Summary
Two v5-only gaps surfaced while closing flaky-test issues today. Both are fixes that landed on v4 and never reached v5.
1. waitContribDisconnect is missing on v5, so the #6165 / #6285 TempDir race is still live there
The TestLeaseRestart_ResumeSurvivesHubRestart flake (disconnect defer writing ws-state/failed-tasks.json after the test body returns, racing t.TempDir removal) was fixed on v4 by #6158's second commit e1e5125, which added waitContribDisconnect to block on the defer's last observable act. git grep waitContribDisconnect origin/v5 returns nothing. All three failure observations on #6285 were v5 runs. The last v4-into-v5 sync (#6053 / #6060) predates #6158.
Action: cherry-pick e1e5125 onto v5, or include it in the next v4-to-v5 sync. #6285 was closed as a duplicate of #6165 with this caveat noted.
2. Token-access audit: an agent can delete its own not-yet-ingested event
#6303 makes the audit log hive-owned 0600 with agents dropping events into a 3730 sticky spool that the hive ingests every 2s. That closes the tamper-existing-records hole. The residual: within the 2s window an agent can still unlink its OWN event file before ingest (sticky bit only prevents deleting a peer's), and can flood the spool with real calls. The agent cannot alter anything already recorded.
Closing this fully means a channel the agent cannot retract from - an SO_PEERCRED Unix socket to the hive, or making the spool append-only at the filesystem level. Not urgent; the important property (immutability of recorded history) is in.
Refs #6285, #6165, #6158, #6287, #6303.
Summary
Two v5-only gaps surfaced while closing flaky-test issues today. Both are fixes that landed on v4 and never reached v5.
1.
waitContribDisconnectis missing on v5, so the #6165 / #6285 TempDir race is still live thereThe
TestLeaseRestart_ResumeSurvivesHubRestartflake (disconnect defer writingws-state/failed-tasks.jsonafter the test body returns, racingt.TempDirremoval) was fixed on v4 by #6158's second commit e1e5125, which addedwaitContribDisconnectto block on the defer's last observable act.git grep waitContribDisconnect origin/v5returns nothing. All three failure observations on #6285 were v5 runs. The last v4-into-v5 sync (#6053 / #6060) predates #6158.Action: cherry-pick e1e5125 onto v5, or include it in the next v4-to-v5 sync. #6285 was closed as a duplicate of #6165 with this caveat noted.
2. Token-access audit: an agent can delete its own not-yet-ingested event
#6303 makes the audit log hive-owned 0600 with agents dropping events into a 3730 sticky spool that the hive ingests every 2s. That closes the tamper-existing-records hole. The residual: within the 2s window an agent can still unlink its OWN event file before ingest (sticky bit only prevents deleting a peer's), and can flood the spool with real calls. The agent cannot alter anything already recorded.
Closing this fully means a channel the agent cannot retract from - an SO_PEERCRED Unix socket to the hive, or making the spool append-only at the filesystem level. Not urgent; the important property (immutability of recorded history) is in.
Refs #6285, #6165, #6158, #6287, #6303.