diff --git a/.wolf/buglog.json b/.wolf/buglog.json index e57c71de..d6b2c361 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -18422,6 +18422,221 @@ "record": ".wolf/bugs/bug-1957.md", "gitea_issue": 388, "gitea_synced_status": "fixed" + }, + { + "id": "bug-1958", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T10:15:56Z", + "last_seen": "2026-10-10T10:15:56Z", + "occurrences": 1, + "error_message": "apiserver lets any rbac:control grant create roles and extend its own role (privilege escalation)\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1952 fix: role create/update in `controllers/roles.go` accepts any `rbac:control` scope, so a user holding `rbac:control` with scope `self` can add `cluster:control` (or any permission) to a role it already holds: the same escalation bug-1952 closed for user-role assignment, by another route.\n\n**Expected:** Creating roles or changing a role's permissions requires `rbac:control` with scope `all` (as user-role changes do since bug-1952).\n**Impact:** Security: privilege escalation through role editing.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/frontend/apiserver/controllers/roles.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "rbac" + ], + "related_bugs": [ + "bug-1952" + ], + "fix_commits": [], + "record": ".wolf/bugs/bug-1958.md" + }, + { + "id": "bug-1959", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "xcecli", + "severity": "security", + "timestamp": "2026-10-10T10:15:59Z", + "last_seen": "2026-10-10T10:15:59Z", + "occurrences": 1, + "error_message": "xcecli logout only clears local config and never calls the logout API, so the token is not revoked\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1946 fix: server-side token revocation exists (`POST /xce/v1/auth/logout`), but `xcecli logout` deletes the local token without calling it, so the token stays valid until expiry.\n\n**Expected:** `xcecli logout` calls the logout API (best effort) before clearing local state.\n**Impact:** Security: a CLI token survives logout.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/frontend/xcecli/cmd/auth", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "xcecli", + "security", + "jwt" + ], + "related_bugs": [ + "bug-1946" + ], + "fix_commits": [], + "record": ".wolf/bugs/bug-1959.md" + }, + { + "id": "bug-1960", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "controller", + "severity": "wrong-result", + "timestamp": "2026-10-10T10:16:02Z", + "last_seen": "2026-10-10T10:16:02Z", + "occurrences": 1, + "error_message": "closed queues accept submissions: controller never checks, apiserver skips the default queue\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1938 fix: `handle_jobsubmit()` (`src/controller/job.c`) never checks `QUEUE_STAT_CLOSED`; the apiserver's check in `preCheckJobRequest()` runs only when a queue name is given, so a submission without one goes to `normal` unchecked, and non-REST submit paths (libxce, harness) are not checked at all.\n\n**Expected:** A submission to a closed queue (explicit or default) is rejected with a clear error on every submit path.\n**Impact:** Admin queue close silently ignored for default-queue and non-REST submissions.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/controller/job.c, src/frontend/apiserver/controllers/jobs.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "controller", + "apiserver", + "queue", + "admin-control" + ], + "related_bugs": [ + "bug-1938" + ], + "fix_commits": [], + "record": ".wolf/bugs/bug-1960.md" + }, + { + "id": "bug-1961", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "wrong-result", + "timestamp": "2026-10-10T10:16:04Z", + "last_seen": "2026-10-10T10:16:04Z", + "occurrences": 1, + "error_message": "apiserver ControlHost writes a second response after validateHost rejected the request\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1949 fix: `validateHost` (`controllers/hosts.go`) writes a 403 via `ReturnError` without aborting and `ControlHost` continues and writes another response (today masked by the route's RequirePermission).\n\n**Expected:** A rejected host control stops after the first error response.\n**Impact:** Wrong result / noise: double responses, possible action after a rejection if the route guard changes.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/frontend/apiserver/controllers/hosts.