diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/implementation-review.md | 18 | ||||
| -rw-r--r-- | docs/validation/linux-vm-continued.txt | 115 |
2 files changed, 130 insertions, 3 deletions
diff --git a/docs/implementation-review.md b/docs/implementation-review.md index 0bf25c0..99ecf29 100644 --- a/docs/implementation-review.md +++ b/docs/implementation-review.md @@ -22,12 +22,24 @@ The specification review found five correctness issues: - Manual diagnostic requests ignored provider cooldowns. Retry-After now prevents further diagnostic requests to that provider, including manual Ping and Speed. - Competing HTTP and measurement timeouts could turn a completed duration-limited Speed observation into a generic error. Diagnostics now use one measurement deadline and report consumed bytes when the duration cap ends a nonempty measurement. -Spec findings: five correctness issues, corrected. The stale-selection forwarding path was the most serious finding. VM CLI regressions cover failed preflight retries and startup with stale capture and unset selection. The probe TLS changes and duration/rate-limit behavior still require end-to-end validation with the required current Xray runtime. +Spec findings: five correctness issues, corrected. The stale-selection forwarding path was the most serious finding. VM CLI regressions cover failed preflight retries and startup with stale capture and unset selection. The continued validation below covers probe TLS transport and duration/rate-limit behavior using non-TUN fixtures. Qualification of the full managed lifecycle on the required current Xray runtime remains pending. ## Validation boundary After the user's VM-only instruction, all test execution used the supplied ALT VM. Compilation and formatting used the local checkout. The VM checkpoint precedes package/test preparation and is restored after validation. -The current package available from that VM's refreshed Sisyphus repository is Xray 26.3.27. The implementation rejects activation with it. The tests therefore distinguish actual guard/controller/polkit/editor/recovery behavior from unverified native-TUN and diagnostic operation with the researched newer Xray contract. The product installer is not counted as a successful installation in this environment; system-bus tests stage their integration fixtures explicitly. +The current package available from that VM's refreshed Sisyphus repository is Xray 26.3.27. The implementation rejects activation with it. The tests distinguish actual guard/controller/polkit/editor/recovery behavior and fixture-backed diagnostics from unverified native-TUN forwarding and managed-probe lifecycle operation with the researched newer Xray contract. The product installer is not counted as a successful installation in this environment; system-bus tests stage their integration fixtures explicitly. -The final available suite passed on 2026-10-30: 10 Rust CLI/controller acceptance tests and 21 VM workflow checks. The [captured output](validation/linux-vm.txt) records the tested executable digest and each result. Checks include TCP and UDP DNS destination policy, IPv4/IPv6 blocking, retained incoming connections, denial/allow authorization, ordinary-user TUI restoration, editor privacy, failed-preflight retries, stale capture with unset selection, malformed TOML recovery, missing durable state, and uninstall retention/purge. +The initial available suite passed on 2026-10-30: 10 Rust CLI/controller acceptance tests and 21 VM workflow checks. The [captured output](validation/linux-vm.txt) records the tested executable digest and each result. Checks include TCP and UDP DNS destination policy, IPv4/IPv6 blocking, retained incoming connections, denial/allow authorization, ordinary-user TUI restoration, editor privacy, failed-preflight retries, stale capture with unset selection, malformed TOML recovery, missing durable state, and uninstall retention/purge. + +## Continued implementation and review + +Independent standards and specification reviews compared candidate `7999fab` against `fc3c1d51b1be9db6ba6ad286584fbc34bb305f38`. Standards found no actionable issues. Spec found one P2 issue: a JSON error document larger than the diagnostic prefix could count as a successful Speed download. A bounded-memory scanner now checks top-level error markers throughout consumed response chunks. Controller acceptance checks cover long error values, late and escaped error keys, legitimate nested payload fields, and HTML after long leading whitespace. All pass. + +The continued work also corrected diagnostic CLI exit status after provider rejection and stale successful observations after probe startup failure. Probe sessions now use the runtime boundary, and both production and acceptance fixtures share the authenticated HTTPS proxy configuration. Networking units use a shared dependency drop-in so the guard starts first. + +The final available suite passed on 2026-10-30: 20 Rust acceptance tests and 29 VM workflow checks. The [continued captured output](validation/linux-vm-continued.txt) records the tested executable digest and results. All tests ran only on the supplied ALT VM. The diagnostic fixtures used its distribution-owned Xray 26.3.27 in non-TUN mode, a temporary trusted CA, an authenticated HTTPS proxy, a real Trojan TLS connection, and a local HTTPS provider. Checks covered TLS failures without direct fallback, redirects and error documents, byte/time limits, both Retry-After header forms, cancellation, scheduling, and CLI failures. Temporary certificates and trust anchors were removed afterward. + +System checks used actual terminal polkit/PAM authentication with wrong and correct temporary fixture passwords, cancellation, and noninteractive denial. A real VM reboot retained enabled/blocked intent, and the guard became active before NetworkManager. SIGKILL and SIGSTOP checks retained protection; explicit recovery persisted disabled intent before releasing it. The reboot fixture deliberately had no selected configuration, so it does not qualify successful native-TUN forwarding after reboot. + +The required Xray 26.10.29 