--- binding-DJNQQ2RA/fp-driver-d2-r6-configured.sh +++ fp-driver-d2-r10-P9RLK4VU.sh @@ -57,7 +57,7 @@ # t2 at the outcome of the setup, beside D1, BEFORE any teardown is requested — so the # state at a refusal is captured while it still exists. # t3 immediately before the teardown request is written, with the manifest hashed first. -# TWO BUDGETS, ENFORCED AND SEPARATE (plan §4): a 300 s EXPERIMENTAL budget and a 180 s +# TWO BUDGETS, ENFORCED AND SEPARATE: the DERIVED experimental budget below and a 180 s # CLEANUP REPORTING deadline. The experimental deadline ENDS ACTIVITY AND STARTS # CLEANUP — it exits through the EXIT trap, which is the only way cleanup is ever # entered, so a truncated run tears down exactly like a complete one. The reporting @@ -195,7 +195,7 @@ # executor's hash-verified PREPARED/NOT_STARTED acknowledgment # run under THIS bound; the experimental window does not exist # yet while they do. -EXP_BUDGET_S=300 # plan §4: experimental total, from GO -- NOT from run start +# EXP_BUDGET_S is derived below (P9RLK4VU), from GO -- NOT from run start. CLEANUP_REPORT_S=180 # plan §4: cleanup REPORTING deadline, from the end of activity HANDOFF_WAIT_S=900 # bounded wait for a liam receipt; narrowed at the point of # waiting to what remains of the experimental budget @@ -209,12 +209,36 @@ # KILL_GRACE_S caller reporting reserve; native setup, termination and confirmation # live inside the launcher's own deadline. Only retained created handles # authorize termination. No PID-tree sweep or guard bypass exists. -# HANDOFF_CAP_S a POLICY ALLOCATION of the activity window -- how much of the 300s this -# run will spend waiting on another agent. 94s and 134s are two samples, -# not a distribution, and nothing here is derived from them. +# HANDOFF_CAP_S retained 120s policy for PREPARE, GO and cleanup handoffs. +# P9RLK4VU supersedes it for SETUP ONLY, whose receipt follows execution. LEDGER_RESERVE_S=30 KILL_GRACE_S=5 HANDOFF_CAP_S=120 +# AQ23KKNI: independent execution allocation, not notification/handoff time. +# 9s measured around a refused capture + existing 90s capture cap + 5s reserve + 16s margin. +ELEVATED_LEG_BUDGET_S=120 +# P9RLK4VU, run 20260914T063552Z; timeline.txt and executor's measured latency: +# setup: 112s notification/read/launch latency + 120s leg + 8s receipt margin = 240s. +# post probes: two portfields calls at up to 45s + census 46s = 136s observed on this +# host. Add 64s for identity capture, D1 and bookkeeping: an ALLOWANCE, not a measured +# complete post-receipt path (that path was not reached in the fifth window). +# t3 measured 25s, also 25s in run 20260913T041410Z; t2 retains the 90s capture +# ceiling rather than inheriting 180s. Its 100s allocation adds the 5s launcher +# reporting reserve plus 5s shell/reporting margin. +# GO-to-request measured 54s: pre-dispatch allowance 74s adds 20s margin. +# Activity = 74 + 240 + (200 + 100) + 16 transition reserve = 630s. +# Prep 600 and cleanup-report 180 INCLUDING ledger 30 are unchanged. No window grant. +SETUP_LATENCY_S=112 +SETUP_HANDOFF_MARGIN_S=8 +SETUP_HANDOFF_CAP_S=$((SETUP_LATENCY_S + ELEVATED_LEG_BUDGET_S + SETUP_HANDOFF_MARGIN_S)) +POST_RECEIPT_PROBE_S=$((2 * 45 + 46 + 64)) +T2_NATIVE_CEILING_S=90 +T2_BOUND_S=$((T2_NATIVE_CEILING_S + KILL_GRACE_S)) +T2_ALLOWANCE_S=$((T2_BOUND_S + 5)) +POST_RECEIPT_S=$((POST_RECEIPT_PROBE_S + T2_ALLOWANCE_S)) +PRE_DISPATCH_ALLOWANCE_S=$((54 + 20)) +ACTIVITY_TAIL_RESERVE_S=16 +EXP_BUDGET_S=$((PRE_DISPATCH_ALLOWANCE_S + SETUP_HANDOFF_CAP_S + POST_RECEIPT_S + ACTIVITY_TAIL_RESERVE_S)) # THE TEARDOWN COMMAND IS PINNED, NEVER COMPOSED (doyle 2026-09-13). The removal this run may # need is the PRODUCT'S OWN rendered cleanup command, which only the shipped binary can emit. # Until it has been emitted, decoded, reviewed and pinned here, cleanup REFUSES to dispatch any @@ -339,6 +363,14 @@ # command has finished, so it is never the command's creation record. HANDOFF_REQUEST_UTC=UNRECORDED HANDOFF_RECEIPT_UTC=UNRECORDED +HANDOFF_WAIT_END_UTC=UNRECORDED +SETUP_WAIT_STATUS=NOT_REQUESTED +SETUP_TERMINAL_RC=UNAVAILABLE +SETUP_FINAL_RECEIPT_READ=no +LEG_START_EPOCH=UNRECORDED +LEG_DEADLINE_EPOCH=UNRECORDED +LEG_CLOCK_STATUS=UNMEASURED +PRODUCT_QUERY_KILL=UNAVAILABLE TS_ORDER=UNMEASURED # the six stamps above compared with the calendar, not assumed PRE_SETUP_ABSENCE=UNRECORDED RESIDUE_COUNT=UNMEASURED @@ -597,10 +629,15 @@ local context="$1" local rf="$HO_RECEIPT" nonce="$HO_NONCE" local now; now=$(date +%s) - local started="$now" limit="$HANDOFF_WAIT_S" phase_deadline deadline remaining nap + local started="$now" limit="$HANDOFF_WAIT_S" phase_deadline deadline remaining nap cap="$HANDOFF_CAP_S" [ "$context" = cleanup ] && limit="$CLEANUP_HANDOFF_WAIT_S" + if [ "$context" = trial ] && [ "${SETUP_WAIT_STATUS:-}" = WAITING ]; then cap="$SETUP_HANDOFF_CAP_S"; fi deadline=$((started + limit)) - [ "$deadline" -gt "$((started + HANDOFF_CAP_S))" ] && deadline=$((started + HANDOFF_CAP_S)) + [ "$deadline" -gt "$((started + cap))" ] && deadline=$((started + cap)) + if [ "$context" = trial ] && [ "${SETUP_WAIT_STATUS:-}" = WAITING ]; then + # Request construction and notification spend the published deadline too. + [ "$deadline" -le "$SETUP_HANDOFF_DEADLINE" ] || deadline="$SETUP_HANDOFF_DEADLINE" + fi # Cleanup owns WORK_DEADLINE even if GO never happened; zero/unopened fails closed. if [ "$context" = cleanup ]; then phase_deadline="$WORK_DEADLINE" else phase_deadline=$(cur_deadline); fi @@ -656,6 +693,56 @@ echo "$n" } +# Shared by timely acceptance and the single final cleanup-side receipt observation. +# A terminal exit never overwrites SETUP_RC's timely-receipt/timeout disposition. +read_setup_terminal() { + local terminal_rc="$1" ts_hq ts_ss ts_se ts_t1s ts_t1e ts_hr + SETUP_TERMINAL_RC="$terminal_rc" + SETUP_START_UTC=$(leg_utc "$R/setup-start.utc") + SETUP_END_UTC=$(leg_utc "$R/setup-return.utc") + T1_START_UTC=$(leg_utc "$R/d2-t1-start.utc") + T1_END_UTC=$(leg_utc "$R/d2-t1-end.utc") + SETUP_EXIT_FILE=$(leg_exit "$R/setup.exit") + LEG_START_EPOCH=$(leg_exit "$R/elevated-leg-start.epoch") + LEG_DEADLINE_EPOCH=$(leg_exit "$R/d2-t1.deadline") + TS_ORDER=UNMEASURED + LEG_CLOCK_STATUS=UNMEASURED + if ts_readable "$HANDOFF_REQUEST_UTC" && ts_readable "$SETUP_START_UTC" && ts_readable "$SETUP_END_UTC" \ + && ts_readable "$T1_START_UTC" && ts_readable "$T1_END_UTC" && ts_readable "$HANDOFF_RECEIPT_UTC"; then + ts_hq=$(date -u -d "$HANDOFF_REQUEST_UTC" +%s); ts_ss=$(date -u -d "$SETUP_START_UTC" +%s) + ts_se=$(date -u -d "$SETUP_END_UTC" +%s); ts_t1s=$(date -u -d "$T1_START_UTC" +%s) + ts_t1e=$(date -u -d "$T1_END_UTC" +%s); ts_hr=$(date -u -d "$HANDOFF_RECEIPT_UTC" +%s) + TS_ORDER=VIOLATED + if [ "$ts_hq" -le "$ts_ss" ] && [ "$ts_ss" -le "$ts_se" ] && [ "$ts_se" -le "$ts_t1s" ] \ + && [ "$ts_t1s" -le "$ts_t1e" ] && [ "$ts_t1e" -le "$ts_hr" ]; then TS_ORDER=OK; fi + case "$LEG_START_EPOCH:$LEG_DEADLINE_EPOCH" in + *[!0-9:]*|:*|*:) ;; + *) + LEG_CLOCK_STATUS=VIOLATED + if [ "$LEG_START_EPOCH" -eq "$ts_ss" ] && \ + [ "$LEG_DEADLINE_EPOCH" -eq "$((LEG_START_EPOCH + ELEVATED_LEG_BUDGET_S))" ]; then + LEG_CLOCK_STATUS=WITHIN + [ "$ts_t1e" -le "$LEG_DEADLINE_EPOCH" ] || LEG_CLOCK_STATUS=EXCEEDED + fi ;; + esac + fi + record "SETUP_TERMINAL exit=$terminal_rc preserved_exit=$SETUP_EXIT_FILE setup=[$SETUP_START_UTC .. $SETUP_END_UTC] t1=[$T1_START_UTC .. $T1_END_UTC]" + record "TIMESTAMP_ORDER=$TS_ORDER handoff_request=$HANDOFF_REQUEST_UTC setup_start=$SETUP_START_UTC setup_return=$SETUP_END_UTC t1_start=$T1_START_UTC t1_end=$T1_END_UTC receipt_observed=$HANDOFF_RECEIPT_UTC" + record "ELEVATED_LEG_CLOCK start=$LEG_START_EPOCH deadline=$LEG_DEADLINE_EPOCH budget=${ELEVATED_LEG_BUDGET_S}s status=$LEG_CLOCK_STATUS — notification latency belongs only to the handoff" + [ "$SETUP_EXIT_FILE" = "$terminal_rc" ] || record "SETUP_EXIT_DISAGREES_OR_UNAVAILABLE receipt=$terminal_rc leg_file=$SETUP_EXIT_FILE — neither value replaces the other" + return 0 +} + +record_product_query_findings() { + PRODUCT_QUERY_KILL=UNAVAILABLE + [ -n "${SETUP_ERR:-}" ] && [ -f "$SETUP_ERR" ] || return 0 + PRODUCT_QUERY_KILL=NOT_RECORDED + if grep '^bootstrap-firewall leg=verify-query .