Pull request #58 · stacks/drone

Summary

Extend #42 qualification with a real full Linux filesystem. The public coordinator accepts signed root/role metadata, then copies an authenticated host image onto a bounded private tmpfs. The campaign requires actual ENOSPC, a partial image and SQLite failure-state persistence refusal, while retaining the previous known-good image and security floors.

confirmed release 7 -> prepared release 9 -> accept root 2 / targets 3
  -> real full filesystem -> interrupted selection, no new health
  -> fresh metadata recovery -> exact-slot abandonment
  -> unrestricted new trial -> fresh observed boot/session confirmation

The fixture verifies private namespace/propagation and actual tmpfs capacity. It archives and hashes the full volume before freeing the filler, retains later state/process snapshots, and unmounts its own filesystem. CI keeps the synthetic artifacts for seven days. Builds on #57; no production or dependency changes.

Evidence

Before: the new qualification module was absent and the new test failed at import. This is fixture absence, not a production defect.
Local: native Buddy Pickier, application/runtime/test types, docs, roadmap and parity pass. The existing actual partial-write campaign still passes on minimum Bun 1.4.2 after sharing its bounded error-code reader. The new opt-in Linux case skips locally and supplies no local positive ENOSPC evidence.
Rendered docs: 89 pages, 6,487 local links and 89 assets with no missing targets after the final docs correction.
Separate root Spec and Standards review passes within the proposed scope; independent final review was unavailable. The first Linux execution at 6386c6ea133b63d992c4ff609cd33328e08b0e64 passed. Artifact readback verified actual ENOSPC, two SQLITE_FULL errors, a 1 MiB authenticated prefix, retained metadata/floors/previous image, explicit recovery/abandonment and new clean boot/session health. All 62 retained volume-file hashes and the public states matched. The first private archive checker assumed errno order; that checker was corrected to required presence/count without changing product tests.
Artifact inspection found a stats/manifest filename collision; child output still retained the actual stats. Corrected head 7b120baf4a40e904710aa804bbc54f4cc64f64ea retains distinct files and derives the reported free space from readback. The actual Linux case in corrected-head CI 39731192997 passed. Separate artifact readback verified the distinct zero-free-space stats and all 62 retained file hashes (419,703-byte ZIP, SHA-256 20a9a7ed4b79fadff70d546b5c0994ff10e79bb72dcc19dd9dd0d5962c0811d1). All five jobs are still required before main; the original workflow remains separately running.

Merge Danger

Door: two-way. Test, fixture, CI and docs changes only.

Blast Radius: qualification. Privileged execution is confined to the explicit CI mount namespace and an owned 16 MiB tmpfs. Physical media, electrical power loss, EDQUOT, EIO and sync-failure qualification remain open. #42 remains open and physical deployment stays disabled.

All five jobs passed on corrected exact head 7b120baf4a40e904710aa804bbc54f4cc64f64ea in CI 39731192997. The original parent workflow 39730608429 also passed and is retained separately. Corrected terminal log collected once: 3027959 bytes, SHA-256 e19fc1f0f23e8ebbfcfd6e62557fcfe016d11ece410c8d3aa59d60428cce34a5. Nine reviewed source pins match committed blobs. Publication is a normal fast-forward as Chris without coauthor trailers; broad issue #42 acceptance remains open.