FEATURE-ci-darwin-test-contracts: honor native fixture and peer setup contracts

Check returned continuation behavior with a retained coroutine, exercise five actual QPACK allocations and blocked-request nonpublication, and derive the shared output fixture budget from real retained capacity. Prepare only the selected Darwin archive proof's missing loopback alias and clean up owned state on success, failures and signals.

Focused GNU and actual libc++20 Linux runs each pass 47 cases / 2901 checks. Full-check Clang ASan/UBSan lifetime run passes 1816 checks outside sandbox ptrace. Workflow suite (28 tests), changed C++ cpplint, actionlint, Python/shell syntax and diff checks pass. Native post-fix platform checks remain CI/v3 PR owned; caller validation/finalization pending.

Author: etr

.github/workflows/v3-release-acceptance.yml

@@ -118,6 +118,43 @@ jobs:
         "$RUNNER_TEMP/clients/bin/python" -m pip install -r test/integ/http2-client-requirements.txt
     - name: Complete native and installed TLS off/on proof
       run: |
+        peer_alias_owned=false
+        cleanup_peer_alias() {
+          status=$?
+          trap - EXIT HUP INT TERM
+          if "$peer_alias_owned"; then
+            if ! sudo ifconfig lo0 inet 127.0.0.2 -alias; then
+              echo 'peer-policy: failed to remove owned lo0 alias 127.0.0.2' >&2
+              if [ "$status" -eq 0 ]; then status=1; fi
+            fi
+          fi
+          exit "$status"
+        }
+        trap cleanup_peer_alias EXIT
+        trap 'exit 129' HUP
+        trap 'exit 130' INT
+        trap 'exit 143' TERM
+        if ! loopback=$(ifconfig lo0 inet); then
+          echo 'peer-policy: failed to query lo0 IPv4 addresses' >&2
+          exit 1
+        fi
+        if ! awk '$1 == "inet" && $2 == "127.0.0.2" { found=1 } END { exit !found }' <<< "$loopback"; then
+          if ! sudo ifconfig lo0 inet 127.0.0.2 netmask 255.255.255.255 alias; then
+            echo 'peer-policy: failed to create lo0 alias 127.0.0.2' >&2
+            exit 1
+          fi
+          peer_alias_owned=true
+        fi
+        if ! python3 - <<'PY'
+        import socket
+        for address in ('127.0.0.1', '127.0.0.2'):
+            with socket.socket() as peer:
+                peer.bind((address, 0))
+        PY
+        then
+          echo 'peer-policy: both loopback source addresses must bind before proof' >&2
+          exit 1
+        fi
         prefix=()
         if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then
           prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD")

scripts/test-v3-ci-workflows.py

@@ -530,5 +530,149 @@ def test_all_modified_workflows_pin_actions(self):
                     self.assertRegex(use, r'@[0-9a-f]{40}$')
 