* outcome=killed$' "$SETUP_ERR" > "$R/product-query-findings.txt"; then + PRODUCT_QUERY_KILL=OBSERVED + record "PRODUCT_FINDING leg=verify-query outcome=killed evidence=$R/product-query-findings.txt — separate from handoff/capture deadline failure" + fi +} + # PREPARATION (600 s, carried from the provisioning controller). Read-only preflight and # the executor's hash-verified PREPARED/NOT_STARTED acknowledgment. NO EXPERIMENTAL TIME IS SPENT # HERE: the experimental clock does not start until go(), and every activity step @@ -685,6 +772,7 @@ EXP_DEADLINE=0 # RUN_EPOCH + EXP_BUDGET_S, set at go() REPORT_DEADLINE=0 # CLEANUP_EPOCH + CLEANUP_REPORT_S, set at end_experimental() WORK_DEADLINE=0 # REPORT_DEADLINE - LEDGER_RESERVE_S, same place +OBSERVATION_DEADLINE=0 # post-receipt probe/t2 suballocation; cleanup never uses it SETUP_COMPLETION=UNPROVEN # R6: proven only by a run-bound receipt with terminal fields CLEANUP_STOP_STATE=NOT_REACHED # which gate outcome step 1 took (IR-124) TEARDOWN_DISPATCH=NOT_REACHED # whether a teardown command was dispatched, and why not @@ -847,6 +935,26 @@ now=$(date +%s); used=$((now - RUN_EPOCH)); left=$((EXP_BUDGET_S - used)) [ "$left" -lt 0 ] && left=0 echo "$left" +} +require_setup_budget() { # AVAILABLE_SECONDS PHASE(before-go|before-dispatch) + local available="$1" phase="$2" + local required=$((SETUP_HANDOFF_CAP_S + POST_RECEIPT_S + ACTIVITY_TAIL_RESERVE_S)) + [ "$phase" = before-go ] && required=$((required + PRE_DISPATCH_ALLOWANCE_S)) + case "$available" in (''|*[!0-9]*) record "SETUP_BUDGET_REFUSED phase=$phase available=$available"; return 1 ;; esac + record "SETUP_BUDGET phase=$phase available=${available}s required=${required}s handoff=${SETUP_HANDOFF_CAP_S}s post_probes=${POST_RECEIPT_PROBE_S}s t2=${T2_ALLOWANCE_S}s transition=${ACTIVITY_TAIL_RESERVE_S}s" + if [ "$available" -lt "$required" ]; then + record "SETUP_BUDGET_REFUSED — no setup request may be dispatched; a smaller remaining window is not a smaller execution grant" + return 1 + fi + return 0 +} +observation_budget() { # LABEL ALLOCATION_SECONDS RESERVE_AFTER_SECONDS + local label="$1" allocation="$2" reserve="$3" now ceiling + now=$(date +%s) + OBSERVATION_DEADLINE=$((now + allocation)) + ceiling=$((EXP_DEADLINE - reserve)) + [ "$OBSERVATION_DEADLINE" -le "$ceiling" ] || OBSERVATION_DEADLINE="$ceiling" + record "OBSERVATION_BUDGET label=$label deadline=$OBSERVATION_DEADLINE reserve_after=${reserve}s" } # r5: actual argv vector, owned job confirmation, direct state kept separate. BOUNDED_STATE=NOT_REACHED @@ -1003,6 +1111,7 @@ cur_deadline() { if [ "$CLEANUP_EPOCH" -ne 0 ]; then echo "$WORK_DEADLINE" elif [ -z "$RUN_EPOCH" ]; then echo "$PREP_DEADLINE" + elif [ "$OBSERVATION_DEADLINE" -gt 0 ] && [ "$OBSERVATION_DEADLINE" -lt "$EXP_DEADLINE" ]; then echo "$OBSERVATION_DEADLINE" else echo "$EXP_DEADLINE"; fi } # THE EXECUTABLE MUST BE NAMED TO WINDOWS. A call site spells its program the way bash finds @@ -1044,7 +1153,7 @@ exit 8 } # GO - THE ONE PLACE THE EXPERIMENTAL CLOCK EVER STARTS (doyle 2026-09-13). It is a -# separate act from preparation on purpose: the 300s window pays for THIS RUN'S ACTIVITY, +# separate act from preparation on purpose: the derived window pays for THIS RUN'S ACTIVITY, # and it must not already be running while an elevated operator reads a request. MEASURED # REASON: run 20260913T041410Z spent 134s of its 300s at the setup handoff and reached # neither t1 nor t2. @@ -1554,6 +1663,18 @@ [ "$r6_nonce" -eq 1 ] || r6_missing="$r6_missing nonce-lines=$r6_nonce" r6_exit=$(HO_RECEIPT="$SETUP_RECEIPT" handoff_exit) [ "$r6_exit" = 255 ] && r6_missing="$r6_missing exit-record-unread" + # One final observation at the cleanup boundary, after the timed wait has ended. + # Recover terminal stamps from a late receipt; never resume activity or erase its timeout. + if [ "$SETUP_WAIT_STATUS" = EXPIRED ] && [ "$SETUP_FINAL_RECEIPT_READ" = no ]; then + SETUP_FINAL_RECEIPT_READ=yes + if [ "$r6_nonce" -eq 1 ] && [ "$r6_exit" != 255 ]; then + HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + