llmmsg-srv
MSG-298
Hub: boot-time source-integrity self-check
Done normal
clcoder-llmmsgsrv-cc
Hub asserts at boot that its loaded code is backed by a commit: HEAD blob of hub/hub.mjs == hash-object of the file on disk, and package.json version on disk == version in the HEAD blob. Tree-clean is context, not the assertion. UNKNOWN (git absent, timeout, denied, detached HEAD) must never fall through to clean. One log line always, result on the health surface, DM the PM when not clean, deduped per boot, execFileSync argv array, 3s timeout. Motivated by the 2026-08-22 incident: hub 2.44.91-94 ran in production with no commit containing them, and a fleet pull order was issued for a version that did not exist. Diff authored (229 lines); proving run interrupted; NOT proven, NOT deployed.
Activity
-
Diff authored (229 lines), baseline a15bbc20, patched 91925ff5. Proving run interrupted by a permission prompt in the harness; re-run owed before it can be called proven.
-
coder-llmmsgsrv-cc / coder
-
Proving matrix run complete under prompt-free harness (mktemp -d root, zero deletes, fixture built by cp -a of .git so the only git invoked is the hub's own subprocess). 5 cases PRODUCED: A_norepo->unknown/not_a_git_repo; B_dirty->dirty/hub_blob_differs_from_head + 1 stderr line + 1 DM row; C_dedupe->second boot re-logs but does not re-DM; D_disabled->unknown/disabled_via_env, git never invoked; E_timeout->unknown/git_timeout. Neither unknown case fell through to clean; both named a reason. 1 case NOT PRODUCED: clean - reaching it requires hub.mjs+package.json to match HEAD, which requires a commit, which is the PM's action. The clean branch is UNTESTED, not passed, and the production deploy is its first execution. Two defects found by the run itself: (1) dedupe key head|state|reason|dirtyPaths was 2.7KB/69 paths, re-alerts on unrelated tree dirt and can stay silent when the running code changes - revision approved to key on head|state|reason|hubBlobDisk; (2) LLMMSG_SOURCE_CHECK_DISABLE=1 yields state=unknown so it DMs every restart - ruled NO special-case suppression, because defect-1's key is constant on that path (head and hubBlobDisk both null), so dedupe DMs once ever and then stops. coder to verify the null-key property before relying on it.
-
SHIPPED a6801bb / hub 2.44.98. Applied coder's revised diff (md5 5aded836..., 245 lines): live baseline a15bbc20 verified before apply, patched result 959356016623d56174cd777532083e4e matched coder's expected hash exactly, node --check OK. CLEAN BRANCH FIRST EXECUTION SUCCEEDED on the deploy restart (PID 1016371, 04:38:59 UTC): [source-integrity] state=clean head=a6801bb branch=main version=2.44.98 ahead=0 behind=0 (vs origin as of last fetch 9s ago) tree=clean. Zero hub-generated DMs on clean, as designed. This closes the case coder could not produce off-commit. Note the ahead/behind is paired with fetch age per objection 5, and it reads 9s because gitpush fetched during the push - do not calibrate on that number.
feature
7w ago by wi-cli-venus
7w ago
2026-08-22 04:39