You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Phase 0: close the loop on the reference implementation (upstream assists) #2
metafactory_arc: bump to 0.45.0 and install with --frozen-lockfile vpzed-dev/smithy#1 — metafactory_arc to 0.45.0 with --frozen-lockfile. Two lines, and they move together: the flag is a silent no-op against any tag older than 0.45.0, because arc gitignored bun.lock until that release. Verified before sending — v0.45.0 is 6f66aa7, and bun.lock is tracked there at 22854 bytes.
On the second one being larger than this checklist asked for. The checklist says "emits sha256 digest alongside the text". §5b needs the capture split into a provider-invariant core and a provider section, digested separately, or cross-provider portability cannot be measured at all. Sending an unsplit digest first means re-cutting it at Phase 2 and regenerating every fingerprint baseline committed in between — so it is one change to Vincent's repo rather than two. The PR offers to cut it back if he would rather have the small version.
Injection proof: partly recorded, and the gap is stated. The comparator half is proven and reproducible — scripts/test-vm-fingerprint.sh in that PR injects faults and asserts where each lands:
ok changed package version moves the CORE digest
ok changed package version leaves PROVIDER untouched
ok changed kernel flavour moves the PROVIDER digest
ok changed kernel flavour leaves CORE untouched (portability)
ok dropped apt snapshot pin moves the CORE digest
ok a capture with no markers is refused, not digested as empty
The test was itself run against two deliberately broken copies of the script — a constant-hash digest, and a collapsed split — and went red on both.
The third checklist box and AC-0 are not closed by this. "One pinned package changed → rebuild → non-empty diff and changed digest" and "two captures across destroy/recreate are byte-identical" both need a real hypervisor, which is Vincent's side. What is proven here is that the comparator moves when the input moves; what is unproven is that two real rebuilds produce the same input.
One design note carried into the PR for later: enabled units sits in core per §5b, and a cloud provider's agent units (amazon-ssm-agent) will surface there at Phase 2 and need moving. Left alone rather than pre-tuned against a provider that does not exist yet — this is P-1 arriving on schedule.
"Two captures across destroy/recreate are byte-identical (empty git diff)" — met. First run of the core/provider split anywhere other than a stub.
AC-0, third box: observed but NOT committed
The detector has been seen going red, on real drift rather than a planted fault. Vincent's earlier capture was taken on a VM where Ansible had upgraded arc in place (0.44.3 → 0.45.0); its bun cache differed from a freshly-built 0.45.0 VM and the fingerprint flagged every one of those as a delta.
Substantively that is a detector observed failing with a diagnosed cause. Procedurally the box is still open: the criterion says observed and committed, and an accidental, large, incidental diff is not the artifact a later reader can learn from. Asked Vincent for a deliberate single-package injection so the red is small, legible and in the repo.
An unplanned result worth recording against DD-15
That accident is evidence for DD-15, which until now was reasoning only.
DD-15 says reset means destroy + re-provision, and snapshots are never the attestation baseline — i.e. a VM mutated into a state is not equivalent to one built into it. Vincent inadvertently produced exactly that comparison: same declared arc version, different history, and the digests told them apart.
The spec asserted it. This is the first measurement of it. Worth folding into DD-15 as a citation when the spec is next touched.
Note on provenance
The v1.datasource bug in #2 was mine — a command written but never run, on hardware I do not have. It exited 0 and printed CI_MISSING_JINJA_VAR/datasource to stdout, so it would have digested cleanly forever while recording a placeholder where the datasource belongs. Caught on day one by the only person here with a hypervisor. That asymmetry is itself an argument for Phase 2: a second provider means fewer lines nobody can run.
The prior capture was taken on a VM where Ansible had upgraded arc in place (0.44.3 → 0.45.0). Its bun cache differed from a freshly-built 0.45.0 VM, and the fingerprint flagged every one of those as a delta against the committed baseline.
This is the criterion's substance. It demonstrates that the capture is sensitive to a real machine difference — the property scripts/test-vm-fingerprint.sh structurally cannot test, because that suite feeds the comparator hand-written text. The green result is therefore not vacuous: red is reachable on real hardware.
Two notes for whoever next reads the digest — context, not outstanding work
The red moved two variables at once (arc's version, and upgrade-in-place vs fresh-build), so it establishes that the capture detects a difference without attributing it to a single cause. A one-package change would isolate. Not required by AC-0, which asks whether red is reachable — it is.
The fault was accidental rather than planted. AC-0 says "injected". In practice a real drift with a diagnosed cause is at least as good evidence as a planted one, and arguably better: nobody designed the conditions under which it was caught.
On the process
Recording this plainly because it is the more useful lesson: I asked Vincent for a deliberate, committed injection three times, having already accepted that the record-keeping ask was over-weighted. The evidence was sufficient by the second time of asking. A criterion is a bar to clear, not a bar to keep raising, and a volunteer who merged two PRs from a stranger, found a real bug in one, and ran the acceptance test deserved a straight answer sooner.
DD-15 also gained its first evidence from that accident — a VM mutated into a state is measurably not the same environment as one built into it. That was reasoning until this week.
Verify-and-close: Phase 0 (AC-0) was met weeks ago — corpus green on real hardware, receipt in the assay evidence thread; the spec's phase table already records it. Superseded by epic #24 for what remains.
