ded814c817; product sources match reviewed completion candidate255f37a2c718501d3de03faedaaa5a9e657fd7f2, with the intended Defrag/Compact test union.Independent ordinary release validation passed 54 functions / 217 expanded cases with zero issues in 55.179 seconds. This includes both operations observing hardware activity between files, all twelve FAT32/exFAT final-scan completion-proof cases, and the 22 Compact safety-gate cases checking exact refusal reasons and separate restoration outcomes. The initial combined run exposed a test expecting the older error type; the corrected test adds restoration assertions and retains whole-image/no-write checks. Canonical arm64 app/worker, macOS 15 minimum, plist, packaged-component and milestone diff checks passed.
The milestone includes continuous native write/cache preparation checks, freshly captured remount authority, ordered client callbacks, and explicit retained completed-state verification without target writes. Distinct operation views are joining this pushed interface. Full tickets #21–#23 remain open and all native production flags remain gated. A subsequent signed native test found the installer lease was available after a safe operation close while the ordinary worker remained alive; the required whole-worker-lifetime lock is being corrected and qualified before final native/release gates. Removed-target release and global recovery evidence access are separate pending checkpoints, not claimed complete by this milestone.
The shared worker/lifecycle/recovery milestone is integrated and pushed on
implement/iodd-tool-spec-7atc9783b75b9b5b1ded87895174981f45212d1037b. Its entire tree exactly matches frozen candidate103ddf8e0e8712211b8358b20221ec921dfd5cdb; all four native production operation flags remain gated.The worker now retains its installer lease through its complete process lifetime. A separate private UI connection reservation prevents duplicate control connections while permitting authenticated retry after an unsafe UI exit leaves stale endpoint metadata. Endpoint data is protected before atomic publication, so failed protection preserves the prior record. Independent review and genuine failure traces also corrected per-record recovery inventory failures that previously blocked intact exports or silently omitted newly unreadable evidence. The parent workflow joins all three operation views and remains responsible for safe close/remount.
Exact-source ordinary release validation passed all 243 functions with zero issues in 827.645 seconds. Fresh independent merger validation passed 67 functions / 246 expanded cases in 54.597 seconds, followed by canonical arm64 app/worker builds, macOS 15 minimum, plist, packaged-component equality, full-tree identity and diff checks. A tooling-capacity interruption was handled with a separate worktree; the original checkout and unfinished test/evidence history were preserved.
The exact signed artifact passed a scoped macOS 15 unsafe-EOF test: a real endpoint-write denial left the same unsafe worker alive and its lease held; restoration of only the task-owned directory permissions allowed the same UI to reconnect, explicitly renew preparation and perform matched checked rollback. The complete 42,395,648-byte backing matched the independent pristine image, the nonrepairing raw exFAT checker returned zero with unchanged input, and normal GUI exit/ordinary detach left no owned worker or attachment. The setup used real writes and cache ioctl success followed by an explicitly modeled cache-report failure; it does not assert a physical cache or power-loss fault.
Same-source macOS 15 FAT32/exFAT Create and Writing-zeros Stop checks passed independent VHD/footer/zero-content/complete-allocation and original-record/sibling/outside preservation checks, appropriate nonrepairing checkers and normal cleanup. Ticket #21 remains open: current-stable macOS qualification, remaining access/restoration/interruption conditions and conservative handling of unmatched foreign recovery evidence are still being completed. Defrag is resuming its distinct native qualification against this pushed worker on the reserved macOS 27 guest. No final release, notarization, hardware or whole-ticket acceptance is claimed by this milestone.
