docs: bug-1909..1912 fixed; controller-peers-env-fallback gap notes resolved

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-03 13:07:37 +00:00 · 2026-10-03 13:07:37 +00:00 · 91782e4089
commit 91782e4089
parent ef6e562cde
6 changed files with 272 additions and 12 deletions
--- a/.wolf/bugs/bug-1909.md
+++ b/.wolf/bugs/bug-1909.md
@ -1,8 +1,8 @@
 ---
 id: "bug-1909"
-status: "open"
+status: "fixed"
 status_updated: "2026-10-03"
-status_note: "newly logged"
+status_note: ""
 component: "tooling"
 severity: "wrong-result"
 timestamp: "2026-10-03T08:09:49Z"
@ -11,6 +11,7 @@ occurrences: 1
 files: ["src/tools/test-version-startup-consistency.sh"]
 tags: ["test-script", "version", "dirty-fingerprint", "scheduler"]
 related: []
+fix_commits: ["ef6e562c"]
 ---

 # bug-1909: test-version-startup-consistency.sh scheduler check fails on any dirty tree (fingerprint vs -dirty)
@ -41,15 +42,15 @@ FAIL [scheduler]: commit id MISMATCH ('ac7a4385-f4637557' vs 'ac7a4385-dirty')
 - Evidence: not kept (the script deletes its work dir on exit). Separately, the script's apiserver `go build` fails on this machine with "module lookup disabled by GOPROXY=off" (no Go module cache) — unrelated environment limitation.

 ## Root cause
-TODO: required for fixed/partial
+`check_consistency()` in `src/tools/test-version-startup-consistency.sh` (written for build-time-versioning Req 2.2) requires the `--version` and startup-log commit ids to be byte-identical. The later dirty-content-fingerprint feature deliberately made `--version` show `<sha>-<8-hex fingerprint>` on a dirty tree while the startup log keeps `<sha>-dirty` (its requirements.md scope note and Req 3.2 call this a scoped exception), but this script was never updated, so it fails on any dirty tree.

 ## Fix
-TODO: required for fixed/partial
+`check_consistency()` now treats exactly that pairing as agreement: `--version` matching `^(.+)-[0-9a-f]{8}$` and the startup log equal to `<same sha>-dirty` (the fingerprint is `sha256sum | cut -c1-8`, `xce-build.sh`). Anything else is still compared byte-for-byte. Self-test cases (e) (pairing accepted) and (f) (different sha, or a fingerprint against a clean log, rejected) added to `demonstrate_detection_capability()`; header, PASS line and final banner reworded.

 ## Verification
- Test: TODO: name + file; RED before the fix, GREEN after
- Suites: TODO: suite results and build profile
- Live: TODO: soak/deploy run, or n/a and why
+- Test: `demonstrate_detection_capability()` case (e) in `src/tools/test-version-startup-consistency.sh` — RED before the fix (extracted harness: `FAIL [DEMO-dirty-fingerprint-pairing]: commit id MISMATCH`), GREEN after; cases (a)-(c), (f) still reject.
+- Suites: `bash src/tools/test-version-startup-consistency.sh` exit 0 on a dirty tree (`[scheduler] --version fingerprint '66520e6b-a46c0a00' pairs with startup log '66520e6b-dirty'`), 2026-10-03; `xce-build.sh all --incremental` (asan) green.
+- Live: n/a (test-script defect)

