diff --git a/.wolf/buglog.json b/.wolf/buglog.json index d0a10948..0bd5f685 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -17812,6 +17812,401 @@ "record": ".wolf/bugs/bug-1935.md", "gitea_issue": 360, "gitea_synced_status": "fixed" + }, + { + "id": "bug-1936", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:36Z", + "last_seen": "2026-10-10T08:14:36Z", + "occurrences": 1, + "error_message": "apiserver drops cwd, env, run/resource limits, file transfers and I/O paths of REST job submissions\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`modelJobToSubmit()` (`src/frontend/apiserver/backend/convert.go:323-375`) builds the controller's `job_startinfo_t` with only cmdline, execuser, launch_type and pre/post-exec; it never sets `exdata`, `exechome` or `execcwd`:\n```go\nsi := (*C.job_startinfo_t)(C.calloc(1, C.sizeof_job_startinfo_t))\nsi.cmdline = C.CString(job.Command)\n... // no si.exdata / si.exechome / si.execcwd\n```\nSo `--cwd`, `--env`, `--file` transfers, interactive mode, every `*_limit` flag (incl. `-W` run limit), `-i/-o/-e`, asked hosts and begin/end time are kept only in the apiserver's memory and never reach the controller or the worker.\n\n**Expected:** Every submit option the apiserver accepts reaches the worker in the job's start info (exdata, exec home, cwd), or is rejected as unsupported.\n**Impact:** Silent wrong result: jobs run without the limits, environment, working directory and I/O paths the user asked for (e.g. a `-W` run limit is never enforced).\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/backend/convert.go, src/frontend/apiserver/controllers/jobs.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "submit", + "exdata", + "limits" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1936.md" + }, + { + "id": "bug-1937", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "worker", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:38Z", + "last_seen": "2026-10-10T08:14:38Z", + "occurrences": 1, + "error_message": "apiserver writes job file transfers under 'transfer_files' but the worker parses 'transfer_file'\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe apiserver serialises transfers as `extendDataMap[\"transfer_files\"]` (`src/frontend/apiserver/controllers/jobs.go:1923`) while the worker looks for:\n```c\nelse if (strcmp(key, \"transfer_file\") == 0) { /* xcecd_exdata.c:115 */\n```\n\n**Expected:** Both sides use one key, so transfers in exdata are parsed.\n**Impact:** Wrong result once exdata reaches the worker: file transfers are silently ignored.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/controllers/jobs.go, src/worker/src/xcecd_exdata.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "worker", + "exdata", + "file-transfer" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1937.md" + }, + { + "id": "bug-1938", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:41Z", + "last_seen": "2026-10-10T08:14:41Z", + "occurrences": 1, + "error_message": "xce_scheduler dispatches jobs from closed or inactive queues (queue readiness gate is a stub)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe admin queue controls set and clear the closed/inactive flags (`src/controller/queue.c:131-152`), but the scheduler's gates always pass:\n```c\n/* FIXME this is just stub, we need to add more */\nint sched_job_is_ready(xce_sched_job_t* j) { return 1; }\n/* FIXME this is just stub, we need to add more */\nint sched_queue_is_ready(xce_sched_queue_t* q) { return 1; } /* core.c:646-649 */\n```\n\n**Expected:** Jobs of an inactive queue are not dispatched (they stay pending with a reason); a closed queue accepts no new submissions.\n**Impact:** Admin queue control silently ignored: inactivating a queue does not stop dispatch.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/scheduler/src/core.c, src/scheduler/src/plugins/builtin_fcfs.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "queue", + "admin-control" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1938.md" + }, + { + "id": "bug-1939", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:43Z", + "last_seen": "2026-10-10T08:14:43Z", + "occurrences": 1, + "error_message": "xce_scheduler dispatches jobs to hosts closed by an admin\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nHost close sets `XCE_WORKER_CLOSED|XCE_WORKER_CLOSED_BY_ADMIN` (`src/controller/worker.c:1015-1024`), but no scheduler code checks either bit (only unavailable/reconciling hosts are skipped: `core_session.c:136`, `resource.c:704,887`); the parallel allocator's bad-host check is empty (`plugins/parjob_allocator.c:40-48`).\n\n**Expected:** A closed host gets no new jobs; running jobs are unaffected.\n**Impact:** Admin host control silently ignored: closing a host for maintenance does not stop new jobs landing on it.