fix(spec-007): close AG/SW listener and profile gaps (4.10b) by IanFrelinger · Pull Request #738 · IanFrelinger/Ashlar

IanFrelinger · 2026-10-09T20:44:50Z

Summary

SPEC-007 PR 4.10b: close live AG/SW inbound gaps and related hygiene. Supersedes draft #725 (codex/spec-007-410b) with master R1 (de03fa7c) merged in and the kernel-coverage TimeoutConvention fix.

Changes

Collect ASPNETCORE_HTTP_PORTS / HTTPS_PORTS as wildcard candidates when urls unset; post-bind LoopbackListenerVerifier
Bare/bracketed/::ffff: IPv6 loopback accepted for inbound/mesh bind
Multi-frame vision refuses a cloud resolve on AirGapped
PostConfigure reasserts the strictest AddAshlar profile snapshot
SW MCP HTTP detection beyond the Ashlar wrapper marker; profile-read + MCP caller conventions
Mesh-serve loopback twins; hygiene/ProdStyle facts; mutation evidence scripts
Records: SPEC-007 4.10b bullet, EgressInventory Known limits (post-bind window, G15), CHANGELOG, DEPLOYMENT, cert-gate rows
Fix: [Theory(Timeout = TestTimeouts.HostTouching)] on A_restricted_server_without_published_addresses_fails_closed

Testing

Inherited from fix(spec-007): close AG/SW listener and profile gaps (4.10b) #725 tip cf756ff23 (five required checks green; kernel-coverage failed on the Timeout convention — fixed here)
Mutation evidence and runner scripts from the Codex tip; re-verify on CI after this tip
Merge commit resolves R1×4.10b records conflicts in favour of the implemented 4.10b wording

Testing strategy (blast radius)

Change type	Minimum proof
Hosting / API / `AddAshlar` / inbound	ProdStyle + cert-gate hygiene twins
Infrastructure adapters	Focused certification + mutation batch

Checklist

Documentation updated
Breaking changes documented (Known limits: post-bind window; G15 Full-before-AG)

Records touched

SPEC-007, EgressInventory, CHANGELOG, Configuration, Federation, DEPLOYMENT, cert-gate-assertions, knowledge-graph, PublicAPI as in #725

Release

Not a versioned release — skip

Supersedes #725.

Master stated the owner's 2026-10-06 reverse (open-read → SystemHigh) as still reversible, omitted dated decisions-log rows, promised bare ::1, and claimed stacking makes CI a fast-forward. Align SPEC-007, inventory, CHANGELOG, process docs and the readiness-push gate with what master actually ships; code follow-ups stay in 4.10b/4.3b/4.5b. Co-authored-by: IanFrelinger <IanFrelinger@users.noreply.github.com>

Reject a missing push filter even when a later pull_request event has the expected branch list. Co-authored-by: Codex <noreply@openai.com>

…ecks

…ntions

Co-authored-by: Codex <noreply@openai.com>

Replace the branch-only text-summary runner with the shared TRX validator and recoverable evidence archive. Add mapped-address and mapped-socket regressions to the 21-case hygiene manifest. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

The devcontainer base ships python3-minimal: the real mutation-runner smoke failed before tests with missing json. Install the full Python package and verify the required stdlib imports at image build. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

Keep the local port helper referenced so missing port configuration produces assertions rather than CS8321. Match the actual API-host wiring assertion. Add mapped 127.0.0.2 facts because the runtimes already special-case mapped 127.0.0.1. Co-authored-by: Codex <noreply@openai.com>

Require the directly affected assertion for pre-bind and port expansion mutants; retain the selected API tests that independently refuse the configuration after binding. Co-authored-by: Codex <noreply@openai.com>

Bring de03fa7 onto the hygiene tip. Resolve records conflicts in favour of 4.10b (implements the R1 Known limits). Add HostTouching Timeout on A_restricted_server_without_published_addresses_fails_closed so the kernel-coverage TimeoutConventionTests pass. Co-authored-by: IanFrelinger <IanFrelinger@users.noreply.github.com>

cursor · 2026-10-09T20:47:13Z

Handoff (for drift audit): SPEC-007 PR 4.10b. Touches inbound listener policy, LoopbackListenerVerifier, AdaptiveProviderFactory multi-frame, MCP validation, mesh-serve twins, DeploymentProfileReadConventionTests, SPEC-007 / EgressInventory / CHANGELOG / DEPLOYMENT / cert-gate-assertions. Merge when five required checks are green on tip. Series order: this → #739 (4.3b) → #740 (4.5b).

cursor · 2026-10-09T21:41:42Z

Merged squash as bceb1ba2114877148b87b97bcb0c2ca1f181910e. Five required checks were green on eda3f6fb. Advisory reds (layer-boundary verify on application/ paths, UAT k8s-manifests-parse, Compose ephemeral) did not block. Next: #739 → #740.

