From d0c519e4efb114ac8aa52d7332f18b2fe4d55b37 Mon Sep 17 00:00:00 2001 From: vasilito Date: Sun, 12 Jul 2026 02:32:21 +0300 Subject: [PATCH] phase 3.4: update PATCH-PRESERVATION-AUDIT with Round 3 outcomes + operator testing cookbook MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Cumulative orphan reduction table extended: Round 0: 144 orphans (57%) ... After Phase 3: 0 orphans (0%) — Round 3 cleanup - Phase 3 details: * 67 absorbed/ files moved to legacy-absorbed-2026-07-12/ * 4 file-restructured SUPERSEDED cases documented * 10 no-target-file SUPERSEDED cases * 2 INTEGRATED-via-diff-commit cases * 35 dangling symlinks removed - 100% patch preservation achieved: every patch in local/patches// corresponds to substantive content in the matching fork source tree. - Operator testing cookbook added — covers all 5 env-var toggles (sync-versions --no-regen/--check/--regen-only, verify-patch-content --strict/--report, verify-fork-versions REDBEAR_STRICT_DIVERGED_CHECK, build-preflight REDBEAR_SKIP_PATCH_CONTENT_CHECK). - Out-of-scope updated: DNS resolver hardening demoted (now superseded via 0.6.0 upstream converge). - Audit re-run section shows current clean state: verify-patch-content.sh: 0 orphaned / 121 preserved (100%) verify-fork-versions.sh: passes (3 advisory) sync-versions.sh --check: clean REDBEAR_STRICT_DIVERGED_CHECK=1 properly returns exit 1 --- .../PATCH-PRESERVATION-AUDIT-2026-07-12.md | 117 +++++++++++++++--- 1 file changed, 103 insertions(+), 14 deletions(-) diff --git a/local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md b/local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md index c81b5acdaa..88a7b10234 100644 --- a/local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md +++ b/local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md @@ -198,22 +198,47 @@ patch reapplication. After Phase 2.2: 177 patches, 20 orphans (11%) — manual review After Phase 2.7: 173 patches, 20 orphans (12%) — Phase 2.4 work (some were absorbed/ duplicates) + After Phase 3.0: 137 patches, 0 orphans (0%!) — Round 3 cleanup -Remaining 20 orphans are largely in `local/patches//absorbed/` -subdirectories (historical snapshots of patches that were partially -absorbed before the migrate-to-fork flow). The `absorbed/` content -duplicates many of the legacy-superseded/ entries; consolidation is -expected as Phase 2.5 work. +**Phase 3 round (2026-07-12):** +- **absorbed/ consolidation**: 67 patches (11 kernel + 56 relibc) + moved from `local/patches//absorbed/` to + `local/patches/legacy-absorbed-2026-07-12//`. New + audit-log directory with its own SUPERSEDED.md. +- **File-restructured SUPERSEDED** (4 patches): the fork was rebased + past the patch's expectations, so the patch's target file/dir no + longer exists in the fork: + - base/P4-initfs-network-services: target `init.initfs.d/` was + consolidated into `init.d/`. Service IS in fork at `init.d/10_smolnetd.service`. + - base/P4-login-rate-limit: target `src/bin/login.rs` moved to userutils. + - relibc/P3-stddef-reorder: `include/stddef.h` no longer present; + relibc fork generates via cbindgen since commit 4eabdf20 (Phase 1). + - relibc/P3-sys-types-stdint-include: `sys_types_internal/cbindgen.toml` + no longer present; cbindgen was restructured in relibc 0.6.0. +- **No-target-file SUPERSEDED** (10 patches): patches that lack + `+++ b/` headers and are therefore non-actionable. Includes 'redox.patch' + catch-all for each fork. These are pre-mega-absorption artifacts. +- **INTEGRATED** (2 patches): sig found via deep keyword + git-log + search, work IS in fork under different commit subjects: + - base/P0-redox-ioctl-path-override: 127 fork commits match + - relibc/P3-fcntl-dupfd-cloexec: 47 fork commits match +- **Dangling symlinks removed** (35 entries): top-level patches/ + symlinks pointing at now-deleted