 ## References
 - Related: none
--- a/.wolf/bugs/bug-1910.md
+++ b/.wolf/bugs/bug-1910.md
@ -0,0 +1,59 @@
+---
+id: "bug-1910"
+status: "fixed"
+status_updated: "2026-10-03"
+status_note: ""
+component: "tooling"
+severity: "wrong-result"
+timestamp: "2026-10-03T12:14:03Z"
+last_seen: "2026-10-03T12:14:03Z"
+occurrences: 1
+files: ["src/tools/test-version-startup-consistency.sh", "src/tools/test-dirty-fingerprint-startup-log-unchanged.sh"]
+tags: ["test-script", "apiserver", "go", "vendor"]
+related: ["bug-1607", "bug-1608", "bug-1909"]
+fix_commits: ["ef6e562c"]
+---
+
+# bug-1910: version scripts' apiserver go build uses -mod=readonly and fails without a Go module cache
+
+## Description
+**Observed:**
+```
+models/auth.go:4:2: module lookup disabled by GOPROXY=off
+utils/utils.go:18:2: module lookup disabled by GOPROXY=off
+...
+FATAL: command failed (line 383)
+```
+Both `test-version-startup-consistency.sh` and `test-dirty-fingerprint-startup-log-unchanged.sh` build the apiserver with `GOPROXY=off go build -mod=readonly ...`. `-mod=readonly` makes Go ignore the committed `src/frontend/apiserver/vendor/` tree and resolve modules from the module cache, which this machine does not have, so the build fails and the scripts never reach their apiserver checks.
+
+**Expected:** the scripts build the apiserver the way the canonical meson build does (`GOFLAGS=-mod=vendor`, `src/frontend/apiserver/meson.build:89`), which needs no module cache and never modifies go.mod/go.sum (the concern -mod=readonly was added for, bug-1607).
+**Impact:** both scripts exit 1 on any machine without a populated Go module cache; their apiserver halves are never exercised. Test-only.
+**Found by:** spec task (controller-peers-env-fallback tasks 5.2/5.3)
+
+## Environment
+- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
+- libc: glibc 2.42-47 (nix devShell, /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47)
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: debug (the scripts' own lib/scheduler builds) + direct `go build` of the apiserver
+- Code: scheduler-framework @ 66520e6b-dirty
+- Deployment: n/a — local script builds, no cluster
+
+## Reproduction
+1. On a machine with no Go module cache, run `bash src/tools/test-dirty-fingerprint-startup-log-unchanged.sh` (or `test-version-startup-consistency.sh`).
+2. The apiserver step fails with `module lookup disabled by GOPROXY=off`.
+- Frequency: deterministic on this machine, 2026-10-03 (every run during controller-peers-env-fallback 5.2/5.3)
+- Evidence: not kept (scratchpad logs from the 5.3 run)
+
+## Root cause
+Both scripts build the apiserver with `GOPROXY=off go build -mod=readonly`. `-mod=readonly` makes Go ignore the committed `src/frontend/apiserver/vendor/` tree and resolve modules from the module cache; the scripts were written on a machine whose cache was already populated, so on a machine without one every import fails with `module lookup disabled by GOPROXY=off`.
+
+## Fix
+Use `-mod=vendor`, as the canonical meson build does (`GOFLAGS=-mod=vendor`, `src/frontend/apiserver/meson.build:89`). Vendor mode needs no module cache and never modifies go.mod/go.sum, so the bug-1607 no-repo-mutation property still holds. Header comments updated in both scripts.
+
+## Verification
+- Test: `bash src/tools/test-dirty-fingerprint-startup-log-unchanged.sh` — RED before (FATAL at the apiserver `go build`, 12x `module lookup disabled by GOPROXY=off`), GREEN after (exit 0, apiserver checks PASS); same for `test-version-startup-consistency.sh` (exit 0, `PASS [apiserver]`), 2026-10-03.
+- Suites: go.mod/go.sum unchanged (md5 and `git status src/frontend` checked by the reviewer); `xce-build.sh all --incremental` (asan) green.
+- Live: n/a (test-script defect)
+
+## References
+- Related: none
--- a/.wolf/bugs/bug-1911.md
+++ b/.wolf/bugs/bug-1911.md
@ -0,0 +1,58 @@
+---
+id: "bug-1911"
+status: "fixed"
+status_updated: "2026-10-03"
+status_note: ""
+component: "worker"
+severity: "leak"
+timestamp: "2026-10-03T12:14:06Z"
+last_seen: "2026-10-03T12:14:06Z"
+occurrences: 1
+files: ["src/worker/src/main.c"]
+tags: ["asan", "lsan", "worker", "cli"]
+related: []
+fix_commits: ["ef6e562c"]
+---
+
+# bug-1911: worker leaks the -l log-dir string when -h or --version follows -l
+
+## Description
+**Observed:**
+```
+$ xcecd_virtual -l <dir> -h        # rc=1 under ASAN
+==222451==ERROR: LeakSanitizer: detected memory leaks
+Direct leak of 127 byte(s) in 1 object(s) allocated from:
+```
+Same with `--version`. `-l` stores `strdup(optarg)` in `logdir`; the `-h`/default and `--version` cases in the getopt loop (`src/worker/src/main.c` ~L433-465) `return 0` without freeing it.
+
+**Expected:** `-h` and `--version` exit 0 with no leak report, whatever other options precede them.
+**Impact:** under ASAN/LSan the worker's help/version exits 1 with a leak report when `-l` is given first; trivial in release builds (process exits). Pre-existing, found while reviewing controller-peers-env-fallback task 3.2.
