MI activation changes durable state before TLS startup succeeds #245

New issue

Closed

opened 2026-11-01 18:34:16 +00:00 by kilo · 2 comments

kilo commented

2026-11-01 18:34:16 +00:00

Member

Observed

During isolated Foundry target-host testing of canonical SR f96d58e6d7d0fffdbe70476850d824efa5de2fb5 with its pinned MI d65891668b7e79f7b666c021f02a1b4bf8c4ca9c, a network-isolated container started control_server with a valid synthetic --mi-config, a fresh disposable data store, and invalid TLS certificate/key material. Before startup, ServerStore.current_mi_cut_digest was null. The process exited 2 with TLS configuration failed: [SSL] PEM lib; afterward the store contained the MI cut digest. Independently hashing the canonical wrapped record matched the stored digest. Temporary test state was discarded.

Source inspection indicates control_server activates the MI configuration against the durable store before creating the TLS context and binding the listener. Consequently an installation can report failed startup while its previous durable MI state has changed. This is not a claim of exploitation or of automatic recovery failure for every error.

Requested investigation

Define and test startup failure semantics for MI activation, including existing accepted state, invalid TLS, listener bind failure and restart/retry. If activation is meant to commit only after successful listener startup, preserve the prior cut on failure and cover interruption/concurrency. Keep the consumer and durable-store contract SR-owned. Foundry integration is tracked at Creatidy/foundry#1.

## Observed During isolated Foundry target-host testing of canonical SR `f96d58e6d7d0fffdbe70476850d824efa5de2fb5` with its pinned MI `d65891668b7e79f7b666c021f02a1b4bf8c4ca9c`, a network-isolated container started `control_server` with a valid synthetic `--mi-config`, a fresh disposable data store, and invalid TLS certificate/key material. Before startup, `ServerStore.current_mi_cut_digest` was null. The process exited 2 with `TLS configuration failed: [SSL] PEM lib`; afterward the store contained the MI cut digest. Independently hashing the canonical wrapped record matched the stored digest. Temporary test state was discarded. Source inspection indicates `control_server` activates the MI configuration against the durable store before creating the TLS context and binding the listener. Consequently an installation can report failed startup while its previous durable MI state has changed. This is not a claim of exploitation or of automatic recovery failure for every error. ## Requested investigation Define and test startup failure semantics for MI activation, including existing accepted state, invalid TLS, listener bind failure and restart/retry. If activation is meant to commit only after successful listener startup, preserve the prior cut on failure and cover interruption/concurrency. Keep the consumer and durable-store contract SR-owned. Foundry integration is tracked at https://forgejo.creatidy.com/Creatidy/foundry/issues/1.

kilo referenced this issue from Creatidy/foundry

2026-11-01 18:36:23 +00:00

Establish first secure SR–MI installed integration #1

kilo referenced this issue from Creatidy/foundry

2026-11-01 18:44:45 +00:00

Add opt-in installed SR–MI integration #8

kilo referenced this issue from Creatidy/foundry

2026-11-01 19:21:45 +00:00

Add opt-in installed SR–MI integration #8

kilo referenced this issue from Creatidy/foundry

2026-11-01 19:22:29 +00:00

Establish first secure SR–MI installed integration #1

kilo added the

label

2026-11-02 21:09:25 +00:00

adrian.tkacz referenced this issue from a commit

2026-11-02 21:33:27 +00:00

Preserve MI cut on startup failures (#245)

kilo referenced this issue

2026-11-02 21:33:31 +00:00

Preserve MI cut on server startup failures (#245) #251

kilo commented

2026-11-02 21:33:35 +00:00

Author

Member

Implementation is open as PR #251 at 23f4e7e0716e663a7366397060577df89339dd93, based on 481844accb57f5bc092ba9534746c4641e31fc5f. Focused startup tests and the full offline gate passed (3264 tests, 18 skipped; basedpyright clean). Independent review and Forgejo CI remain pending.

Implementation is open as PR #251 at `23f4e7e0716e663a7366397060577df89339dd93`, based on `481844accb57f5bc092ba9534746c4641e31fc5f`. Focused startup tests and the full offline gate passed (3264 tests, 18 skipped; basedpyright clean). Independent review and Forgejo CI remain pending.

adrian.tkacz referenced this issue from a commit

2026-11-02 21:55:16 +00:00

Cover concurrent MI startup activation (#245)

kilo referenced this issue from a commit

2026-11-02 23:12:05 +00:00

Merge pull request 'Preserve MI cut on server startup failures (#245)' (#251) from issue-245-mi-startup into develop

kilo commented

2026-11-02 23:12:15 +00:00

Author

Member

Integrated PR #251 into develop at merge commit 7985cbadd31e6b594cb3a7b5fc27a06f6e03f33e. Its parents are reviewed base 481844accb57f5bc092ba9534746c4641e31fc5f and reviewed HEAD 0aef3514cb74a8c834674f94f9a3d7ca1abad90a; the integrated tree matches the reviewed HEAD. Review #2 APPROVE with no findings; Forgejo CI #3499 passed. Full local validation: 3266 tests, 18 skipped, basedpyright clean. Startup commit is after required listener binding; a crash after commit but before serving can retain the new cut, as documented. No live deployment or external inference performed.

Integrated PR #251 into develop at merge commit `7985cbadd31e6b594cb3a7b5fc27a06f6e03f33e`. Its parents are reviewed base `481844accb57f5bc092ba9534746c4641e31fc5f` and reviewed HEAD `0aef3514cb74a8c834674f94f9a3d7ca1abad90a`; the integrated tree matches the reviewed HEAD. Review #2 APPROVE with no findings; Forgejo CI #3499 passed. Full local validation: 3266 tests, 18 skipped, basedpyright clean. Startup commit is after required listener binding; a crash after commit but before serving can retain the new cut, as documented. No live deployment or external inference performed.

kilo closed this issue

2026-11-02 23:12:19 +00:00