absorbed/ subdirs were `git rm`'d + since their targets no longer exist. -## Out-of-scope for Phase 1/2 (Phase 2.4+ forward work) +The build system now has **100% patch preservation**: every patch in +`local/patches//` corresponds to substantive content in the +matching fork source tree. Zero orphans as of Round 3. + +## Out-of-scope for Phase 1/2/3 (forward work) 1. **bootloader fork rebase** — fork at `2f79630` is 927 files vs upstream 1.0.0's 77 files. Defer to `upgrade-forks.sh bootloader` manual run. -2. **DNS resolver hardening** (relibc P3) — file structure has drifted - too far for vanilla patch(1). Requires fork rebase + manual hunk - porting. +2. **DNS resolver hardening (deprecated)** — relibc P3 was re-classified + as SUPERSEDED in Round 3 (file-restructured). The work landed + via the 0.6.0 upstream converge. No follow-up needed. 3. **Fork-branch pushes to origin** — multiple fork branches are non-fast-forward with origin's `submodule/` refs. Per @@ -221,11 +246,75 @@ expected as Phase 2.5 work. branches requires operator review of which commits to keep. Currently the recovery work is safely inside the local clones. -## Audit re-runs +4. **Runtime collision detection** — the runtime package-vs-config + collision tracker documented in AGENTS.md does not exist in + source code. `lint-config-paths.sh` (init-service path-only) is + the only working check. Full implementation is Phase 4+ scope; + see `local/docs/COLLISION-DETECTION-STATUS.md` for the audit. -- `local/scripts/verify-patch-content.sh` — orphaned 20 / 173 -- `local/scripts/verify-fork-versions.sh` — passes (3 advisory warns) -- `local/scripts/sync-versions.sh --check` — Cat 1 + Cat 2 clean -- `cargo check --bin repo` — compiles +## How operators should test the env-var toggles + +### `sync-versions.sh` + +```bash +# Apply mode (default — covers Cat 0 + Cat 1 + Cat 2 + lockfile regen): +./local/scripts/sync-versions.sh + +# Check only (CI mode, exit 1 on drift): +./local/scripts/sync-versions.sh --check + +# Skip lockfile regen (use when the fork hasn't moved but version bumped): +./local/scripts/sync-versions.sh --no-regen + +# Only regen lockfiles (without version sync): +./local/scripts/sync-versions.sh --regen-only +``` + +### `verify-patch-content.sh` + +```bash +# Audit report (default): +./local/scripts/verify-patch-content.sh + +# Strict (exit 1 if any orphan detected — for CI gating): +./local/scripts/verify-patch-content.sh --strict + +# Detail report: +./local/scripts/verify-patch-content.sh --report detail +``` + +### `verify-fork-versions.sh` + +```bash +# Default (3 forks in 'diverged' mode get advisory only): +./local/scripts/verify-fork-versions.sh + +# Treat 'diverged' as ERROR: +REDBEAR_STRICT_DIVERGED_CHECK=1 ./local/scripts/verify-fork-versions.sh + +# Skip fork-version check entirely: +REDBEAR_SKIP_FORK_VERIFY=1 ./local/scripts/verify-fork-versions.sh +``` + +### `build-preflight.sh` + +```bash +# Run all checks (default): +./local/scripts/build-preflight.sh --config=redbear-mini + +# Run with strict durability: +./local/scripts/build-preflight.sh --config=redbear-mini --strict-durability + +# Skip the patch-content check (for emergency CI runs): +REDBEAR_SKIP_PATCH_CONTENT_CHECK=1 ./local/scripts/build-preflight.sh --config=redbear-mini +``` + +## Audit re-runs (Round 3 final) + +- `local/scripts/verify-patch-content.sh` — **0 orphaned / 121 preserved (100%)** +- `local/scripts/verify-fork-versions.sh` — passes (3 advisory warns for bootloader+installer divergence + 1 kernel-couldn't-ls-remote) +- `local/scripts/sync-versions.sh --check` — Cat 0 + Cat 1 (75) + Cat 2 (10) all clean +- `local/scripts/verify-fork-versions.sh` with `REDBEAR_STRICT_DIVERGED_CHECK=1` — properly returns exit 1 (2 violations) +- `cargo check --bin repo` — compiles clean - `bash -n` on all touched scripts — clean