* docs(spec-007-pr4): fix DESIGN-4-final.md multi-frame AG refuse (card-763) Align §2.7 near :605 with master: AirGapped refuses a cloud multi-frame resolve before frames reach the inner factory (PR 4.10b / #738). Scenario B already records SystemHighData. C12 adaptation left unrecorded pending owner answer to REVIEW §10 new (d). Co-authored-by: icfrelinger <icfrelinger@gmail.com> * docs(spec-007-pr4): record owner-accepted C12 adaptation in DESIGN §5 Owner accept 2026-10-15 of REVIEW §10 new (d): C12 now states the runner ends an ordinary tool exception with error and the test checks the next send in the same frame. Completes card #763 with the prior :605 multi-frame fix. Co-authored-by: icfrelinger <icfrelinger@gmail.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>

cursoragent and others added 26 commits October 8, 2026 12:22

fix(ci): constrain readiness branch extraction to on.push

ef5920b

Reject a missing push filter even when a later pull_request event has the expected branch list. Co-authored-by: Codex <noreply@openai.com>

test(spec-007): pin 4.10b listener and profile hardening

a3e19cb

test(spec-007): bound mesh refusal probe

466703e

test(spec-007): reject non-HTTP listener schemes

81ff73a

fix(spec-007): close AG/SW listener and profile bypasses

7f0b492

test(spec-007): disambiguate convention assertion overload

654d442

test(spec-007): cover API wiring and local multi-frame control

50c2281

test(spec-007): add reproducible 4.10b mutation batch

98e016f

fix(spec-007): preserve MCP validator constructor compatibility

6beaadb

docs(spec-007): record 4.10b behavior and residual limits

2689d5c

docs(spec-007): document deployment settings and new certification ch…

a7b290b

…ecks

fix(spec-007): fail closed on unverifiable binds and strengthen conve…

6963bc7

…ntions

fix(spec-007): normalize mapped mesh binds to IPv4 sockets

59aae11

test(spec-007): separate baseline and selected mutation runs

7b983c2

test(spec-007): obtain legacy transport marker through DI

95976c9

docs(spec-007): reconcile R1 limits resolved by 4.10b

f904dae

Co-authored-by: Codex <noreply@openai.com>

docs(spec-007): refresh integrated certification file count

958f929

Co-authored-by: Codex <noreply@openai.com>

test(spec-007): retain mutation evidence validator fixtures

490b695

Co-authored-by: Codex <noreply@openai.com>

docs(spec-007): reconcile operator and MCP guidance after R1

80cc903

Co-authored-by: Codex <noreply@openai.com>

test(spec-007): accept matched xUnit failure diagnostics in TRX

23d1197

Co-authored-by: Codex <noreply@openai.com>

test(spec-007): distinguish overlapping listener mutation controls

cf756ff

Require the directly affected assertion for pre-bind and port expansion mutants; retain the selected API tests that independently refuse the configuration after binding. Co-authored-by: Codex <noreply@openai.com>

IanFrelinger mentioned this pull request Oct 9, 2026

fix(egress): never follow redirects into Host (4.3b) #739

Merged

3 tasks done

cursor Bot mentioned this pull request Oct 9, 2026

fix(security): pin open reads and harden subject producers (4.5b) #726

Closed

3 of 5 tasks

IanFrelinger mentioned this pull request Oct 9, 2026

fix(security): pin open reads and harden subject producers (4.5b) #740

Merged

3 tasks done

cursor Bot merged commit bceb1ba into master Oct 9, 2026
68 of 71 checks passed

cursor Bot deleted the cursor/spec-007-410b-d476 branch October 9, 2026 21:38

Navigation Menu

Repository navigation

fix(spec-007): close AG/SW listener and profile gaps (4.10b) - #738

fix(spec-007): close AG/SW listener and profile gaps (4.10b)#738
cursor[bot] merged 26 commits into
masterfrom
cursor/spec-007-410b-d476

IanFrelinger commented Oct 9, 2026

Uh oh!

cursor Bot commented Oct 9, 2026

Uh oh!

Uh oh!

cursor Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

IanFrelinger commented Oct 9, 2026

Summary

Changes

Testing

Testing strategy (blast radius)

Checklist

Records touched

Release

Uh oh!

cursor Bot commented Oct 9, 2026

Uh oh!

Uh oh!

cursor Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants