myxce/.wolf/STATUS.md

STATUS

Single source of truth for resuming work. Read this FIRST when starting a session. Update at the end of every work phase so the next /clear resumes in 1 read.

---

✅ Done

• Worker security fixes (2026-09-26, pushed, all TDD RED→GREEN, worker suite 12/12, sequential HA soaks PASS on xcecd_virtual):
  • bug-1508 (7723a4f4): worker fetchfile (root) opened any path. Now only <dir>/job_<jobid>_task<N>.out for the request's jobid (exact match, xcecd_is_job_output_path() in worker/include/job_output_path.h), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (submit with out_file=/etc/shadow, then GET output).
  • bug-1868 (7864a3da): job output file created as root in /tmp followed planted links. xcecd_create_job_output() unlinks + O_EXCL|O_NOFOLLOW.
  • bug-1869 (5df33e69): xcecd_worker.log (was chmod 0666 by path), /tmp/xcecd_worker.log append, and the restart flag. worker/include/xcecd_tmpfile.h: xcecd_open_owned_file() / xcecd_owned_file_exists(), fchmod instead of chmod(path).
  • Live gap: the sandbox only runs xcecd_virtual, so the real root worker's output/log creation is covered by unit tests only.
• bug-1754 (2026-09-26, 6876e4f6, pushed): a failed job's exit code is now persisted. A worker reports every nonzero exit as a FAIL (not FINISH), and WAL_JOB_FAIL had no code slot, so job.exit_info was NULL for every failed job. WAL_JOB_FAIL now carries an int32 code trailer (persist_submit_job_fail_fact); both apply seams adopt it via apply_job_fail_exit_code() (non-POST_EXEC stages only). apply_wal_entry also no longer assigns wire state 0 for STAGE_FLAG FAIL entries. New test_wal_job_fail_fact.c; controller suite 1228/0. Soaks: sequential 6 rounds PASS (SIMVERIFY 7 files, 0 mismatches) + factstream 2 rounds PASS.
• HA stability fixes (2026-09-25, pushed, soak-verified): bug-1864 (per-endpoint FIFO in vtask dispatcher), bug-1865 (primary control endpoint refcounted, no double-close), bug-1850 (NOT_READY retries in place, no failover rotate), bug-1854 (re-pushed resource defs are idempotent).
• bug-1714 / bug-1840 marked cannot-reproduce (0 crashes across 2,400-element burst on old + current builds).
• Gitea sync (2026-09-26): issues #264-#289 created (#287-#289 = bug-1508/1868/1869) (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854, 1508, 1868, 1869), #74 closed. Only a subset of the buglog is mirrored by design; scripts/gitea-sync.py gained --ids because bulk triage bumped the date fields --since relies on.
• Logged: bug-1866 (worker launch_type leak), bug-1867 (controller snapshot drops exit_info — capnp Job has no exit field).

---

🚀 Next phase

Goal: None active. Suggested order: bug-1747 FAIL half (add finish_time to the WAL_JOB_FAIL trailer) → bug-1867 (snapshot exit_info, capnp schema) → xce_test harness batch + bug-1866 → a tasks-ready spec.

Open items (not yet actioned)

• none pending

Files to create / edit

• none pending

Open decisions

• REST job output for jobs with a custom out_file/err_file: the worker never writes those paths (always /tmp/job_<id>_task<N>.out), so since bug-1508 GET /jobs/:id/output for such a job returns a permission error from the worker. Either the apiserver's resolveOutputPath() (controllers/output.go) always targets the worker's own output file, or the worker starts honouring out_file. Waiting on the user.

---

📁 Active architecture

• Stack: Go API/CLI tier (src/frontend/apiserver) fronting C daemons (src/controller, src/worker, src/scheduler); Meson-based build via src/tools/xce-build.sh, hermetic nix dev shell.
• Current focus area: src/controller persistence (WAL fact payloads/apply seams in persist.c, job.c) and worker root-privilege file handling (src/worker/include/job_output_path.h, xcecd_tmpfile.h).

---

🔧 Useful commands

# Build controller unit tests in place (nix shell) and run one group
cd src && nix develop . --command meson compile -C xce.build controller_unit_test xce_controller
ASAN_OPTIONS=detect_leaks=0 ./xce.build/controller/controller_unit_test -t test_wal_job_fail_fact

# HA soaks (sequential with real worker+scheduler; worker fact stream)
XCE_HA_ROUNDS=6 nix develop ./src --command bash .claude/skills/xce-test-ha/run-ha-soak.sh --sequential <dir>
nix develop ./src --command bash .claude/skills/xce-test-ha/run-ha-soak.sh --factstream <dir>

# Gitea bug sync (REST, no MCP needed) — always dry-run first
python3 scripts/gitea-sync.py --dry-run --bugs --since <date> [--ids bug-N,bug-M]