distribution package was unavailable in the refreshed VM repository. Production compatibility requirements remain unchanged. Full native-TUN forwarding, successful managed-probe startup, and the product installation lifecycle on that package remain unqualified. The VM checkpoint was restored after this run. diff --git a/docs/validation/linux-vm-continued.txt b/docs/validation/linux-vm-continued.txt new file mode 100644 index 0000000..2683a56 --- /dev/null +++ b/docs/validation/linux-vm-continued.txt @@ -0,0 +1,115 @@ +Candidate SHA-256: 991a9548054179821055a063dd8134637b727fb06108c62bcbd2214015cebf03 +xray-core-26.3.27-alt2.x86_64 +libnftnl-1.3.2-alt1.x86_64 +libmnl-1.0.5-alt2.d24c886.x86_64 +Running: cli_acceptance-8ac5b3df5e4cd10a + +running 2 tests +test subscription_url_cannot_be_passed_on_the_command_line ... ok +test help_describes_the_controller_commands_without_contacting_services ... ok + +test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s + +Running: roentgen-2037e66e0f348630 + +running 0 tests + +test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s + +Running: diagnostics_acceptance-f430a3a9a6964e8f + +running 10 tests +test cancelling_a_bus_diagnostic_stops_it_without_changing_proxy_intent ... ok +test cli_exits_unsuccessfully_when_the_provider_rate_limits_a_diagnostic ... ok +test controller_ping_uses_the_selected_trojan_path_with_verified_tls_without_enabling ... ok +test controller_records_a_failed_check_when_a_previously_working_probe_cannot_start ... ok +test controller_rejects_an_untrusted_target_or_local_proxy_without_direct_fallback ... ok +test controller_rejects_redirects_oversized_ping_and_error_downloads ... ok +test controller_rejects_streamed_json_errors_without_misclassifying_payload_fields ... ok +test controller_speed_stops_at_the_first_byte_or_duration_limit ... ok +test provider_retry_after_blocks_manual_ping_and_speed_for_both_header_forms ... ok +test scheduled_checks_use_only_selection_never_run_speed_and_do_not_overlap ... ok + +test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s + +Running: controller_acceptance-7693ccc2191fcbcc + +running 8 tests +test denied_operations_leave_durable_state_unchanged ... ok +test importing_requires_explicit_selection_and_enabling ... ok +test mixed_base64_import_keeps_all_rows_and_prohibits_invalid_selection ... ok +test losing_a_selection_keeps_enabled_intent_and_blocks_without_replacement ... ok +test failed_fetch_preserves_selection_but_an_empty_received_list_clears_it ... ok +test label_changes_keep_identity_but_duplicate_candidates_clear_selection ... ok +test persisted_intent_restores_under_protection_after_controller_restart ... ok +test explicit_unset_and_deletion_never_disable_or_select_another_entry ... ok + +test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s + +Running: roentgen-0d6b8b6ef4b4cfd3 + +running 0 tests + +test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s + +Running: vm_guard_acceptance.py +{ + "passed": [ + "private IPv4/IPv6 destinations stay direct on ports 53 and 18080", + "public IPv4/IPv6 destinations are blocked on ports 53 and 18080", + "UDP DNS follows the same IPv4/IPv6 private/public destination rule", + "classified incoming TCP connection survives guard replacement and toggles", + "preexisting outgoing TCP connection receives no established-flow exemption", + "explicit disabled guard restores ordinary direct routing" + ] +} +Running: vm_boot_acceptance.py hang +{ + "passed": [ + "guard remains armed while controller is stopped", + "explicit recovery terminates a hung controller and persists disabled intent before releasing protection" + ], + "recovery_seconds": 0.03 +} +Running: vm_boot_acceptance.py prepare-boot +Enabled/blocked boot fixture prepared; reboot the VM next. +Rebooting the authorized ALT VM. +Running: vm_boot_acceptance.py verify-boot +{ + "passed": [ + "normal reboot restores enabled/blocked intent", + "guard becomes active before NetworkManager", + "SIGKILL does not release guard protection", + "systemd restarts the controller without disabling intent" + ], + "guard_active_us": 5099817, + "network_manager_active_us": 5246105 +} +Running: vm_controller_acceptance.py +{ + "passed": [ + "real HTTP import remains disabled/unselected and public CLI output omits credentials", + "noninteractive non-root mutation is denied with durable state unchanged", + "terminal polkit prompts under an ordinary user; cancellation leaves selection, intent and generation unchanged", + "terminal polkit rejects a wrong password and authorizes the real mutation after valid VM-fixture PAM authentication", + "polkit site allow policy authorizes the actual ordinary bus caller", + "mixed update retains ordered invalid/unsupported rows and normalized identity", + "whole-document failure preserves selection while received empty list clears it", + "unsupported packaged Xray activation is rejected before enabled intent changes", + "service restart retains explicit selection and disabled intent", + "editor receives literal arguments and a user-owned private snapshot that is removed afterward", + "ordinary-user TUI renders, accepts navigation/help/quit, restores terminal modes, and preserves service intent", + "restart and scheduled retry preserve blocked intent after failed compatibility checks", + "restart with unset selection removes stale capture and keeps TUN forwarding blocked", + "explicit recovery persists disabled intent even with malformed editable TOML", + "subscription deletion clears selection without replacement", + "missing durable enabled state fails closed; only explicit recovery initializes disabled state", + "uninstall retains saved data by default, explicit purge removes it, and system Xray remains installed" + ] +} +ALL AVAILABLE VM TESTS PASSED: 20 Rust acceptance tests and 29 VM workflow checks + +Post-validation restoration: roentgen-before-implementation checkpoint restored. +SSH/PVE guest identity verified by the reset helper. +Read-only guest checks confirmed no product executable, configuration, state, +fixture accounts, roentgen nftables table, or test-installed Xray package remained. |