The reviewed recovery-safety milestone is integrated and pushed on
implement/iodd-tool-spec-7at7dbe08cf5365ce65f81d912a93e4375a4bc09d29. Qualified product sources match95eac7f1329ec078b370a65d37b3597f6ac3db19(Sourcesbb5b8f58f0abd02f3dc8b44ce504b93a022d7934). All four native production operation flags remain disabled.Fresh admission refuses unmatchable, misplaced or ambiguous pending evidence before taking offline ownership. A retained owner cannot become safe merely because one selected journal was replayed: all pending evidence must be accounted for. Checked registry identity, failed observations, evidence I/O and fresh close inventory remain conservative, including preserved/missing/replaced namespaces. Genuine public failure traces and positive matched/idempotent recovery controls establish these corrections without clearing original evidence or granting historical metadata remount authority.
Independent review also corrected the final Compact error formatter so domain reasons and localized native failures remain actionable. The diagnostic fixture now invalidates its own descriptor before close; a genuine reused-pipe probe reproduced stale-close EBADF/Python BrokenPipe and passed after the test-only fix. The probe relinquishes any mismatched descriptor before further reads or cleanup. This proves the fixture defect, not the cause of the original failed full runs; those inputs and receipts remain preserved separately.
Exact corrected
95eac7fordinary arm64 release validation passed all 259 functions with zero issues in 1141.623 seconds (actual exit 0); all 25 preserved executable/resource hashes are unchanged. Canonical app/worker, minimum macOS 15/plist and strict Developer ID signatures passed. The integration union adds only the separate checker-compatible Defrag fixture generator; union qualification details: six functions / 20 expanded cases passed with zero issues in 41.284 seconds, fresh two-filesystem fixture generation/oracle/preservation checks passed, and canonical arm64 app/worker packaging, macOS 15 minimum, plist, built-to-bundled bytes and all 23 packaged fixture hashes passed. The resource-union Tests tree differs by this one generator; the exact-source full proof is not relabelled whole-tree equality.The exact signed app also passed an actual macOS 15 Compact preparation-refusal check: the unchecked fresh declaration produced plain actionable text, with zero target writes and complete original-record/allocation/metadata/sibling/outside preservation. Fresh public review found no unresolved evidence; ordinary parent Finish recorded native close 0, the nonrepairing raw exFAT checker returned 0 without changing the full backing hash, and normal GUI exit/detach left both leases free and no owned UI/worker/endpoint/attachment.
Ticket #21 remains open. The collectors are completing current-source Defrag/Compact/creation joins and both-runtime access/lifecycle evidence on disposable macOS 15 and 27 guests. Older
103ddf8results and current unchanged-Core worker evidence retain their exact scope. This milestone does not enable production writes, close #21–#23, or establish final distribution/notarization, physical IODD, 4K or power-loss qualification.A later native test-provider interruption stopped both test VMs during remaining acceptance. Both VM disk/config/NVRAM states were preserved before restoring their runners. The original macOS 27 Stop result and full held-data witness are retained, but its old application Finish/close remain unverified. Fresh guest/evidence audits and normal public review continue; the interruption does not establish cleanup or final acceptance.
Qualification progress; ticket remains open and production flags remain false.
Pushed integration 3a94080 now contains the independently reviewed external mutation validation ledger and its adjacent JSON source/artifact/evidence commitments. This merge changes documentation only; app/worker/Tests/Package/scripts remain the qualified0dc code. The ledger has a stated evidence cutoff; the later macOS15 handback below is a subsequent milestone, not a rewritten frozen observation.
Actual signed0dc exFAT Create/Compact integration now has scoped positives on macOS15.6.1/24G90 and27.0.1/26A434, as standard UID502. The27 case first refused the16MiB request because4095 contiguous clusters were insufficient for4097, then separately reviewed/confirmed Compact, completed fresh analysis, and separately reviewed/confirmed a NEW Create. The15 case explicitly reviewed the complete allocation target, committed five small-file moves, obtained fresh analysis/backup, then separately confirmed Create. No automatic prerequisite movement or automatic Create occurred.