 
+@unittest.skipIf(os.name == 'nt', 'Darwin proof uses a POSIX shell')
+class DarwinPeerAliasLifecycle(unittest.TestCase):
+    def execute(self, *, preexisting=False, failure='', signal_name=''):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            tools = root / 'tools'
+            tools.mkdir()
+            (root / 'scripts').mkdir()
+            state = root / 'alias'
+            if preexisting:
+                state.touch()
+            capture = root / 'calls.jsonl'
+            boundary = '''import json, os, pathlib, sys
+sys.excepthook = sys.__excepthook__
+def record(value):
+    with open(os.environ['CAPTURE'], 'a') as stream:
+        stream.write(json.dumps(value) + '\\n')
+state = pathlib.Path(os.environ['ALIAS_STATE'])
+failure = os.environ['FAILURE']
+'''
+            scripts = {
+                'ifconfig': boundary + '''
+args = sys.argv[1:]
+record(['ifconfig'] + args)
+if args == ['lo0', 'inet']:
+    if failure == 'query': sys.exit(43)
+    print('lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST>')
+    print('    inet 127.0.0.1 netmask 0xff000000')
+    print('    inet 127.0.0.20 netmask 0xffffffff')
+    if state.exists(): print('    inet 127.0.0.2 netmask 0xffffffff')
+elif args == ['lo0', 'inet', '127.0.0.2', 'netmask', '255.255.255.255', 'alias']:
+    assert not state.exists(), 'preexisting alias must be preserved'
+    if failure == 'create': sys.exit(47)
+    state.touch()
+elif args == ['lo0', 'inet', '127.0.0.2', '-alias']:
+    assert state.exists(), 'cleanup needs an owned alias'
+    if 'cleanup' in failure: sys.exit(53)
+    state.unlink()
+else:
+    raise AssertionError(args)
+''',
+                'sudo': 'import os, sys\nos.execvp(sys.argv[1], sys.argv[1:])\n',
+                'brew': "print('/fixture/homebrew')\n",
+            }
+            for name, code in scripts.items():
+                tool = tools / name
+                tool.write_text('#!' + sys.executable + '\n' + code)
+                tool.chmod(0o755)
+            (tools / 'python3').symlink_to(sys.executable)
+            # Execute the workflow's actual preflight Python, replacing only
+            # the OS socket boundary so Linux cannot mask Darwin's bind refusal.
+            (root / 'socket.py').write_text(boundary + '''
+class socket:
+    def __enter__(self): return self
+    def __exit__(self, *args): self.close()
+    def close(self): pass
+    def bind(self, address):
+        record(['bind', *address])
+        if address[0] == '127.0.0.2' and (not state.exists() or failure == 'preflight'):
+            raise OSError(49, 'Cannot assign requested address')
+''')
+            (root / 'scripts/run-v3-release-ci.py').write_text(boundary + '''
+import signal
+record(['proof'] + sys.argv[1:])
+assert state.exists(), 'proof requires the second peer source address'
+if os.environ['SIGNAL_NAME']:
+    os.kill(os.getppid(), getattr(signal, os.environ['SIGNAL_NAME']))
+if 'proof' in failure: sys.exit(61)
+''')
+            lane = workflow('v3-release-acceptance.yml')
+            job = lane['jobs']['darwin']
+            step = next(step for step in job['steps']
+                        if step.get('name') == 'Complete native and installed TLS off/on proof')
+            env = dict(os.environ, PATH=str(tools) + os.pathsep + os.environ['PATH'],
+                       PYTHONPATH=str(root), CAPTURE=str(capture), ALIAS_STATE=str(state),
+                       FAILURE=failure, SIGNAL_NAME=signal_name, RUNNER_TEMP=str(root),
+                       V3_CXX='/selected/clang++', V3_CC='/selected/clang', V3_PACKAGE_TOOLCHAIN='/selected')
+            result = subprocess.run(workflow_shell(lane, job, step) + [step['run']], cwd=root,
+                                    env=env, capture_output=True, text=True, timeout=10)
+            calls = [json.loads(line) for line in capture.read_text().splitlines()] if capture.exists() else []
+            return result, calls, state.exists()
+
+    def assert_preflight(self, calls):
+        proof = next(i for i, call in enumerate(calls) if call[0] == 'proof')
+        for address in ('127.0.0.1', '127.0.0.2'):
+            self.assertIn(['bind', address, 0], calls[:proof])
+
+    def test_owned_alias_surrounds_proof_and_both_actual_bind_preflights(self):
+        result, calls, remains = self.execute()
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assert_preflight(calls)
+        self.assertEqual(calls[0], ['ifconfig', 'lo0', 'inet'])
+        self.assertEqual(calls[-1], ['ifconfig', 'lo0', 'inet', '127.0.0.2', '-alias'])
+        self.assertFalse(remains)
+        proof = next(call for call in calls if call[0] == 'proof')
+        self.assertIn('/selected/clang++', proof)
+
+    def test_preexisting_alias_survives_success_and_proof_failure(self):
+        for failure, status in (('', 0), ('proof', 61)):
+            with self.subTest(failure=failure):
+                result, calls, remains = self.execute(preexisting=True, failure=failure)
+                self.assertEqual(result.returncode, status, result.stdout + result.stderr)
+                self.assert_preflight(calls)
+                self.assertEqual([call for call in calls if call[0] == 'ifconfig'], [['ifconfig', 'lo0', 'inet']])
+                self.assertTrue(remains)
+
+    def test_setup_and_preflight_fail_visibly_before_proof(self):
+        for failure in ('query', 'create', 'preflight'):
+            with self.subTest(failure=failure):
+                result, calls, remains = self.execute(failure=failure)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn('peer-policy', result.stderr)
+                self.assertFalse(any(call[0] == 'proof' for call in calls))
+                self.assertFalse(remains)
+                cleanup = ['ifconfig', 'lo0', 'inet', '127.0.0.2', '-alias']
+                self.assertEqual(cleanup in calls, failure == 'preflight')
+
+    def test_preexisting_alias_survives_failed_bind_preflight(self):
+        result, calls, remains = self.execute(preexisting=True, failure='preflight')
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn('peer-policy', result.stderr)
+        self.assertFalse(any(call[0] == 'proof' for call in calls))
+        self.assertEqual([call for call in calls if call[0] == 'ifconfig'], [['ifconfig', 'lo0', 'inet']])
+        self.assertTrue(remains)
+
+    def test_owned_alias_is_cleaned_after_proof_failure_and_signals(self):
+        for failure, signal_name, status in (('proof', '', 61), ('', 'SIGHUP', 129),
+                                             ('', 'SIGINT', 130), ('', 'SIGTERM', 143)):
+            with self.subTest(failure=failure, signal=signal_name):
+                result, calls, remains = self.execute(failure=failure, signal_name=signal_name)
+                self.assertEqual(result.returncode, status, result.stdout + result.stderr)
+                self.assertEqual(calls[-1], ['ifconfig', 'lo0', 'inet', '127.0.0.2', '-alias'])
+                self.assertFalse(remains)
+
+    def test_cleanup_failure_is_visible_and_preserves_prior_failure(self):
+        for failure, status in (('cleanup', 1), ('proof-cleanup', 61)):
+            with self.subTest(failure=failure):
+                result, calls, remains = self.execute(failure=failure)
+                self.assertEqual(result.returncode, status, result.stdout + result.stderr)
+                self.assertIn('peer-policy', result.stderr)
+                self.assertEqual(calls[-1], ['ifconfig', 'lo0', 'inet', '127.0.0.2', '-alias'])
+                self.assertTrue(remains)
+
+
 if __name__ == '__main__':
     unittest.main()

specs/tasks/FEATURE-ci-darwin-test-contracts.md

@@ -0,0 +1,36 @@
+# FEATURE-ci-darwin-test-contracts
+
+Status: In Progress (implementation ready; caller validation/finalization pending)
+Base: local v3 `a5a72356741300e5da16b94090f0f26a67a2d1f7`
+
+Repair four native-reproduced test/setup assumptions without changing production
+runtime, quota accounting, APIs, peer addresses or unrelated workflows.
+
+- [x] Test returned continuation behavior with an explicitly owned coroutine frame.
+- [x] Inject all five actual QPACK precommit allocations and prove blocked request nonpublication, with a successful control.
+- [x] Size the shared response fixture budget from actual reserved string capacity.
+- [x] Prepare and clean up only the Darwin selected-archive proof's owned loopback alias; execute lifecycle regressions.
+- [x] Run focused local checks and record native verification limits.
+- [ ] Caller validation and finalization.
+
+Evidence: primary `.debug/ci-darwin-test-contracts-8m2spsq4/journal.md`.
+Native RED batch 40055653509 is closed. Diagnostic refs f6475daf/88cd82fd
+must never merge or cherry-pick into v3. Header/outbox incidents remain closed
+with uncertain cause; this task does not retry or repair them. Native post-fix
+Darwin, Windows and BSD checks remain incomplete and CI/v3 PR owned.
+
+Local verification: each of the three focused C++ targets passes with GNU and
+actual libc++20 on Linux (47 cases / 2901 checks per standard library, no skips).
+The lifetime target and concurrency implementation pass Clang ASan/UBSan with
+leak and stack checking enabled (3 cases / 1816 checks), using supported execution
+outside sandbox ptrace. Workflow tests pass (28 tests, including 6 lifecycle tests
+covering 13 absent/preexisting/failure/signal scenarios). Changed-file cpplint,
+actionlint, workflow Bash syntax, Python compilation and diff whitespace pass.
+
+TDD uses the retained native RED for the three platform-specific fixture failures;
+new workflow lifecycle regressions failed before the setup change and pass after it.
+Original GCC sized-delete sanitizer setup and sandbox LSan failures are preserved
+in the journal; neither is reported as a passing run. Two Automake wrappers were
+interrupted during unrelated prerequisite compilation before tests; verification
+then executed only the three requested binaries. No production owner expansion,
+full baseline suite, native rerun, CI control or publication occurred.