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "hosts" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1961.md" + }, + { + "id": "bug-1962", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "security", + "timestamp": "2026-10-10T10:16:07Z", + "last_seen": "2026-10-10T10:16:07Z", + "occurrences": 1, + "error_message": "apiserver JWT excluded-path check drops the last character of every entry, matching unintended paths\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`ValidateHandler.isExcludedPath` (`middleware/validatehandler.go:52-61`) trims the last character of every excluded entry, not only a trailing `*`, and matches by prefix: `/ping` matches any path starting with `/pin`, and `/swagger/*any` never matches.\n\n**Expected:** Exact entries match exactly; only entries ending in `*` match by prefix.\n**Impact:** Security: paths that merely share a prefix with an excluded entry skip JWT validation.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/frontend/apiserver/middleware/validatehandler.go", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "security", + "jwt" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1962.md" + }, + { + "id": "bug-1963", + "status": "investigating", + "status_updated": "2026-10-10", + "status_note": "suspected; confirm with a scheduler fixture test", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T10:16:09Z", + "last_seen": "2026-10-10T10:16:09Z", + "occurrences": 1, + "error_message": "xce_scheduler host iteration offers unavailable or reconciling hosts as placement candidates\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nSuspected (reported by the bug-1939 fix, not verified): `sched_host_iter_next()` (`src/scheduler/src/host_iter.c`) skips admin-closed hosts since bug-1939 but not `XCE_WORKER_UNAVAIL` or `XCE_WORKER_RECONCILING`; other checks (`resource.c:704,887`, `core_session.c:136`) are accounting skips, not placement filters.\n\n**Expected:** Unavailable and reconciling hosts get no new placements.\n**Impact:** Possible dispatch to a dead or reconciling host (dispatch then fails and is retried).\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/scheduler/src/host_iter.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "host" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1963.md" + }, + { + "id": "bug-1964", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "scheduler", + "severity": "wrong-result", + "timestamp": "2026-10-10T10:16:12Z", + "last_seen": "2026-10-10T10:16:12Z", + "occurrences": 1, + "error_message": "xce_scheduler --sim does not re-seed limits when a config push arrives mid-replay\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\nReported by the bug-1943 fix: the simulator seeds the limit plugin only at bootstrap (`sim_bootstrap_limit_plugin`); a CONFIG_PUSH during replay updates groups (bug-1943) but a new or changed limit config never reaches the limit plugin, while the live scheduler applies it (`plugin_config_update`).\n\n**Expected:** Live and simulated scheduling apply the same limits after a config change.\n**Impact:** Replays that span a limit config change decide differently than live.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/scheduler/src/sim_limit.c, src/scheduler/src/core_events.c", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "scheduler", + "sim", + "equivalence", + "limit" + ], + "related_bugs": [ + "bug-1943" + ], + "fix_commits": [], + "record": ".wolf/bugs/bug-1964.md" + }, + { + "id": "bug-1965", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "build", + "severity": "noise", + "timestamp": "2026-10-10T10:16:14Z", + "last_seen": "2026-10-10T10:16:14Z", + "occurrences": 1, + "error_message": "xce-build.sh apiserver skips the middleware, router and cmd Go test packages\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`xce-build.sh` runs `go test ./store/... ./utils/... ./controllers/... ./backend/...` for the apiserver; `./middleware/...`, `./router/...`, `./cmd/...` (which hold several security tests since bug-1945..1952) are never run by the build.\n\n**Expected:** The build runs every apiserver test package.\n**Impact:** Regressions in middleware/router/cmd tests go unnoticed by `/xce-build`.