Both new16MiB VHDs passed independent footer/checksum/capacity/exact16,777,728-byte EOF, all16,777,216 guest bytes zero, and one complete4097-cluster extent (16,781,312 allocated bytes), plus QEMU checks and original-file/full-allocation/slack/metadata/free/pinned/sibling/outside preservation. Both had actual native close0, nonrepairing filesystem check0/input unchanged, normal Quit, free leases and ordinary detach. The15 case independently measured restoration of BOTH original selected/sibling mount paths; its transient GUI remount status text was not captured, and post-OS-remount byte equality is excluded. Root independently verified55 references for27 and100 for15.
An EXTRA collector assertion that new cluster slack beyond logical EOF should be zero failed and remains preserved separately; the corrected observation records its actual bytes. The authoritative creation contract requires guest-zero initialization, footer/exact EOF and complete-file allocation separately, without that additional slack-zero guarantee. Original files’ complete allocation/slack preservation remains required. Ambiguous preview wording is recorded for the final UI clarification; no backend change or operation repeat was made.
Remaining27 workflow/recovery joins, operation flag qualification, final frozen both-OS acceptance, whole-integration review, lifecycle/install, notarized/stapled release and Homebrew gates remain open under21–24. Existing failures and excluded timing/close observations retain their original scope. No hardware/IODD/physical power-loss or performance claim is added.
Resolved on 381442f, pushed and remote-confirmed on implement/iodd-tool-spec-7. Its entire tree matches reviewed candidate
d514e5516f; all four native operation flags are enabled.Independent Standards and Spec reviews found no issues. Canonical arm64 builds, macOS 15 minimum/plist, Developer ID hardening/timestamps and strict component signatures passed. The public safety cohort passed 2 functions / 3 cases (exit 0, 7.268 seconds). The later capture helper's exit 1 remains preserved separately, followed by read-only inventory completion. Signed development archive SHA-256: 5e428352dfc9848836891840f2e6bb6d5eb35030f3025bbd603ba038341afabb (2,847,620 bytes).
The dated ledger and adjacent JSON retain earlier evidence and exact source/artifact bindings. Later d514 observations below supplement that snapshot. The older 95eac full 259-function PASS, fixture union and failed 8cb/7fc full runs retain their separate scope; no binary equivalence, original-cause or flake conclusion is inferred.
Create revalidates the target, hardware preparation and approved preview, retains whole-device isolation, checks required synchronization, and preserves failed/interrupted evidence until explicit matched recovery. Public RED→GREEN and positive recovery controls establish conservative handling of ambiguous, misplaced, unreadable and missing/replaced evidence. Replaying one journal cannot clear unrelated pending evidence.
Exact signed d514 passed one mounted exFAT Compact → fresh analysis → separately confirmed NEW 16 MiB Create on macOS 15.6.1 / 24G90 as non-admin UID 502. Independent guest and HOST oracles preserved all six offline-baseline files, complete allocations/slack, metadata, pinned/system/free-map and sibling/outside bytes. The VHD passed footer checksum/capacity, all 16,777,216 guest bytes zero, exact 16,777,728-byte EOF, one complete 4097-cluster extent (16,781,312 allocated bytes) and QEMU checks. Fresh safe review preceded native close 0; both original mounts were measured restored. Quit, raw exFAT check 0 with unchanged input and ordinary detach left no owner. ROOT verified all 84 references.
The same archive passed macOS 27.0.1 / 26A434's representative FAT File → fresh All case and safe cleanup (315 references). Prior FAT32/exFAT Create, Writing-zeros Stop and modeled-report rollback retain their stated scope. Wording now separates guest zeros, footer and complete allocation. The EXTRA new beyond-EOF slack-zero assertion remains failed/excluded; original-file slack preservation is still required. OS unmount does not prove IODD hardware detachment; modeled report errors after successful real writes/cache calls remain labelled.
Final frozen suites on both supported runtimes, whole-integration review, complete app smoke, supported manual/Homebrew lifecycle, notarization/stapling, immutable DMG and clean-user Gatekeeper/cask distribution remain in #24. This closes the operation implementation, not final release. Physical IODD, 4K, power-loss and performance qualification are neither claimed nor added as prerequisites.