read_setup_terminal "$r6_exit" + record "HANDOFF_FINAL_RECEIPT observed=$HANDOFF_RECEIPT_UTC wait_ended=$HANDOFF_WAIT_END_UTC — late terminal evidence, NOT timely acceptance" + else + record "HANDOFF_FINAL_RECEIPT unavailable_or_invalid — setup remains unproven; no second wait or retry" + fi + fi case "$SETUP_END_UTC" in ABSENT|UNPARSEABLE|'') r6_missing="$r6_missing setup-return-stamp=$SETUP_END_UTC" ;; esac @@ -1892,15 +2013,18 @@ local qf=$(( ${D2_T1_QF:-0} + ${D2_T2_QF:-0} + ${D2_T3_QF:-0} )) if [ "$D2_T1" = 0 ] && [ "$D2_T2" = 0 ] && [ "$D2_T3" = 0 ] \ && [ "$t1v" = COMPLETE ] && [ "$t2v" = COMPLETE ] && [ "$t3v" = COMPLETE ] \ - && [ "$qf" -eq 0 ]; then + && [ "$qf" -eq 0 ] && [ "$LEG_CLOCK_STATUS" = WITHIN ]; then CAPTURE_CONTRACT=SATISFIED fi + record_product_query_findings { echo "D2 RUN LEDGER — run=$RUN_ID" echo " this file reports; it does not congratulate. The driver's own exit means the" echo " sequence ran and this ledger was written, never that the run was green." echo "EXITS, four separate values, none inferred from another:" echo " setup_elevated_exit=$SETUP_RC" + echo " setup_terminal_exit=$SETUP_TERMINAL_RC (may be learned after timeout; does not replace setup_elevated_exit)" + echo " handoff_wait=$SETUP_WAIT_STATUS wait_end=$HANDOFF_WAIT_END_UTC final_receipt_read=$SETUP_FINAL_RECEIPT_READ" echo " d2_t1_exit=$D2_T1 (UNAVAILABLE = the elevated capture never ran: a labelled evidence gap)" echo " d2_t2_exit=$D2_T2" echo " d2_t3_exit=$D2_T3" @@ -1909,6 +2033,9 @@ echo " t1=$t1v t2=$t2v t3=$t3v" echo "QUERY FAILURES among the required observations -- observed, recorded, and NOT successful:" echo " t1=${D2_T1_QF:-0} t2=${D2_T2_QF:-0} t3=${D2_T3_QF:-0} (any nonzero refuses the contract, however valid the document is)" + echo "PRODUCT FINDINGS, independent of the handoff squeeze:" + echo " verify_query_outcome_killed=$PRODUCT_QUERY_KILL evidence=product-query-findings.txt" + echo " M5XKQ2DN historical failed candidate b8482445: query budget=3000ms, starts before spawn and includes output collection" echo "IDENTITY the records bind to (never InstanceID):" echo " run=$RUN_ID" echo " pre_setup_absence=$PRE_SETUP_ABSENCE" @@ -1917,6 +2044,7 @@ echo " handoff_interval=[$HANDOFF_REQUEST_UTC .. $HANDOFF_RECEIPT_UTC] (this driver's request-write and receipt-verify -- a DIFFERENT interval, never the command's)" echo " timestamp_order=$TS_ORDER (the six stamps compared with the calendar; UNMEASURED = at least one is a gap)" echo " setup_exit_preserved_by_leg=$SETUP_EXIT_FILE (written before t1 ran; the receipt's exit= above stays the declared channel)" + echo " elevated_leg_clock start=$LEG_START_EPOCH deadline=$LEG_DEADLINE_EPOCH budget=${ELEVATED_LEG_BUDGET_S}s status=$LEG_CLOCK_STATUS" echo " rule_names=$RULE_TAILNET,$RULE_LAN port=$PORT isolated_home=$H" echo "VERDICTS:" echo " CAPTURE_CONTRACT=$CAPTURE_CONTRACT" @@ -2490,6 +2618,7 @@ python "$BIN/launch-record.py" argv "$(cygpath -w "$R/d2-t1.argv.json")" -NoProfile -Command "$T1_CODE" || die "capture argv preparation failed" ( set -o noclobber; printf '{}\n' > "$R/d2-t1.environment.json" ) || die "capture environment reservation failed" T1_LAUNCH="pwsh -NoProfile -File '$BIN/launch-v2.ps1' -Label 't1-$RUN_ID' -Seconds ([Math]::Min(90, ([long][IO.File]::ReadAllText('$R/d2-t1.deadline') - [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - 5))) -RecordFile '$R/d2-t1.native.json' -ArgsFile '$R/d2-t1.argv.json' -Exe '$CAPTURE_PWSH' -OutFile '$R/d2-t1.out' -ErrFile '$R/d2-t1.err' -Admission process-tree -Scope step -EnvironmentFile '$R/d2-t1.environment.json'" +LEG_CLOCK_BEGIN="\$ErrorActionPreference='Stop'; \$legStart=[DateTimeOffset]::UtcNow; \$entries=@(@('$R/setup-start.utc',\$legStart.UtcDateTime.ToString('yyyy-MM-ddTHH:mm:ssZ')),@('$R/elevated-leg-start.epoch',[string]\$legStart.ToUnixTimeSeconds()),@('$R/d2-t1.deadline',[string](\$legStart.ToUnixTimeSeconds()+$ELEVATED_LEG_BUDGET_S))); foreach(\$entry in \$entries){\$file=[IO.File]::Open(\$entry[0],[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read); try{\$bytes=[Text.Encoding]::ASCII.GetBytes(\$entry[1]);\$file.Write(\$bytes,0,\$bytes.Length);\$file.Flush(\$true)}finally{\$file.Dispose()}}" handoff_request prepare \ "ACKNOWLEDGE ONLY -- RUN NOTHING. Confirm you are prepared to execute the setup leg and that you have started nothing yet, and report the sha256 of BOTH subjects this leg would run, AS YOU MEASURE THEM NOW: the pinned executable and the capture script." \ "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with these four tokens, EACH ON A LINE OF ITS OWN AND NOTHING ELSE ON THAT LINE: PREPARED, NOT_STARTED, then executable_sha256= followed by the sha256 you measure of $EXE, then capture_sha256= followed by the sha256 you measure of $BIN/d2_capture.ps1. If you are NOT prepared, say so in words -- do not write NOT_PREPARED on a line by itself and expect it to read as a refusal. NOTE ON PHRASING: this text carries no angle brackets deliberately. handoff_request refuses any command text containing a redirect character, because capture paths are composed inside it; a bracketed placeholder was refused by that guard on the first live PREP (run 20260913T070453Z), before any request was written." @@ -2501,7 +2630,10 @@ echo "$T1_LAUNCH" echo "The environment overlay is exactly {}; preserve the live parent. Child argv is -NoProfile -Command plus the capture expression in d2-t1.argv.json." echo "The no-field Get-Command/Get-FileHash fixture control ran through this same pwsh/L2/pwsh shape before driver invocation; see the attached admission packet." - echo "Dry-run this shape and both hashes; mismatch REFUSES. The deadline file is published only with the setup request." + echo "Dry-run the launcher shape, clock initializer and both hashes; mismatch REFUSES. Do not initialize the clock during this acknowledgment." + echo "elevated_leg_budget_seconds: $ELEVATED_LEG_BUDGET_S" + echo "leg_clock_begin_powershell:" + echo "$LEG_CLOCK_BEGIN" } >> "$R/handoff/$HO_SEQ-prepare-request.txt" # BOUNDED BY WHAT IS LEFT OF PREPARATION (doyle 2026-09-13). HANDOFF_WAIT_S is 900s and the whole # preparation budget is 600s, so an unbounded-by-prep wait could sit past the deadline and then @@ -2543,7 +2675,7 @@ # bound to THIS run and THIS request and cannot be a stale or reused token from another. prep_check go-authorization handoff_request go-authorization \ - "AUTHORIZE ONLY -- RUN NOTHING. FOR THE DRI, NOT FOR THE ELEVATED EXECUTOR: readiness has already been acknowledged by the leg that would run this, and that acknowledgment is not this decision. Authorize the experimental window to OPEN for this run, knowing the 300s activity clock starts when it does." \ + "AUTHORIZE ONLY -- RUN NOTHING. FOR THE DRI, NOT FOR THE ELEVATED EXECUTOR: readiness has already been acknowledged by the leg that would run this, and that acknowledgment is not this decision. Authorize the experimental window to OPEN for this run, knowing the derived ${EXP_BUDGET_S}s activity clock starts when it does; setup handoff ${SETUP_HANDOFF_CAP_S}s, post-receipt observations ${POST_RECEIPT_S}s, pre-dispatch ${PRE_DISPATCH_ALLOWANCE_S}s and transition reserve ${ACTIVITY_TAIL_RESERVE_S}s." \ "AUTHORIZATION ONLY. Nothing is run to answer this. Reply in the receipt with THREE things: the token GO_AUTHORIZED on a line of its own and nothing else on that line; the line authorizer=doyle, likewise alone on its line; and the nonce of THIS request quoted exactly (anywhere). To WITHHOLD authorization, say so in words -- there is no negative token this check reads." \ doyle GO_ACK="$HO_RECEIPT"; GO_ACK_NONCE="$HO_NONCE" @@ -2586,6 +2718,7 @@ # an authorization that is verified late must not open a window the budget had already closed. # prep_check refuses with exit 8 -- a run that never started, with nothing to tear down. prep_check window-open +require_setup_budget "$EXP_BUDGET_S" before-go || die "derived activity budget cannot hold the planned sequence; GO refused" # THE WINDOW OPENS HERE AND NOWHERE ELSE. go "GO authorization verified (run-bound), both subject hashes measured by the executor, and the reviewed removal instrument verified" @@ -2601,6 +2734,7 @@ # The daemon has its own run-scoped job, alive before any autostart-capable dispatch. run_daemon_start || die "run-scoped daemon did not establish owned readiness; no setup is dispatched" run_daemon_require_ready || die "autostart-capable setup refused: no current owned daemon" +require_setup_budget "$(exp_left)" before-dispatch || die "remaining activity budget cannot hold setup and its observations; setup not dispatched" # MARKED BEFORE THE DISPATCH (C): a REFUSED setup can still leave rules behind. mark_state fw_mutation_may_have_occurred "an elevated reconcile is about to be REQUESTED; rules may exist from this moment even if the setup is refused" mark_state daemon_may_run "run-scoped job owns the prestarted daemon; setup may not autostart one" @@ -2629,9 +2763,10 @@ # finished, and it includes however long liam took to read the request and answer it. Both # intervals are recorded here, each under a name that says whose clock took it. HANDOFF_REQUEST_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" -T1_HANDOFF_DEADLINE=$(( $(date +%s) + HANDOFF_CAP_S )) -[ "$T1_HANDOFF_DEADLINE" -le "$EXP_DEADLINE" ] || T1_HANDOFF_DEADLINE="$EXP_DEADLINE" -( set -o noclobber; printf '%s' "$T1_HANDOFF_DEADLINE" > "$R/d2-t1.deadline" ) || die "capture deadline reservation failed" +SETUP_HANDOFF_DEADLINE=$(( $(date +%s) + SETUP_HANDOFF_CAP_S )) +SETUP_RECEIPT_LATEST=$((EXP_DEADLINE - POST_RECEIPT_S - ACTIVITY_TAIL_RESERVE_S)) +[ "$SETUP_HANDOFF_DEADLINE" -le "$SETUP_RECEIPT_LATEST" ] || SETUP_HANDOFF_DEADLINE="$SETUP_RECEIPT_LATEST" +SETUP_WAIT_STATUS=WAITING handoff_request setup \ "create the owned pair with the product itself (never a hand netsh, so the rules carry the shipped desired_specs shape) AND take the t1 capture inside this same elevated leg" \ "env -u SPT_INSTALL_NO_FIREWALL SPT_HOME=\"$H\" \"$EXE\" serve lan --bootstrap --port $PORT" @@ -2648,7 +2783,9 @@ echo "" echo "capture_identity_REQUIRED: sha256 $CAPTURE_SHA" echo "capture_launcher_identity_REQUIRED: $CAPTURE_PWSH" - echo "capture_deadline_epoch: $T1_HANDOFF_DEADLINE (includes setup/handoff time; never restarted)" + echo "handoff_deadline_epoch: $SETUP_HANDOFF_DEADLINE (request-to-receipt only; includes notification latency)" + echo "elevated_leg_budget_seconds: $ELEVATED_LEG_BUDGET_S (starts inside step 1 immediately before run_exactly)" + echo "capture_deadline_file: $R/d2-t1.deadline (executor publishes leg_start_epoch + $ELEVATED_LEG_BUDGET_S; never request time)" echo "executable_identity_REQUIRED: sha256 $EXE_SHA" echo " at $EXE — MEASURED by this driver immediately before this request (S1) and stated here" echo " because a clean source tree does not identify reused executable BYTES. If the file at that" @@ -2660,7 +2797,11 @@ echo " above and the moment I verify this receipt are the HANDOFF's bounds. They are different" echo " intervals — the handoff one opens before the command exists and closes after it has" echo " finished — and neither may be reported as the other." - echo " 1. stamp_utc_now_to (immediately BEFORE step 2, with nothing in between): $R/setup-start.utc" + echo " 1. initialize_leg_clock (immediately BEFORE step 2, with nothing in between):" + echo "leg_clock_begin_powershell:" + echo "$LEG_CLOCK_BEGIN" + echo " Run that expression in the pinned PowerShell 7 host. All three files use CreateNew; any existing file REFUSES the leg, never resets it." + echo " The expression stamps setup-start.utc and publishes elevated-leg-start.epoch plus d2-t1.deadline from ONE UTC observation." echo " 2. run_exactly (the command and the redirections named above)" echo " 3. PRESERVE ITS EXIT IN A VARIABLE THE INSTANT IT RETURNS, before running anything else:" echo " every later command overwrites \$LASTEXITCODE / \$?, INCLUDING the stamp in step 4." @@ -2670,7 +2811,7 @@ echo " 6. stamp_utc_now_to (immediately BEFORE step 7): $R/d2-t1-start.utc" echo " 7. then_run_exactly (SECOND command, same elevated leg, same nonce):" echo "$T1_LAUNCH" - echo " then_write_its_native_exit_to: $R/d2-t1.exit" + echo " then_write_its_launcher_exit_to: $R/d2-t1.exit (native capture exit remains in d2-t1.native.json)" echo " 8. stamp_utc_now_to (immediately AFTER step 7): $R/d2-t1-end.utc" echo "" echo "stamp_utc_now_to means EXACTLY this, and nothing that merely resembles it:" @@ -2694,25 +2835,17 @@ } >> "$R/handoff/$HO_SEQ-setup-request.txt" record "HANDOFF_T1_RIDER appended to the seq-$HO_SEQ setup request — the only elevated read this design has; omission is a labelled gap, not a pass" record "HANDOFF_REQUEST_UTC=$HANDOFF_REQUEST_UTC — a bound on THIS DRIVER's request, not on the command it asks for" -# The wait cannot outlive the experimental budget: the deadline ends activity, whoever is -# holding it up. -HANDOFF_WAIT_S=$(exp_left) -# THE CAP IS A POLICY ALLOCATION, NOT AN ESTIMATE (doyle CT6GS2Y6). It answers how much of the -# activity window this run will spend waiting on another agent, and it exists because one slow -# counterparty can otherwise consume the whole window and leave nothing for the observations the -# window exists to take -- run 20260913T041410Z spent 134s here and reached neither t1 nor t2. -# 94s and 134s are two samples, not a distribution, and no number here is derived from them. -if [ "$HANDOFF_WAIT_S" -gt "$HANDOFF_CAP_S" ]; then - record "HANDOFF_CAP applied: ${HANDOFF_CAP_S}s of the ${HANDOFF_WAIT_S}s that remain — the rest of the window is RESERVED for the post-mutation observations, which cannot be taken anywhere else" - HANDOFF_WAIT_S=$HANDOFF_CAP_S -fi -record "HANDOFF_WAIT bounded to ${HANDOFF_WAIT_S}s — the lesser of the cap and what remains of the experimental budget" +# Setup's derived allowance supersedes the retained 120s cap for this leg ONLY. +# The absolute request deadline also reserves post-receipt observations and transition. +HANDOFF_WAIT_S=$SETUP_HANDOFF_CAP_S +record "HANDOFF_WAIT setup_cap=${SETUP_HANDOFF_CAP_S}s absolute_deadline=$SETUP_HANDOFF_DEADLINE post_receipt_reserved=${POST_RECEIPT_S}s transition_reserved=${ACTIVITY_TAIL_RESERVE_S}s" # CONTEXT NAME KEPT VERBATIM: 'trial' is handoff_await's name for THE NORMAL FLOW, as # opposed to 'cleanup'. There are no trials here; renaming it would edit a function this # change has no reason to touch, so the name stays and this line says what it means. if ! handoff_await trial; then - HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — the handoff's bounds. The setup command's own bounds were never returned." + SETUP_WAIT_STATUS=EXPIRED + HANDOFF_WAIT_END_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC wait_end=$HANDOFF_WAIT_END_UTC — no timely receipt; final terminal re-read belongs to cleanup" # THE WAIT STOPPED; THE COMMAND MAY NOT HAVE. This driver never entered that leg and has no # authority to stop it, asks for none, and does not re-ask: one nonce is one execution, so a # second request would be a second authorization rather than a retry. It also does NOT proceed @@ -2723,53 +2856,14 @@ record "HANDOFF_CAP_EXPIRED nonce=$SETUP_NONCE receipt_awaited=$SETUP_RECEIPT — the wait ended, the command's disposition is UNKNOWN, and nothing was killed or re-requested" die "no verified setup receipt within the bounded wait. The elevated command may still be acting: state markers are left set, no cleanup mutation may run while it is outstanding (R6), and a REFUSED or UNANSWERED setup can still have left rules behind." fi +SETUP_WAIT_STATUS=TIMELY HANDOFF_RECEIPT_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)" +HANDOFF_WAIT_END_UTC="$HANDOFF_RECEIPT_UTC" +observation_budget post-receipt-probes "$POST_RECEIPT_PROBE_S" "$((T2_ALLOWANCE_S + ACTIVITY_TAIL_RESERVE_S))" SETUP_RC=$(handoff_exit) exits "setup_elevated_EXIT=$SETUP_RC" # THE LEG'S OWN MEASUREMENTS, read back from the files it was asked to write. -SETUP_START_UTC=$(leg_utc "$R/setup-start.utc") -SETUP_END_UTC=$(leg_utc "$R/setup-return.utc") -T1_START_UTC=$(leg_utc "$R/d2-t1-start.utc") -T1_END_UTC=$(leg_utc "$R/d2-t1-end.utc") -SETUP_EXIT_FILE=$(leg_exit "$R/setup.exit") -record "SETUP_INTERVAL start=$SETUP_START_UTC end=$SETUP_END_UTC — THE CREATION RECORD, and it is the ELEVATED LEG's measurement of