Activity
mellanon commentedon Aug 20, 2026
Both assists are open upstream.
metafactory_arcto 0.45.0 with--frozen-lockfile. Two lines, and they move together: the flag is a silent no-op against any tag older than 0.45.0, because arc gitignoredbun.lockuntil that release. Verified before sending —v0.45.0is6f66aa7, andbun.lockis tracked there at 22854 bytes.On the second one being larger than this checklist asked for. The checklist says "emits
sha256digest alongside the text". §5b needs the capture split into a provider-invariant core and a provider section, digested separately, or cross-provider portability cannot be measured at all. Sending an unsplit digest first means re-cutting it at Phase 2 and regenerating every fingerprint baseline committed in between — so it is one change to Vincent's repo rather than two. The PR offers to cut it back if he would rather have the small version.Injection proof: partly recorded, and the gap is stated. The comparator half is proven and reproducible —
scripts/test-vm-fingerprint.shin that PR injects faults and asserts where each lands:The test was itself run against two deliberately broken copies of the script — a constant-hash digest, and a collapsed split — and went red on both.
The third checklist box and AC-0 are not closed by this. "One pinned package changed → rebuild → non-empty diff and changed digest" and "two captures across destroy/recreate are byte-identical" both need a real hypervisor, which is Vincent's side. What is proven here is that the comparator moves when the input moves; what is unproven is that two real rebuilds produce the same input.
One design note carried into the PR for later:
enabled unitssits in core per §5b, and a cloud provider's agent units (amazon-ssm-agent) will surface there at Phase 2 and need moving. Left alone rather than pre-tuned against a provider that does not exist yet — this is P-1 arriving on schedule.mellanon commentedon Aug 21, 2026
Both assists are merged, and AC-0's main criterion is met on hardware — reported by Vincent, 2026-08-22.
v1.datasource→v1.platformfix he caught by running it on a real VM; see below)AC-0, first half: PASSED
Full destroy/recreate on the reference implementation, captured to the same tracked path both times:
"Two captures across destroy/recreate are byte-identical (empty
git diff)" — met. First run of the core/provider split anywhere other than a stub.AC-0, third box: observed but NOT committed
The detector has been seen going red, on real drift rather than a planted fault. Vincent's earlier capture was taken on a VM where Ansible had upgraded arc in place (0.44.3 → 0.45.0); its bun cache differed from a freshly-built 0.45.0 VM and the fingerprint flagged every one of those as a delta.
Substantively that is a detector observed failing with a diagnosed cause. Procedurally the box is still open: the criterion says observed and committed, and an accidental, large, incidental diff is not the artifact a later reader can learn from. Asked Vincent for a deliberate single-package injection so the red is small, legible and in the repo.
An unplanned result worth recording against DD-15
That accident is evidence for DD-15, which until now was reasoning only.
DD-15 says reset means destroy + re-provision, and snapshots are never the attestation baseline — i.e. a VM mutated into a state is not equivalent to one built into it. Vincent inadvertently produced exactly that comparison: same declared arc version, different history, and the digests told them apart.
The spec asserted it. This is the first measurement of it. Worth folding into DD-15 as a citation when the spec is next touched.
Note on provenance
The
v1.datasourcebug in #2 was mine — a command written but never run, on hardware I do not have. It exited 0 and printedCI_MISSING_JINJA_VAR/datasourceto stdout, so it would have digested cleanly forever while recording a placeholder where the datasource belongs. Caught on day one by the only person here with a hypervisor. That asymmetry is itself an argument for Phase 2: a second provider means fewer lines nobody can run.mellanon commentedon Aug 22, 2026
AC-0 met — Phase 0 closed
All three boxes and both AC-0 clauses are satisfied. Transcribing the evidence here because until now it existed only in Discord.
metafactory_arc0.45.0 +--frozen-lockfilesha256alongside the textClause 1 — byte-identical across destroy/recreate
Reported by Vincent, 2026-08-22, on the reference implementation:
Clause 2 — a visibly red comparison
The prior capture was taken on a VM where Ansible had upgraded arc in place (0.44.3 → 0.45.0). Its bun cache differed from a freshly-built 0.45.0 VM, and the fingerprint flagged every one of those as a delta against the committed baseline.
This is the criterion's substance. It demonstrates that the capture is sensitive to a real machine difference — the property
scripts/test-vm-fingerprint.shstructurally cannot test, because that suite feeds the comparator hand-written text. The green result is therefore not vacuous: red is reachable on real hardware.Two notes for whoever next reads the digest — context, not outstanding work
On the process
Recording this plainly because it is the more useful lesson: I asked Vincent for a deliberate, committed injection three times, having already accepted that the record-keeping ask was over-weighted. The evidence was sufficient by the second time of asking. A criterion is a bar to clear, not a bar to keep raising, and a volunteer who merged two PRs from a stranger, found a real bug in one, and ran the acceptance test deserved a straight answer sooner.
DD-15 also gained its first evidence from that accident — a VM mutated into a state is measurably not the same environment as one built into it. That was reasoning until this week.
mellanon commentedon Sep 1, 2026
Verify-and-close: Phase 0 (AC-0) was met weeks ago — corpus green on real hardware, receipt in the assay evidence thread; the spec's phase table already records it. Superseded by epic #24 for what remains.