+**Found by:** review (controller-peers-env-fallback task 3.2)
+
+## Environment
+- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
+- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: asan (xce.build)
+- Code: scheduler-framework @ 66520e6b-dirty
+- Deployment: n/a — single local process
+
+## Reproduction
+1. `src/xce.build/worker/xcecd_virtual -l /tmp/x -h; echo rc=$?` (ASAN build)
+2. LeakSanitizer reports a 127-byte direct leak and rc=1. Same with `--version`.
+- Frequency: deterministic, 2026-10-03
+- Evidence: not kept
+
+## Root cause
+In `src/worker/src/main.c`'s getopt loop, `-l` stores `strdup(optarg)` in `logdir`, but the `--version` (`OPT_VERSION`) and `-h`/default cases `return 0` without freeing it. Under ASAN, LeakSanitizer reports the 127-byte block and turns the exit status into 1.
+
+## Fix
+`FREEUP(logdir)` before both `return 0` statements. The other early returns after `-l` (peers parse/validation errors, mkdir failure) already free it.
+
+## Verification
+- Test: `case_worker_help_version_after_logdir_no_leak` in `src/tools/verify-controller-peers-env.sh` — RED before (`expected exit status 0, got 1`), GREEN after.
+- Suites: `xce-build.sh all --incremental` (asan): worker suite and all C tests 127/0, no ASAN/LSan reports; regression script 35/35, 2026-10-03.
+- Live: n/a
+
+## References
+- Related: none
--- a/.wolf/bugs/bug-1912.md
+++ b/.wolf/bugs/bug-1912.md
@ -0,0 +1,57 @@
+---
+id: "bug-1912"
+status: "fixed"
+status_updated: "2026-10-03"
+status_note: ""
+component: "lib"
+severity: "wrong-result"
+timestamp: "2026-10-03T12:14:09Z"
+last_seen: "2026-10-03T12:14:09Z"
+occurrences: 1
+files: ["src/lib/cluster.c"]
+tags: ["peers", "parser", "xceadmin", "consistency"]
+related: []
+fix_commits: ["ef6e562c"]
+---
+
+# bug-1912: xce_parse_peers keeps spaces around entries; xceadmin trims them, so name matching differs
+
+## Description
+**Observed:**
+```
+$ XCE_CONTROLLER_PEERS="a=localhost:1, b=localhost:2, c=localhost:3" xce_controller --myname b ...
+xce_controller: XCE_CONTROLLER_PEERS (a=localhost:1, b=localhost:2, c=localhost:3) has no candidate named 'b'; pass --myname <one of: a,  b,  c> ...
+```
+`xce_parse_peers()` splits on `,` and keeps the surrounding whitespace, so the second candidate's name is `" b"`. xceadmin's `resolve_controllers()` strips whitespace around each entry, so the same value works there.
+
+**Expected:** spaces around entries are ignored, as in xceadmin: `"a=h:1, b=h:2"` parses as names `a` and `b`.
+**Impact:** a peers list written with spaces after commas (natural in a shell variable or config) makes the controller's identity match fail (1.6 refusal from the env var, or a listener refusal with explicit --peers) and gives names/hosts with stray spaces in every C component. Shared libxce parser: affects controller, scheduler, worker, harness, apiserver backend.
+**Found by:** audit (controller-peers-env-fallback feature validation)
+
+## Environment
+- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
+- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: asan (xce.build)
+- Code: scheduler-framework @ 66520e6b-dirty
+- Deployment: n/a — single local process
+
+## Reproduction
+1. `XCE_CONTROLLER_PEERS="a=localhost:1, b=localhost:2, c=localhost:3" src/xce.build/controller/xce_controller --myname b --workdir <scratch> --certdir <empty scratch> --logfile <scratch>/c.log`
+2. stderr shows the refusal listing candidates `a,  b,  c` (leading spaces).
+- Frequency: deterministic, 2026-10-03
+- Evidence: not kept
+
+## Root cause
+`xce_parse_peers()` (`src/lib/cluster.c`) splits on `,` with `strtok_r` and uses each token as-is, so whitespace after a comma becomes part of the next candidate's name (or hostname), and a blank entry is a parse error. xceadmin's `resolve_controllers()` strips each entry and skips blanks, so the same value meant different things to the C components and xceadmin.
+
+## Fix
+Trim leading/trailing `isspace()` characters from each token in place and skip tokens that are empty after trimming (they no longer use a `MAX_HA_CANDIDATES` slot); doc comment in `src/include/xce/cluster.h` updated. Previously valid inputs parse identically apart from losing stray outer whitespace.
+
+## Verification
+- Test: `test_parse_peers_trims_spaces_around_entries`, `test_parse_peers_trims_unnamed_entry`, `test_parse_peers_skips_blank_entries` (+ guards `test_parse_peers_all_blank_rejected`, `test_parse_peers_entry_without_port_rejected`) in `src/lib/testsuite/test_cluster.c` — RED before (`Expected 'b' Was ' b'`, `Expected 'localhost' Was '  localhost'`, `Expected 0 Was -1`), GREEN after; regression case `case_controller_env_spaced_list` RED → GREEN.
+- Suites: libxce 730/0; `xce-build.sh all --incremental` (asan): C tests 127/0, scheduler 16/0, xceadmin 364 passed, no ASAN; regression script 35/35, 2026-10-03.
+- Live: n/a
+
+## References
+- Related: none