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/scheduler/src/resource.c, src/scheduler/src/core_session.c, src/scheduler/src/plugins/parjob_allocator.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "host", + "admin-control" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1939.md" + }, + { + "id": "bug-1940", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:46Z", + "last_seen": "2026-10-10T08:14:46Z", + "occurrences": 1, + "error_message": "job control ignores the requested signal and the force-kill flag (apiserver to controller)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe control handler passes a JSON event string as content (`controllers/jobs.go:2260-2277`); `signalNumber()` looks it up as a signal name, fails and falls back to TERM/TSTP/CONT; `backend/clib.go:697-705` always sends `sig.force = 0` and `ckpt.kill = 0`, dropping ForceKill and the checkpoint kill/method options (`:746-762`).\n\n**Expected:** A kill with a user-chosen signal sends that signal; force kill and checkpoint options reach the controller.\n**Impact:** Wrong result: users cannot send a specific signal or force-kill a job.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/controllers/jobs.go, src/frontend/apiserver/backend/clib.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "job-control", + "signal" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1940.md" + }, + { + "id": "bug-1941", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "controller", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:48Z", + "last_seen": "2026-10-10T08:14:48Z", + "occurrences": 1, + "error_message": "xce_controller refuses kill/stop/resume of running jobs on hosts whose status is not exactly OK\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n```c\n/* FIXME: better method to check host status */\nif (w->ep && w->host.status == 0) { /* src/controller/job.c:2145-2156 */\n```\nAny other status bit (CLOSED_BY_ADMIN, BUSY, UNAVAIL...) makes the control request fail.\n\n**Expected:** Jobs on a closed (or otherwise flagged but connected) host can be killed, stopped and resumed; a host that is not connected gives a clear error.\n**Impact:** Users and admins cannot kill jobs on a host closed for maintenance.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/controller/job.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "controller", + "job-control", + "host-status" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1941.md" + }, + { + "id": "bug-1942", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "controller", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:51Z", + "last_seen": "2026-10-10T08:14:51Z", + "occurrences": 1, + "error_message": "xce_controller sends job control of a multi-host job only to its first host\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nJob control is routed to `allocs[0]->host` only (`src/controller/job.c:2126-2131`).\n\n**Expected:** Signals reach every host of the job (or the job's launcher is documented to fan them out and does so).\n**Impact:** Suspending or killing a multi-host job can leave its tasks on other hosts running.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/controller/job.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "controller", + "job-control", + "parallel" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1942.md" + }, + { + "id": "bug-1943", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:54Z", + "last_seen": "2026-10-10T08:14:54Z", + "occurrences": 1, + "error_message": "xce_scheduler --sim does not load user and host groups, so group-scoped limits differ from live\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a config push the live scheduler loads user and host groups (`groupmgr_load_configs`, `src/scheduler/src/scheduler.c:1144-1145`); the core's config event used by the simulator applies only resources, resource values and queues (`core_events.c:846-850`).\n\n**Expected:** Live and simulated scheduling apply the same groups (scheduler-driver-equivalence.md).\n**Impact:** Replays of clusters with group-scoped limits make different decisions than the live scheduler.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/scheduler/src/core_events.c, src/scheduler/src/scheduler.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "sim", + "equivalence", + "limit" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1943.md" + }, + { + "id": "bug-1944", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T08:14:56Z", + "last_seen": "2026-10-10T08:14:56Z", + "occurrences": 1, + "error_message": "xce_scheduler gives a job moved to another queue the queue's priority, so it jumps ahead\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nNew jobs get priority 0 (`schedobj.c:214`, `core_events.c:353`), but on a queue change the job's priority becomes the queue's priority (`core_events.c:1360`, `schedobj.c:684`); the picker sorts by job priority within a queue (`plugins/builtin_fcfs.c:213`).\n\n**Expected:** Moving a job does not change its job priority.\n**Impact:** Wrong ordering: moved jobs overtake jobs submitted earlier to the target queue.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/scheduler/src/core_events.c, src/scheduler/src/schedobj.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "queue", + "priority" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1944.md" + }, + { + "id": "bug-1945", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:14:59Z", + "last_seen": "2026-10-10T08:14:59Z", + "occurrences": 1, + "error_message": "apiserver signs and accepts JWTs with the shipped default secret when XCE_JWT_SECRET is unset\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`config/app.yaml:17` ships the secret `xce-api-key`; `utils/config.go:315-320` uses `XCE_JWT_SECRET` when set and otherwise keeps the default without any warning.\n\n**Expected:** The apiserver never runs with a publicly known signing secret.\n**Impact:** Security: anyone can forge tokens for any user on a deployment that did not set the environment variable.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/config/app.yaml, src/frontend/apiserver/utils/config.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "jwt" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1945.md" + }, + { + "id": "bug-1946", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:01Z", + "last_seen": "2026-10-10T08:15:01Z", + "occurrences": 1, + "error_message": "apiserver logout does not revoke the token: it stays valid until expiry\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nLogout deletes a token file (`controllers/auth.go:69-95`) that token validation never reads (`middleware/validatehandler.go:101-116`).\n\n**Expected:** After logout the token is rejected.\n**Impact:** Security: a leaked token keeps working for up to 24 h after logout.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/controllers/auth.go, src/frontend/apiserver/middleware/validatehandler.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "jwt" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1946.md" + }, + { + "id": "bug-1947", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:04Z", + "last_seen": "2026-10-10T08:15:04Z", + "occurrences": 1, + "error_message": "apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:60` compares the stored plaintext password with `!=`; `config/auth.yaml:12-21` ships `admin/admin` and `user1/user1`.\n\n**Expected:** Stored passwords are hashed and compared in constant time; no default credentials are shipped active.\n**Impact:** Security: password disclosure from the config file, timing side channel, and known default credentials.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/backend/auth/config_file.go, src/frontend/apiserver/config/auth.yaml", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "auth" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1947.md" + }, + { + "id": "bug-1948", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:06Z", + "last_seen": "2026-10-10T08:15:06Z", + "occurrences": 1, + "error_message": "apiserver trusts X-Forwarded-For from any client, so IP whitelist and JWT IP binding can be spoofed\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe router uses `gin.Default()` (`router/routers.go:19`) and never calls `SetTrustedProxies`, so `ClientIP()` honours `X-Forwarded-For` from any peer.\n\n**Expected:** Forwarded headers are only honoured from configured trusted proxies.\n**Impact:** Security: a client can claim any IP and bypass the IP whitelist and the IP bound into its JWT.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/router/routers.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "whitelist" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1948.md" + }, + { + "id": "bug-1949", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:09Z", + "last_seen": "2026-10-10T08:15:09Z", + "occurrences": 1, + "error_message": "apiserver RequirePermission and IP whitelist write an error but do not abort the request\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a bad token `RequirePermission` returns an error response without `Abort()` (`controllers/rbac_check.go:119-122`); the IP whitelist does the same for an invalid client IP (`middleware/whitelist.go:130-132`); `ReturnError` never aborts (`controllers/response.go:30-37`).\n\n**Expected:** A failed middleware check stops the request before the handler runs.\n**Impact:** Security: the handler may still run after an authorization failure.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/controllers/rbac_check.go, src/frontend/apiserver/middleware/whitelist.go, src/frontend/apiserver/controllers/response.