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/tools/xce-build.sh", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "build", + "tests", + "apiserver" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1965.md" + }, + { + "id": "bug-1966", + "status": "open", + "status_updated": "2026-10-10", + "status_note": "newly logged", + "component": "apiserver", + "severity": "noise", + "timestamp": "2026-10-10T10:16:16Z", + "last_seen": "2026-10-10T10:16:16Z", + "occurrences": 1, + "error_message": "apiserver swagger generation fails on hosts.go models.Error; published swagger is a stale stub\n\n**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))\n`swag init -g cmd/main.go` fails: `ParseComment error in controllers/hosts.go for comment: '// @Failure 400 {object} models.Error': cannot find type definition: models.Error`. `docs/swagger.yaml` is a 212-line stub last generated before the meson merge (no job-control endpoints).\n\n**Expected:** Swagger generates from the annotations and the published spec covers the API.\n**Impact:** API documentation missing/stale.\n**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)", + "file": "src/frontend/apiserver/controllers/hosts.go, src/frontend/apiserver/docs/swagger.yaml", + "root_cause": "TODO: required for fixed/partial", + "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why", + "tags": [ + "apiserver", + "docs", + "swagger" + ], + "related_bugs": [], + "fix_commits": [], + "record": ".wolf/bugs/bug-1966.md" } ] } diff --git a/.wolf/bugs/bug-1958.md b/.wolf/bugs/bug-1958.md new file mode 100644 index 00000000..c0df7d5a --- /dev/null +++ b/.wolf/bugs/bug-1958.md @@ -0,0 +1,50 @@ +--- +id: "bug-1958" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T10:15:56Z" +last_seen: "2026-10-10T10:15:56Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/roles.go"] +tags: ["apiserver", "security", "rbac"] +related: ["bug-1952"] +--- + +# bug-1958: apiserver lets any rbac:control grant create roles and extend its own role (privilege escalation) + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Reported by the bug-1952 fix: role create/update in `controllers/roles.go` accepts any `rbac:control` scope, so a user holding `rbac:control` with scope `self` can add `cluster:control` (or any permission) to a role it already holds: the same escalation bug-1952 closed for user-role assignment, by another route. + +**Expected:** Creating roles or changing a role's permissions requires `rbac:control` with scope `all` (as user-role changes do since bug-1952). +**Impact:** Security: privilege escalation through role editing. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Give user mallory a role with `rbac:control` scoped `self`. +2. As mallory, add `cluster:control` (domain all) to that role through the roles API; it is accepted. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1959.md b/.wolf/bugs/bug-1959.md new file mode 100644 index 00000000..48cd22fe --- /dev/null +++ b/.wolf/bugs/bug-1959.md @@ -0,0 +1,50 @@ +--- +id: "bug-1959" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "xcecli" +severity: "security" +timestamp: "2026-10-10T10:15:59Z" +last_seen: "2026-10-10T10:15:59Z" +occurrences: 1 +files: ["src/frontend/xcecli/cmd/auth"] +tags: ["xcecli", "security", "jwt"] +related: ["bug-1946"] +--- + +# bug-1959: xcecli logout only clears local config and never calls the logout API, so the token is not revoked + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Reported by the bug-1946 fix: server-side token revocation exists (`POST /xce/v1/auth/logout`), but `xcecli logout` deletes the local token without calling it, so the token stays valid until expiry. + +**Expected:** `xcecli logout` calls the logout API (best effort) before clearing local state. +**Impact:** Security: a CLI token survives logout. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (dev shell; `xcecli` itself is a statically linked Go binary, CGO disabled) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. `xcecli login`, copy the token, `xcecli logout`. +2. Call any API with the copied token: it succeeds. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1960.md b/.wolf/bugs/bug-1960.md new file mode 100644 index 00000000..92549640 --- /dev/null +++ b/.wolf/bugs/bug-1960.md @@ -0,0 +1,50 @@ +--- +id: "bug-1960" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "controller" +severity: "wrong-result" +timestamp: "2026-10-10T10:16:02Z" +last_seen: "2026-10-10T10:16:02Z" +occurrences: 1 +files: ["src/controller/job.c", "src/frontend/apiserver/controllers/jobs.go"] +tags: ["controller", "apiserver", "queue", "admin-control"] +related: ["bug-1938"] +--- + +# bug-1960: closed queues accept submissions: controller never checks, apiserver skips the default queue + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Reported by the bug-1938 fix: `handle_jobsubmit()` (`src/controller/job.c`) never checks `QUEUE_STAT_CLOSED`; the apiserver's check in `preCheckJobRequest()` runs only when a queue name is given, so a submission without one goes to `normal` unchecked, and non-REST submit paths (libxce, harness) are not checked at all. + +**Expected:** A submission to a closed queue (explicit or default) is rejected with a clear error on every submit path. +**Impact:** Admin queue close silently ignored for default-queue and non-REST submissions. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Close queue `normal`. +2. Submit a job without a queue (REST) or through xce_test: it is accepted. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1961.md b/.wolf/bugs/bug-1961.md new file mode 100644 index 00000000..59e0dc75 --- /dev/null +++ b/.wolf/bugs/bug-1961.md @@ -0,0 +1,49 @@ +--- +id: "bug-1961" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "wrong-result" +timestamp: "2026-10-10T10:16:04Z" +last_seen: "2026-10-10T10:16:04Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/hosts.go"] +tags: ["apiserver", "hosts"] +related: [] +--- + +# bug-1961: apiserver ControlHost writes a second response after validateHost rejected the request + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Reported by the bug-1949 fix: `validateHost` (`controllers/hosts.go`) writes a 403 via `ReturnError` without aborting and `ControlHost` continues and writes another response (today masked by the route's RequirePermission). + +**Expected:** A rejected host control stops after the first error response. +**Impact:** Wrong result / noise: double responses, possible action after a rejection if the route guard changes. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Call ControlHost so that validateHost rejects (see the handler) with the route guard removed in a unit test; two writes occur. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1962.md b/.wolf/bugs/bug-1962.md new file mode 100644 index 00000000..910b25cf --- /dev/null +++ b/.wolf/bugs/bug-1962.md @@ -0,0 +1,49 @@ +--- +id: "bug-1962" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "security" +timestamp: "2026-10-10T10:16:07Z" +last_seen: "2026-10-10T10:16:07Z" +occurrences: 1 +files: ["src/frontend/apiserver/middleware/validatehandler.go"] +tags: ["apiserver", "security", "jwt"] +related: [] +--- + +# bug-1962: apiserver JWT excluded-path check drops the last character of every entry, matching unintended paths + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +`ValidateHandler.isExcludedPath` (`middleware/validatehandler.go:52-61`) trims the last character of every excluded entry, not only a trailing `*`, and matches by prefix: `/ping` matches any path starting with `/pin`, and `/swagger/*any` never matches. + +**Expected:** Exact entries match exactly; only entries ending in `*` match by prefix. +**Impact:** Security: paths that merely share a prefix with an excluded entry skip JWT validation. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Request `/pinX` (or any route sharing the prefix) without a token: JWT validation is skipped. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1963.md b/.wolf/bugs/bug-1963.md new file mode 100644 index 00000000..ac7a1ba5 --- /dev/null +++ b/.wolf/bugs/bug-1963.md @@ -0,0 +1,49 @@ +--- +id: "bug-1963" +status: "investigating" +status_updated: "2026-10-10" +status_note: "suspected; confirm with a scheduler fixture test" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T10:16:09Z" +last_seen: "2026-10-10T10:16:09Z" +occurrences: 1 +files: ["src/scheduler/src/host_iter.c"] +tags: ["scheduler", "host"] +related: [] +--- + +# bug-1963: xce_scheduler host iteration offers unavailable or reconciling hosts as placement candidates + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Suspected (reported by the bug-1939 fix, not verified): `sched_host_iter_next()` (`src/scheduler/src/host_iter.c`) skips admin-closed hosts since bug-1939 but not `XCE_WORKER_UNAVAIL` or `XCE_WORKER_RECONCILING`; other checks (`resource.c:704,887`, `core_session.c:136`) are accounting skips, not placement filters. + +**Expected:** Unavailable and reconciling hosts get no new placements. +**Impact:** Possible dispatch to a dead or reconciling host (dispatch then fails and is retried). +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Mark a host UNAVAIL in a scheduler fixture and check whether the iterator offers it. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1964.md b/.wolf/bugs/bug-1964.md new file mode 100644 index 00000000..c865587a --- /dev/null +++ b/.wolf/bugs/bug-1964.md @@ -0,0 +1,49 @@ +--- +id: "bug-1964" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "scheduler" +severity: "wrong-result" +timestamp: "2026-10-10T10:16:12Z" +last_seen: "2026-10-10T10:16:12Z" +occurrences: 1 +files: ["src/scheduler/src/sim_limit.c", "src/scheduler/src/core_events.c"] +tags: ["scheduler", "sim", "equivalence", "limit"] +related: ["bug-1943"] +--- + +# bug-1964: xce_scheduler --sim does not re-seed limits when a config push arrives mid-replay + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +Reported by the bug-1943 fix: the simulator seeds the limit plugin only at bootstrap (`sim_bootstrap_limit_plugin`); a CONFIG_PUSH during replay updates groups (bug-1943) but a new or changed limit config never reaches the limit plugin, while the live scheduler applies it (`plugin_config_update`). + +**Expected:** Live and simulated scheduling apply the same limits after a config change. +**Impact:** Replays that span a limit config change decide differently than live. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Replay a recording with a CONFIG_PUSH that changes a limit; compare decisions with live. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1965.md b/.wolf/bugs/bug-1965.md new file mode 100644 index 00000000..aca0f11a --- /dev/null +++ b/.wolf/bugs/bug-1965.md @@ -0,0 +1,49 @@ +--- +id: "bug-1965" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "build" +severity: "noise" +timestamp: "2026-10-10T10:16:14Z" +last_seen: "2026-10-10T10:16:14Z" +occurrences: 1 +files: ["src/tools/xce-build.sh"] +tags: ["build", "tests", "apiserver"] +related: [] +--- + +# bug-1965: xce-build.sh apiserver skips the middleware, router and cmd Go test packages + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +`xce-build.sh` runs `go test ./store/... ./utils/... ./controllers/... ./backend/...` for the apiserver; `./middleware/...`, `./router/...`, `./cmd/...` (which hold several security tests since bug-1945..1952) are never run by the build. + +**Expected:** The build runs every apiserver test package. +**Impact:** Regressions in middleware/router/cmd tests go unnoticed by `/xce-build`. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. Read `src/tools/xce-build.sh` (apiserver go test line); break a middleware test and run `/xce-build apiserver`: it passes. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none diff --git a/.wolf/bugs/bug-1966.md b/.wolf/bugs/bug-1966.md new file mode 100644 index 00000000..4f95cc8a --- /dev/null +++ b/.wolf/bugs/bug-1966.md @@ -0,0 +1,49 @@ +--- +id: "bug-1966" +status: "open" +status_updated: "2026-10-10" +status_note: "newly logged" +component: "apiserver" +severity: "noise" +timestamp: "2026-10-10T10:16:16Z" +last_seen: "2026-10-10T10:16:16Z" +occurrences: 1 +files: ["src/frontend/apiserver/controllers/hosts.go", "src/frontend/apiserver/docs/swagger.yaml"] +tags: ["apiserver", "docs", "swagger"] +related: [] +--- + +# bug-1966: apiserver swagger generation fails on hosts.go models.Error; published swagger is a stale stub + +## Description +**Observed:** (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) +`swag init -g cmd/main.go` fails: `ParseComment error in controllers/hosts.go for comment: '// @Failure 400 {object} models.Error': cannot find type definition: models.Error`. `docs/swagger.yaml` is a 212-line stub last generated before the meson merge (no job-control endpoints). + +**Expected:** Swagger generates from the annotations and the published spec covers the API. +**Impact:** API documentation missing/stale. +**Found by:** follow-up of the 2026-10-10 P0 fixes (bug-1936..1957) +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: scheduler-framework @ 19be145d-dirty +- Deployment: any (found by source reading; confirmed by the RED test of the fix) + +## Reproduction +1. `cd src/frontend/apiserver && swag init -g cmd/main.go -o /tmp/x`: fails as above. +- Frequency: deterministic (by code reading; confirmed by the RED test of the fix) +- Evidence: the code sites quoted in Description; no logs kept. +## Root cause +TODO: required for fixed/partial + +## Fix +TODO: required for fixed/partial + +## Verification +- Test: TODO: name + file; RED before the fix, GREEN after +- Suites: TODO: suite results and build profile +- Live: TODO: soak/deploy run, or n/a and why + +## References +- Related: none