# STATUS

> Single source of truth for resuming work. Read this FIRST when starting a session.
> Update at the end of every work phase so the next `/clear` resumes in 1 read.

---

## ✅ Done

- **Worker security fixes** (2026-09-26, pushed, all TDD RED→GREEN, worker suite 12/12, sequential HA soaks PASS on xcecd_virtual):
  - **bug-1508** (`7723a4f4`): worker `fetchfile` (root) opened any path. Now only `<dir>/job_<jobid>_task<N>.out` for the request's jobid (exact match, `xcecd_is_job_output_path()` in `worker/include/job_output_path.h`), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (submit with `out_file=/etc/shadow`, then GET output).
  - **bug-1868** (`7864a3da`): job output file created as root in /tmp followed planted links. `xcecd_create_job_output()` unlinks + O_EXCL|O_NOFOLLOW.
  - **bug-1869** (`5df33e69`): `xcecd_worker.log` (was chmod 0666 by path), `/tmp/xcecd_worker.log` append, and the restart flag. `worker/include/xcecd_tmpfile.h`: `xcecd_open_owned_file()` / `xcecd_owned_file_exists()`, fchmod instead of chmod(path).
  - Live gap: the sandbox only runs `xcecd_virtual`, so the real root worker's output/log creation is covered by unit tests only.
- **bug-1754** (2026-09-26, `6876e4f6`, pushed): a failed job's exit code is now persisted. A worker reports every nonzero exit as a FAIL (not FINISH), and WAL_JOB_FAIL had no code slot, so `job.exit_info` was NULL for every failed job. WAL_JOB_FAIL now carries an int32 code trailer (`persist_submit_job_fail_fact`); both apply seams adopt it via `apply_job_fail_exit_code()` (non-POST_EXEC stages only). `apply_wal_entry` also no longer assigns wire state 0 for STAGE_FLAG FAIL entries. New `test_wal_job_fail_fact.c`; controller suite 1228/0. Soaks: sequential 6 rounds PASS (SIMVERIFY 7 files, 0 mismatches) + factstream 2 rounds PASS.
- **HA stability fixes** (2026-09-25, pushed, soak-verified): bug-1864 (per-endpoint FIFO in vtask dispatcher), bug-1865 (primary control endpoint refcounted, no double-close), bug-1850 (NOT_READY retries in place, no failover rotate), bug-1854 (re-pushed resource defs are idempotent).
- **bug-1714 / bug-1840** marked cannot-reproduce (0 crashes across 2,400-element burst on old + current builds).
- **Gitea sync** (2026-09-26): issues #264-#289 created (#287-#289 = bug-1508/1868/1869) (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854, 1508, 1868, 1869), #74 closed. Only a subset of the buglog is mirrored by design; `scripts/gitea-sync.py` gained `--ids` because bulk triage bumped the date fields `--since` relies on.
- Logged: **bug-1866** (worker `launch_type` leak), **bug-1867** (controller snapshot drops `exit_info` — capnp `Job` has no exit field).

---

## 🚀 Next phase

**Goal:** _None active._ Suggested order: bug-1747 FAIL half (add finish_time to the WAL_JOB_FAIL trailer) → bug-1867 (snapshot exit_info, capnp schema) → `xce_test` harness batch + bug-1866 → a tasks-ready spec.

### Open items (not yet actioned)
- _none pending_

### Files to create / edit
- _none pending_

### Open decisions
- **REST job output for jobs with a custom `out_file`/`err_file`**: the worker never writes those paths (always `/tmp/job_<id>_task<N>.out`), so since bug-1508 `GET /jobs/:id/output` for such a job returns a permission error from the worker. Either the apiserver's `resolveOutputPath()` (controllers/output.go) always targets the worker's own output file, or the worker starts honouring `out_file`. Waiting on the user.

---

## 📁 Active architecture

- **Stack:** Go API/CLI tier (`src/frontend/apiserver`) fronting C daemons (`src/controller`, `src/worker`, `src/scheduler`); Meson-based build via `src/tools/xce-build.sh`, hermetic nix dev shell.
- **Current focus area:** `src/controller` persistence (WAL fact payloads/apply seams in `persist.c`, `job.c`) and worker root-privilege file handling (`src/worker/include/job_output_path.h`, `xcecd_tmpfile.h`).

---

## 🔧 Useful commands

```bash
# Build controller unit tests in place (nix shell) and run one group
cd src && nix develop . --command meson compile -C xce.build controller_unit_test xce_controller
ASAN_OPTIONS=detect_leaks=0 ./xce.build/controller/controller_unit_test -t test_wal_job_fail_fact

# HA soaks (sequential with real worker+scheduler; worker fact stream)
XCE_HA_ROUNDS=6 nix develop ./src --command bash .claude/skills/xce-test-ha/run-ha-soak.sh --sequential <dir>
nix develop ./src --command bash .claude/skills/xce-test-ha/run-ha-soak.sh --factstream <dir>

# Gitea bug sync (REST, no MCP needed) — always dry-run first
python3 scripts/gitea-sync.py --dry-run --bugs --since <date> [--ids bug-N,bug-M]
```