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "middleware" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1949.md" + }, + { + "id": "bug-1950", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:11Z", + "last_seen": "2026-10-10T08:15:11Z", + "occurrences": 1, + "error_message": "apiserver JWT validation does not pin the signing algorithm\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe middleware's parse callback returns the key without checking `token.Method` (`middleware/validatehandler.go:102-104`), unlike the other parse path (`controllers/auth.go:186`).\n\n**Expected:** Only the configured HMAC algorithm is accepted.\n**Impact:** Security hardening: algorithm-confusion class of attacks is not ruled out.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/middleware/validatehandler.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "jwt" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1950.md" + }, + { + "id": "bug-1951", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "crash", + "timestamp": "2026-10-10T08:15:14Z", + "last_seen": "2026-10-10T08:15:14Z", + "occurrences": 1, + "error_message": "apiserver crashes on an auth.yaml without a config_file block (nil pointer)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:39` reads `cfg.ConfigFile.Users` without checking `cfg.ConfigFile` for nil.\n\n**Expected:** A missing block is a clear configuration error, not a panic.\n**Impact:** Crash at startup or login with a minimal auth.yaml.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/backend/auth/config_file.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "auth", + "config", + "crash" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1951.md" + }, + { + "id": "bug-1952", + "status": "investigating", + "status_updated": "2026-10-10", + "status_note": "suspected from source reading; confirm with a test before fixing", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T08:15:16Z", + "last_seen": "2026-10-10T08:15:16Z", + "occurrences": 1, + "error_message": "apiserver user role changes check a narrower rbac:control grant only against the target user\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nSuspected (needs verification): in add/delete roles for a user, a non-`all` `rbac:control` grant is only checked against \"is the target me?\" (`controllers/users.go:404-412,455-462`), so such a grant could let a user give itself `cluster_admin`. Built-in roles grant `rbac:control` only with domain `all` (`config/rbac.yaml:100-102`), so this is latent.\n\n**Expected:** A user can never grant itself a role with more rights than it already holds.\n**Impact:** Security (latent): privilege escalation through a custom role.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)", + "file": "src/frontend/apiserver/controllers/users.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "rbac" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1952.md" } ] } diff --git a/.wolf/bugs/bug-1936.md b/.wolf/bugs/bug-1936.md new file mode 100644 index 00000000..b1eb1948 --- /dev/null +++ b/.wolf/bugs/bug-1936.md @@ -0,0 +1,56 @@ +--- +id: "bug-1936" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:36Z" +last_seen: "2026-10-10T08:14:36Z" +occurrences: 1 +files: ["src/frontend/apiserver/backend/convert.go", "src/frontend/apiserver/controllers/jobs.go"] +tags: ["apiserver", "submit", "exdata", "limits"] +related: [] +--- + +# bug-1936: apiserver drops cwd, env, run/resource limits, file transfers and I/O paths of REST job submissions + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +`modelJobToSubmit()` (`src/frontend/apiserver/backend/convert.go:323-375`) builds the controller's `job_startinfo_t` with only cmdline, execuser, launch_type and pre/post-exec; it never sets `exdata`, `exechome` or `execcwd`: +```go +si := (*C.job_startinfo_t)(C.calloc(1, C.sizeof_job_startinfo_t)) +si.cmdline = C.CString(job.Command) +... // no si.exdata / si.exechome / si.execcwd +``` +So `--cwd`, `--env`, `--file` transfers, interactive mode, every `*_limit` flag (incl. `-W` run limit), `-i/-o/-e`, asked hosts and begin/end time are kept only in the apiserver's memory and never reach the controller or the worker. + +**Expected:** Every submit option the apiserver accepts reaches the worker in the job's start info (exdata, exec home, cwd), or is rejected as unsupported. +**Impact:** Silent wrong result: jobs run without the limits, environment, working directory and I/O paths the user asked for (e.g. a `-W` run limit is never enforced). +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Submit through REST/xcecli with `xcecli jobs submit -W 1 --cwd /tmp --env A=1 sleep 120` on any deployment. +2. Inspect the job's start info at the worker (worker log of the launched unit) or the controller's `job.start_info`: no exdata, no cwd; the job runs past one minute. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1937.md b/.wolf/bugs/bug-1937.md new file mode 100644 index 00000000..089fe339 --- /dev/null +++ b/.wolf/bugs/bug-1937.md @@ -0,0 +1,52 @@ +--- +id: "bug-1937" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "worker" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:38Z" +last_seen: "2026-10-10T08:14:38Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/jobs.go", "src/worker/src/xcecd_exdata.c"] +tags: ["apiserver", "worker", "exdata", "file-transfer"] +related: [] +--- + +# bug-1937: apiserver writes job file transfers under 'transfer_files' but the worker parses 'transfer_file' + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +The apiserver serialises transfers as `extendDataMap["transfer_files"]` (`src/frontend/apiserver/controllers/jobs.go:1923`) while the worker looks for: +```c +else if (strcmp(key, "transfer_file") == 0) { /* xcecd_exdata.c:115 */ +``` + +**Expected:** Both sides use one key, so transfers in exdata are parsed. +**Impact:** Wrong result once exdata reaches the worker: file transfers are silently ignored. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Read the two sites above; or unit-test `parse_exdata()` with the JSON the apiserver produces: `transfer_info->ops` stays empty. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1938.md b/.wolf/bugs/bug-1938.md new file mode 100644 index 00000000..adc20d37 --- /dev/null +++ b/.wolf/bugs/bug-1938.md @@ -0,0 +1,56 @@ +--- +id: "bug-1938" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:41Z" +last_seen: "2026-10-10T08:14:41Z" +occurrences: 1 +files: ["src/scheduler/src/core.c", "src/scheduler/src/plugins/builtin_fcfs.c"] +tags: ["scheduler", "queue", "admin-control"] +related: [] +--- + +# bug-1938: xce_scheduler dispatches jobs from closed or inactive queues (queue readiness gate is a stub) + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +The admin queue controls set and clear the closed/inactive flags (`src/controller/queue.c:131-152`), but the scheduler's gates always pass: +```c +/* FIXME this is just stub, we need to add more */ +int sched_job_is_ready(xce_sched_job_t* j) { return 1; } +/* FIXME this is just stub, we need to add more */ +int sched_queue_is_ready(xce_sched_queue_t* q) { return 1; } /* core.c:646-649 */ +``` + +**Expected:** Jobs of an inactive queue are not dispatched (they stay pending with a reason); a closed queue accepts no new submissions. +**Impact:** Admin queue control silently ignored: inactivating a queue does not stop dispatch. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Deploy a cluster, inactivate queue `normal` (queue control), submit a job to it. +2. The job is dispatched and runs. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1939.md b/.wolf/bugs/bug-1939.md new file mode 100644 index 00000000..de97aedd --- /dev/null +++ b/.wolf/bugs/bug-1939.md @@ -0,0 +1,50 @@ +--- +id: "bug-1939" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:43Z" +last_seen: "2026-10-10T08:14:43Z" +occurrences: 1 +files: ["src/scheduler/src/resource.c", "src/scheduler/src/core_session.c", "src/scheduler/src/plugins/parjob_allocator.c"] +tags: ["scheduler", "host", "admin-control"] +related: [] +--- + +# bug-1939: xce_scheduler dispatches jobs to hosts closed by an admin + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +Host close sets `XCE_WORKER_CLOSED|XCE_WORKER_CLOSED_BY_ADMIN` (`src/controller/worker.c:1015-1024`), but no scheduler code checks either bit (only unavailable/reconciling hosts are skipped: `core_session.c:136`, `resource.c:704,887`); the parallel allocator's bad-host check is empty (`plugins/parjob_allocator.c:40-48`). + +**Expected:** A closed host gets no new jobs; running jobs are unaffected. +**Impact:** Admin host control silently ignored: closing a host for maintenance does not stop new jobs landing on it. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Close a host (`xcecli hosts close `), submit jobs that fit it. +2. Jobs are dispatched to the closed host. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1940.md b/.wolf/bugs/bug-1940.md new file mode 100644 index 00000000..4d3d0ade --- /dev/null +++ b/.wolf/bugs/bug-1940.md @@ -0,0 +1,50 @@ +--- +id: "bug-1940" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:46Z" +last_seen: "2026-10-10T08:14:46Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/jobs.go", "src/frontend/apiserver/backend/clib.go"] +tags: ["apiserver", "job-control", "signal"] +related: [] +--- + +# bug-1940: job control ignores the requested signal and the force-kill flag (apiserver to controller) + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +The control handler passes a JSON event string as content (`controllers/jobs.go:2260-2277`); `signalNumber()` looks it up as a signal name, fails and falls back to TERM/TSTP/CONT; `backend/clib.go:697-705` always sends `sig.force = 0` and `ckpt.kill = 0`, dropping ForceKill and the checkpoint kill/method options (`:746-762`). + +**Expected:** A kill with a user-chosen signal sends that signal; force kill and checkpoint options reach the controller. +**Impact:** Wrong result: users cannot send a specific signal or force-kill a job. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. `POST /xce/v1/jobs//control` with action kill, signal `SIGUSR1`, force_kill true. +2. The controller receives TERM with force 0. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1941.md b/.wolf/bugs/bug-1941.md new file mode 100644 index 00000000..910ec5f8 --- /dev/null +++ b/.wolf/bugs/bug-1941.md @@ -0,0 +1,54 @@ +--- +id: "bug-1941" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "controller" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:48Z" +last_seen: "2026-10-10T08:14:48Z" +occurrences: 1 +files: ["src/controller/job.c"] +tags: ["controller", "job-control", "host-status"] +related: [] +--- + +# bug-1941: xce_controller refuses kill/stop/resume of running jobs on hosts whose status is not exactly OK + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +```c +/* FIXME: better method to check host status */ +if (w->ep && w->host.status == 0) { /* src/controller/job.c:2145-2156 */ +``` +Any other status bit (CLOSED_BY_ADMIN, BUSY, UNAVAIL...) makes the control request fail. + +**Expected:** Jobs on a closed (or otherwise flagged but connected) host can be killed, stopped and resumed; a host that is not connected gives a clear error. +**Impact:** Users and admins cannot kill jobs on a host closed for maintenance. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Run a job on host h, close h, kill the job. +2. The kill is refused. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1942.md b/.wolf/bugs/bug-1942.md new file mode 100644 index 00000000..d0c2c522 --- /dev/null +++ b/.wolf/bugs/bug-1942.md @@ -0,0 +1,50 @@ +--- +id: "bug-1942" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "controller" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:51Z" +last_seen: "2026-10-10T08:14:51Z" +occurrences: 1 +files: ["src/controller/job.c"] +tags: ["controller", "job-control", "parallel"] +related: [] +--- + +# bug-1942: xce_controller sends job control of a multi-host job only to its first host + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +Job control is routed to `allocs[0]->host` only (`src/controller/job.c:2126-2131`). + +**Expected:** Signals reach every host of the job (or the job's launcher is documented to fan them out and does so). +**Impact:** Suspending or killing a multi-host job can leave its tasks on other hosts running. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Run a 2-host job (e.g. `/xce-test-multihost`), stop it. +2. Tasks on the second host keep running. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1943.md b/.wolf/bugs/bug-1943.md new file mode 100644 index 00000000..08a7e6c8 --- /dev/null +++ b/.wolf/bugs/bug-1943.md @@ -0,0 +1,50 @@ +--- +id: "bug-1943" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:54Z" +last_seen: "2026-10-10T08:14:54Z" +occurrences: 1 +files: ["src/scheduler/src/core_events.c", "src/scheduler/src/scheduler.c"] +tags: ["scheduler", "sim", "equivalence", "limit"] +related: [] +--- + +# bug-1943: xce_scheduler --sim does not load user and host groups, so group-scoped limits differ from live + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +On a config push the live scheduler loads user and host groups (`groupmgr_load_configs`, `src/scheduler/src/scheduler.c:1144-1145`); the core's config event used by the simulator applies only resources, resource values and queues (`core_events.c:846-850`). + +**Expected:** Live and simulated scheduling apply the same groups (scheduler-driver-equivalence.md). +**Impact:** Replays of clusters with group-scoped limits make different decisions than the live scheduler. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Record a session with a limit scoped to a user group, replay it with `xce_scheduler --sim`. +2. The limit does not match the group's users in sim. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1944.md b/.wolf/bugs/bug-1944.md new file mode 100644 index 00000000..2015a444 --- /dev/null +++ b/.wolf/bugs/bug-1944.md @@ -0,0 +1,50 @@ +--- +id: "bug-1944" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T08:14:56Z" +last_seen: "2026-10-10T08:14:56Z" +occurrences: 1 +files: ["src/scheduler/src/core_events.c", "src/scheduler/src/schedobj.c"] +tags: ["scheduler", "queue", "priority"] +related: [] +--- + +# bug-1944: xce_scheduler gives a job moved to another queue the queue's priority, so it jumps ahead + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +New jobs get priority 0 (`schedobj.c:214`, `core_events.c:353`), but on a queue change the job's priority becomes the queue's priority (`core_events.c:1360`, `schedobj.c:684`); the picker sorts by job priority within a queue (`plugins/builtin_fcfs.c:213`). + +**Expected:** Moving a job does not change its job priority. +**Impact:** Wrong ordering: moved jobs overtake jobs submitted earlier to the target queue. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Two jobs pending in queue B; move a third job from A to B (queue priority > 0). +2. The moved job is picked first. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1945.md b/.wolf/bugs/bug-1945.md new file mode 100644 index 00000000..7a064af4 --- /dev/null +++ b/.wolf/bugs/bug-1945.md @@ -0,0 +1,50 @@ +--- +id: "bug-1945" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:14:59Z" +last_seen: "2026-10-10T08:14:59Z" +occurrences: 1 +files: ["src/frontend/apiserver/config/app.yaml", "src/frontend/apiserver/utils/config.go"] +tags: ["apiserver", "security", "jwt"] +related: [] +--- + +# bug-1945: apiserver signs and accepts JWTs with the shipped default secret when XCE_JWT_SECRET is unset + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +`config/app.yaml:17` ships the secret `xce-api-key`; `utils/config.go:315-320` uses `XCE_JWT_SECRET` when set and otherwise keeps the default without any warning. + +**Expected:** The apiserver never runs with a publicly known signing secret. +**Impact:** Security: anyone can forge tokens for any user on a deployment that did not set the environment variable. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Start the apiserver without `XCE_JWT_SECRET`. +2. Sign a token with `xce-api-key` for user `admin`: it is accepted. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1946.md b/.wolf/bugs/bug-1946.md new file mode 100644 index 00000000..294851c7 --- /dev/null +++ b/.wolf/bugs/bug-1946.md @@ -0,0 +1,50 @@ +--- +id: "bug-1946" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:01Z" +last_seen: "2026-10-10T08:15:01Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/auth.go", "src/frontend/apiserver/middleware/validatehandler.go"] +tags: ["apiserver", "security", "jwt"] +related: [] +--- + +# bug-1946: apiserver logout does not revoke the token: it stays valid until expiry + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +Logout deletes a token file (`controllers/auth.go:69-95`) that token validation never reads (`middleware/validatehandler.go:101-116`). + +**Expected:** After logout the token is rejected. +**Impact:** Security: a leaked token keeps working for up to 24 h after logout. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Log in, log out, call any API with the old token. +2. The call succeeds. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1947.md b/.wolf/bugs/bug-1947.md new file mode 100644 index 00000000..66085aa0 --- /dev/null +++ b/.wolf/bugs/bug-1947.md @@ -0,0 +1,49 @@ +--- +id: "bug-1947" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:04Z" +last_seen: "2026-10-10T08:15:04Z" +occurrences: 1 +files: ["src/frontend/apiserver/backend/auth/config_file.go", "src/frontend/apiserver/config/auth.yaml"] +tags: ["apiserver", "security", "auth"] +related: [] +--- + +# bug-1947: apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +`backend/auth/config_file.go:60` compares the stored plaintext password with `!=`; `config/auth.yaml:12-21` ships `admin/admin` and `user1/user1`. + +**Expected:** Stored passwords are hashed and compared in constant time; no default credentials are shipped active. +**Impact:** Security: password disclosure from the config file, timing side channel, and known default credentials. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Read `config/auth.yaml`; log in as admin/admin on a default deployment. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1948.md b/.wolf/bugs/bug-1948.md new file mode 100644 index 00000000..db8fa3fe --- /dev/null +++ b/.wolf/bugs/bug-1948.md @@ -0,0 +1,50 @@ +--- +id: "bug-1948" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:06Z" +last_seen: "2026-10-10T08:15:06Z" +occurrences: 1 +files: ["src/frontend/apiserver/router/routers.go"] +tags: ["apiserver", "security", "whitelist"] +related: [] +--- + +# bug-1948: apiserver trusts X-Forwarded-For from any client, so IP whitelist and JWT IP binding can be spoofed + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +The router uses `gin.Default()` (`router/routers.go:19`) and never calls `SetTrustedProxies`, so `ClientIP()` honours `X-Forwarded-For` from any peer. + +**Expected:** Forwarded headers are only honoured from configured trusted proxies. +**Impact:** Security: a client can claim any IP and bypass the IP whitelist and the IP bound into its JWT. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Send a request with `X-Forwarded-For: ` from a non-whitelisted host. +2. It passes the whitelist. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1949.md b/.wolf/bugs/bug-1949.md new file mode 100644 index 00000000..dbc0eb3c --- /dev/null +++ b/.wolf/bugs/bug-1949.md @@ -0,0 +1,49 @@ +--- +id: "bug-1949" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:09Z" +last_seen: "2026-10-10T08:15:09Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/rbac_check.go", "src/frontend/apiserver/middleware/whitelist.go", "src/frontend/apiserver/controllers/response.go"] +tags: ["apiserver", "security", "middleware"] +related: [] +--- + +# bug-1949: apiserver RequirePermission and IP whitelist write an error but do not abort the request + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +On a bad token `RequirePermission` returns an error response without `Abort()` (`controllers/rbac_check.go:119-122`); the IP whitelist does the same for an invalid client IP (`middleware/whitelist.go:130-132`); `ReturnError` never aborts (`controllers/response.go:30-37`). + +**Expected:** A failed middleware check stops the request before the handler runs. +**Impact:** Security: the handler may still run after an authorization failure. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Call a RequirePermission-guarded route with a malformed token claim (see the code path above) and observe the handler running. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1950.md b/.wolf/bugs/bug-1950.md new file mode 100644 index 00000000..fcbbea5b --- /dev/null +++ b/.wolf/bugs/bug-1950.md @@ -0,0 +1,49 @@ +--- +id: "bug-1950" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:11Z" +last_seen: "2026-10-10T08:15:11Z" +occurrences: 1 +files: ["src/frontend/apiserver/middleware/validatehandler.go"] +tags: ["apiserver", "security", "jwt"] +related: [] +--- + +# bug-1950: apiserver JWT validation does not pin the signing algorithm + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +The middleware's parse callback returns the key without checking `token.Method` (`middleware/validatehandler.go:102-104`), unlike the other parse path (`controllers/auth.go:186`). + +**Expected:** Only the configured HMAC algorithm is accepted. +**Impact:** Security hardening: algorithm-confusion class of attacks is not ruled out. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Present a token signed with another algorithm family; validation does not reject it on the algorithm. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1951.md b/.wolf/bugs/bug-1951.md new file mode 100644 index 00000000..96039844 --- /dev/null +++ b/.wolf/bugs/bug-1951.md @@ -0,0 +1,49 @@ +--- +id: "bug-1951" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "crash" +timestamp: "2026-10-10T08:15:14Z" +last_seen: "2026-10-10T08:15:14Z" +occurrences: 1 +files: ["src/frontend/apiserver/backend/auth/config_file.go"] +tags: ["apiserver", "auth", "config", "crash"] +related: [] +--- + +# bug-1951: apiserver crashes on an auth.yaml without a config_file block (nil pointer) + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +`backend/auth/config_file.go:39` reads `cfg.ConfigFile.Users` without checking `cfg.ConfigFile` for nil. + +**Expected:** A missing block is a clear configuration error, not a panic. +**Impact:** Crash at startup or login with a minimal auth.yaml. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Start the apiserver with an `auth.yaml` that selects config-file auth but has no `config_file:` block. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1952.md b/.wolf/bugs/bug-1952.md new file mode 100644 index 00000000..b1e2e350 --- /dev/null +++ b/.wolf/bugs/bug-1952.md @@ -0,0 +1,49 @@ +--- +id: "bug-1952" +status: "investigating" +status_updated: "2026-10-10" +status_note: "suspected from source reading; confirm with a test before fixing" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T08:15:16Z" +last_seen: "2026-10-10T08:15:16Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/users.go"] +tags: ["apiserver", "security", "rbac"] +related: [] +--- + +# bug-1952: apiserver user role changes check a narrower rbac:control grant only against the target user + +## Description +**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix) +Suspected (needs verification): in add/delete roles for a user, a non-`all` `rbac:control` grant is only checked against "is the target me?" (`controllers/users.go:404-412,455-462`), so such a grant could let a user give itself `cluster_admin`. Built-in roles grant `rbac:control` only with domain `all` (`config/rbac.yaml:100-102`), so this is latent. + +**Expected:** A user can never grant itself a role with more rights than it already holds. +**Impact:** Security (latent): privilege escalation through a custom role. +**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 94472ee3-dirty +- Deployment: any (found by source reading; the failing test that confirms it is named in Verification) + +## Reproduction +1. Define a role with `rbac:control` scoped to `self`, assign it to a user, then add `cluster_admin` to that same user via the users API. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none