its own command, not this driver's measurement of the handoff. No provider creation timestamp is claimed and no instant is invented between these bounds." -record "T1_INTERVAL start=$T1_START_UTC end=$T1_END_UTC — the elevated capture's own two stamps" -record "HANDOFF_INTERVAL request=$HANDOFF_REQUEST_UTC receipt=$HANDOFF_RECEIPT_UTC — SEPARATELY LABELLED. This is how long the handoff took, and it is not a bound on anything the leg ran." -# THE SETUP'S EXIT, TWICE, FROM TWO CHANNELS. The receipt's exit= line keeps its authority -# (SETUP_RC is unchanged); the step-5 file is the evidence that the value was preserved BEFORE -# the capture ran. A disagreement is reported, never resolved by preference: it means one of -# the two readings is of something else. -case "$SETUP_EXIT_FILE" in - "$SETUP_RC") - record "SETUP_EXIT_PRESERVED=$SETUP_EXIT_FILE — the leg's own file agrees with the receipt's exit=, and it was written before t1 ran" ;; - ABSENT) - record "SETUP_EXIT_PRESERVED=ABSENT — step 5 produced no file. The receipt's exit=$SETUP_RC is then the ONLY reading of the setup's exit, and nothing here shows it was captured before the capture command overwrote \$LASTEXITCODE." ;; - UNPARSEABLE) - record "SETUP_EXIT_PRESERVED=UNPARSEABLE — a step-5 file exists and carries no readable exit. An unread exit is not a zero one." ;; - *) - record "SETUP_EXIT_DISAGREES receipt=$SETUP_RC leg_file=$SETUP_EXIT_FILE — TWO CHANNELS, TWO ANSWERS. Neither is preferred here; the receipt's value continues to be used because that is the declared channel, and this line is the standing caveat on it." ;; -esac -# ORDERING IS ASSERTED, NOT ASSUMED. Six stamps taken in an order this driver REQUESTED are a -# claim about that order until they are compared. Parsed with the calendar (ts_readable's rule, -# GNU date -u -d) and compared as epochs; a gap or an unparseable value leaves the comparison -# UNMEASURED rather than passing it. Stamps one second apart or identical are expected: the -# resolution is one second, so the test is <=, and an out-of-order pair is a real violation. -TS_ORDER=UNMEASURED -if ts_readable "$HANDOFF_REQUEST_UTC" && ts_readable "$SETUP_START_UTC" && ts_readable "$SETUP_END_UTC" \ - && ts_readable "$T1_START_UTC" && ts_readable "$T1_END_UTC" && ts_readable "$HANDOFF_RECEIPT_UTC"; then - ts_hq=$(date -u -d "$HANDOFF_REQUEST_UTC" +%s); ts_ss=$(date -u -d "$SETUP_START_UTC" +%s) - ts_se=$(date -u -d "$SETUP_END_UTC" +%s); ts_t1s=$(date -u -d "$T1_START_UTC" +%s) - ts_t1e=$(date -u -d "$T1_END_UTC" +%s); ts_hr=$(date -u -d "$HANDOFF_RECEIPT_UTC" +%s) - if [ "$ts_hq" -le "$ts_ss" ] && [ "$ts_ss" -le "$ts_se" ] && [ "$ts_se" -le "$ts_t1s" ] \ - && [ "$ts_t1s" -le "$ts_t1e" ] && [ "$ts_t1e" -le "$ts_hr" ]; then - TS_ORDER=OK - else - TS_ORDER=VIOLATED - fi -fi -record "TIMESTAMP_ORDER=$TS_ORDER handoff_request=$HANDOFF_REQUEST_UTC <= setup_start=$SETUP_START_UTC <= setup_return=$SETUP_END_UTC <= t1_start=$T1_START_UTC <= t1_end=$T1_END_UTC <= handoff_receipt=$HANDOFF_RECEIPT_UTC" -[ "$TS_ORDER" = VIOLATED ] && record " THE SEQUENCE THE REQUEST ASKED FOR DID NOT HAPPEN IN THAT ORDER. The stamps are kept as taken; nothing is reordered or discarded, and every interval above is read with this line beside it." -[ "$TS_ORDER" = UNMEASURED ] && record " ORDER NOT MEASURED — at least one of the six stamps is missing or unparseable, so no ordering claim is made either way." +read_setup_terminal "$SETUP_RC" # t1's OWN exit, read from its OWN file. Absent file = the elevated capture never ran. if [ -f "$R/d2-t1.exit" ]; then D2_T1=$(tr -d ' \r\n' < "$R/d2-t1.exit") @@ -2861,7 +2955,8 @@ deadline_check t2-capture record "D1 and t2 run NOW, before any teardown is requested, so the state at this outcome is captured while it still exists." d1_capture setup-outcome -d2_capture_at t2 "$(exp_left)" +observation_budget t2 "$T2_BOUND_S" "$ACTIVITY_TAIL_RESERVE_S" +d2_capture_at t2 "$T2_BOUND_S" D2_T2=$(tr -d ' ' < "$R/d2-t2.exit" 2>/dev/null || echo UNRECORDED) # t2's validation is DEFERRED with t1's — see the note at the t1 site. This is the 11s