_canonical_issue() strips FK/FK#/FA/FB/FLAG/FIX prefixes and normalizes separators so
duplicate representations of one root cause collapse (e.g. FK1-SELINUX_RESTORECON +
SELINUX-RESTORECON -> selinux_restorecon; FK3-WAL_CHECKPOINT +
CONCURRENT-STORE-CHECKPOINT -> checkpoint_before_exit via an alias map). Per issue only
the most-detailed note is reported. mark_covered now covers ALL uncovered finding coords
(including deduped-away duplicates) so nothing re-reports. Corresponding notes re-tagged:
issue logs -> finding, status notes -> impl (no uncategorized notes remain).
Adds the headless, cron-driven note reviewer that uses the cubesys::notes
message-save-path as its memory: it reads only uncovered findings from CUBE, gets
the model to rank them, composes a grounded (verbatim) prioritized report, marks
them covered with a checkpoint note, and writes a review .txt. Documents how the
MCP cube-notes-mcp surface is wired into the harness bundle layer (inject:[tools])
and how prior run data saved in CUBE (action trace + finding/checkpoint notes) is
replayed and traced — surfacing 7 previously un-tagged logs (GIT-SHALLOW-CLONE,
POSTFIX-TLS-CERTS, SELINUX-RESTORECON, DSH-WEB-EADDRINUSE,
CONCURRENT-STORE-CHECKPOINT, MCP-BUNDLE-LAYER, CUBES-TWO-TREES).
Two harness drivers (model A per-command auth, model B persistent auth-once)
run across the real release cube-server to settle the "auth-each-time had ~0%
errors" memory. Conclusion: error rate is driven by the slow `audit` op /
3s socket cap, NOT the auth model — with audit removed, model A hits 94.81%
and model B 100%. Adds docs/stress-comparison-20260811.md §5 and the two
reusable harness scripts under tools/.
cubec forwarded its OWN leading options (--socket/--tenant/...) verbatim
into the command payload sent to the daemon, so 'cubec --socket SOCK
"prog ..."' made the server reject '--socket' as an unknown command.
stress.sh therefore produced 'error: unknown command: --socket' on every
sample and measured nothing.
Split cubec arg parsing into client-option vs command-payload so flags are
consumed locally and only the command reaches the daemon. The canonical
'./check stress' stage now drives a real daemon and samples stats.
Adopted recommendation (B): make owner authority a hard guarantee instead
of the non-breaking opt-in. A mutating op now requires a stamped HELLO
identity; anonymous writes are rejected. seal/open (destructive writes)
are gated the same way, and seal stamps the owner onto the encrypted record.
Design / non-breaking bridge:
- Session gains enforce_owner: bool (default false) so library/REPL/unit
tests stay permissive — the 26 prior tests + 3 Task-6 tests are unchanged.
- owner_violation() gains require_identity: the (false) path keeps legacy
behaviour; the (true) path rejects no-identity mutating ops.
- The daemon flips enforce_owner=true on every connection (both HELLO and
no-HELLO branches), implementing the default --require-identity policy.
- Added --allow-anonymous escape hatch so legacy cubec/stress.sh (which
send no HELLO) keep working; stress.sh now passes --allow-anonymous.
- Session::set_enforce_owner() accessor so the daemon (separate bin) can
set the private field.
Verification:
- ./check quick: EXIT=0, fmt+clippy clean, 28 cubesys lib tests (added
enforce_owner_requires_identity, seal_open_respect_owner).
- Ad-hoc daemon verifier (LE framing) against the rebuilt cube-server:
anonymous prog/del rejected, HELLO'd owner first-claim + self-overwrite
allowed, cross-owner overwrite rejected. ALL PASS.
Note: seal's demo key-cell crypto path (KeyCellMissing on the synthetic key
material) is a pre-existing quirk unrelated to this change; the gate fires
before crypto, so the test verifies the gate, not the crypto.
- ./check stress spins a fresh cube-server+cubec built from this tree on a
throwaway socket/store and drives ~150s of real prog/run traffic while
sampling the per-command latency + per-C telemetry.
- tools/stress.sh: never touches the production daemon; STRESS_SECONDS override.
- Fixed latent control-flow bug: the old '|| exit 0' guards made 'bench' and
'mount' subcommands unreachable after the gate (they exited early). Now uses
explicit run_* flags and only exits at the true end.
User clarified: the earlier prune was a ONE-TIME cleanup of an over-backfill
bug, NOT a recurring retention cap. Saved history must persist. Removed
cmd_prune / --prune-older-than-hours entirely; the script now only captures
forward (default) or seeds a bounded window once. No code path deletes cube
entries. Verified: help has no prune arg, forward/seed dry-runs change no
state, live timer runs forward-only.
Captures user/assistant messages from /root/.hermes/state.db into the
'hermes' cube namespace as TYPE: HIST-QNA entries. Forward-only by default
(no backfill); --seed-hours N for bounded one-time population; idempotent;
--prune-older-than-hours to undo over-backfill. systemd timer runs every
5 min. Tested: 24h seed = 1171 msgs; prune cleared a 3164-entry backfill
to 44, then re-seeded correctly.
CUBELinux-2