Repository navigation
test(nix): no-write-encoders check, goip_write docs (FP-8c) - #299
Merged
randomizedcoder merged 6 commits intoNov 14, 2026
Merged
Conversation
checks.no-write-encoders proves goip_write stays out of xtcp2 and go-link-monitor, each proof with a positive control: - files: go list -deps with each binary's own tags names no write file of internal/goip, pkg/xtcpnl or pkg/nlparity; with goip_write it does. - symbols: go tool nm on xtcp2-debug and go-link-monitor finds no write builder, Encode*InfoData or goip write arm; goip has BuildWriteRequest. - no_exec: no package in either daemon's deps imports os/exec, bar minio-go's credentials provider (s3parquet), which is listed. A manual negative run (BuildWriteRequest untagged and referenced from goip.Show) fails both the files and the symbols proofs for both daemons. Co-Authored-By: Claude Opus 5.5 <[email protected]>
- docs/build-flavors.md: a "goip write verbs" section (who carries the tag, what /ip does without it, the check, how to test the write path) and a row in the build-tag table. - docs/netlink/README.md: the parity harness notes the write path is goip/goip-parity only. - cmd/goip: the package comment said goip was read-only; it now says writes are dry runs behind goip_write. - CHANGELOG Breaking: /ip and the daemons carry no netlink write verbs. Co-Authored-By: Claude Opus 5.5 <[email protected]>
randomizedcoder
added a commit
that referenced
this pull request
Nov 12, 2026
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A `treatment` build embeds internal/goip/actuate, which encodes routes and
rules. It may compile xtcpnl_{route,rule}_write.go and xtcpnl_write_request.go
and link BuildWriteRequest/BuildRouteWriteRequest/BuildRuleWriteRequest;
everything else of the write set still fails. The exemption list must all be
present under the tag, or it is stale.
- Adds xtcp2-min (no treatment tag, stripped) to the files and no_exec proofs.
- go-link-monitor (untagged) stays fully strict.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #298 (FP-8b), which is on #297 (FP-8a).
checks.no-write-encodersproves the daemons carry no netlink write path. Each proof has a positive control:go list -depsof xtcp2 and go-link-monitor, using each binary's own build tags, names no write file ofinternal/goip,pkg/xtcpnlorpkg/nlparity. Withgoip_writeadded, it does.go tool nmonxtcp2-debugand go-link-monitor finds noBuild*WriteRequest,BuildSetNsidRequest,Encode*InfoDataor goip write arm. Taggedgoipdoes haveBuildWriteRequest.os/exec. One exception is listed: minio-go's credentials provider in the s3parquet destination. xtcp2 only constructsNewStaticV4, so that provider is never reached.BuildWriteRequestand referenced it fromgoip.Show. Both daemons failed both the files proof and the symbols proof.docs/build-flavors.mdgets a "goip write verbs" section and a build-tag table row.docs/netlink/README.mdnotes the write path builds only into goip and goip-parity.cmd/goippackage comment no longer says goip is read-only./ipand the daemons carry no netlink write verbs./ipreturning 400 for/i/l/s(and/ip/link/set) untagged is already covered by the goiphttp tests.no-write-encoders,nix-fmt,deadnix,statix.nix flake checkon this tip: six reds, all also red on main (built at 9949ee6), none from FP-8:capability-check-no-caps/-names-sys-admin(since FP-3 a missing listener token exits 64 before the capability check),nlcap-batch/nlcap-ws/nlcap-ws-check(flake8 E501),vm-check-runner(t-env row). Recorded as TODOs in the docs: security-hardening program — ConfigService.Set advisory and phased hardening plan #291 plan doc.🤖 Generated with Claude Code