test/unit/http3_qpack_test.cpp

@@ -3,12 +3,15 @@
 #include <cstdlib>
 #include <new>
 #include <limits>
+#include <string>
 #include "./littletest.hpp"
 namespace {
 int allocation_countdown = -1;
+bool allocation_failed = false;
 }  // namespace
 void* operator new(std::size_t size) {
     if (allocation_countdown == 0) {
+        allocation_failed = true;
         allocation_countdown = -1; throw std::bad_alloc();
     }
     if (allocation_countdown > 0) --allocation_countdown;
@@ -125,17 +128,37 @@ LT_BEGIN_AUTO_TEST(http3_qpack_suite, local_settings_advertise_admitted_limits)
     LT_CHECK_EQ(capacity, 128U); LT_CHECK_EQ(blocked, 2U); LT_CHECK_EQ(connect, 1U);
 LT_END_AUTO_TEST(local_settings_advertise_admitted_limits)
 LT_BEGIN_AUTO_TEST(http3_qpack_suite, instruction_allocation_failure_is_internal_and_does_not_publish)
-    for (int stage = 0; stage < 3; ++stage) {
+    // Exceed supported string inline capacities for both decode and table copies.
+    const std::string name(32, 'a'), value(32, 'b');
+    LT_ASSERT(name.size() > std::string().capacity());
+    const auto encoded = hd::qpack_encode_encoder_instruction(
+        {hd::qpack_encoder_instruction_kind::insert_literal, 0, false, name, value}, {100, 100, 100});
+    LT_ASSERT(encoded.status.ok());
+    const auto wire = std::as_bytes(std::span(encoded.value));
+    // Control, decoded name/value, table name/value copies, prepared table node.
+    for (int stage = -1; stage < 5; ++stage) {
         auto root = budget(); hd::quic_storage_pool pool(10000, 30000, root); auto limits = dynamic_limits(); limits.qpack_capacity = 256;
-        hd::http3_connection c(pool.data(), pool.critical(), limits); c.attach_stream(2);
+        hd::http3_connection c(pool.data(), pool.critical(), limits); c.attach_stream(0); c.attach_stream(2);
         LT_CHECK(!feed(c, 2, bytes({2, 0x3f, 0xe1, 1})).error);
-        auto wire = bytes({0x54, 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 20,
-                           'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b', 'b'});
+        LT_CHECK(!feed(c, 0, bytes({1, 3, 2, 0, 0x80})).error);
+        LT_CHECK_EQ(root.in_use(hs::resource::blocked_headers), 1U);
+        LT_CHECK(!c.event(0));
         LT_CHECK(!feed(c, 2, std::span(wire).first(wire.size() - 1)).error);
+        allocation_failed = false;
         allocation_countdown = stage;
         auto result = feed(c, 2, std::span(wire).last(1)); allocation_countdown = -1;
-        LT_ASSERT(result.error); LT_CHECK_EQ(result.error->wire_code, 0x102U);
-        LT_CHECK(!c.event(0));
+        LT_CHECK_EQ(allocation_failed, stage >= 0);
+        if (stage < 0) {
+            LT_CHECK(!result.error);
+            LT_ASSERT(c.event(0));
+            LT_ASSERT_EQ(c.event(0)->fields.size(), 1U);
+            LT_CHECK_EQ(c.event(0)->fields[0].name, name);
+            LT_CHECK_EQ(c.event(0)->fields[0].value, value);
+            LT_CHECK_EQ(root.in_use(hs::resource::blocked_headers), 0U);
+        } else {
+            LT_ASSERT(result.error); LT_CHECK_EQ(result.error->wire_code, 0x102U);
+            LT_CHECK(!c.event(0));
+        }
     }
 LT_END_AUTO_TEST(instruction_allocation_failure_is_internal_and_does_not_publish)
 LT_BEGIN_AUTO_TEST(http3_qpack_suite, encoded_byte_limit_persists_until_event_release)

test/unit/resource_limits_test.cpp

@@ -179,7 +179,10 @@ LT_BEGIN_AUTO_TEST(resource_limits_suite, h1_output_retirement_restores_shared_c
     LT_CHECK_EQ(budget.in_use(hs::resource::response_queue_bytes), 0u);
 LT_END_AUTO_TEST(h1_output_retirement_restores_shared_capacity_for_a_long_response)
 LT_BEGIN_AUTO_TEST(resource_limits_suite, h1_partial_output_keeps_retained_prefix_charged_until_refill_or_drain)
-    auto budget = root(hs::resource::response_queue_bytes, 512);
+    std::string allocation;
+    allocation.reserve(512);
+    const auto retained_capacity = allocation.capacity();
+    auto budget = root(hs::resource::response_queue_bytes, retained_capacity);
     hd::http1_response_outbox outbox({512, 512}, budget);
     auto& sink = outbox.open(1, {});
     http::request_head request; request.request_protocol = http::protocol::http_1_1;
@@ -188,10 +191,10 @@ LT_BEGIN_AUTO_TEST(resource_limits_suite, h1_partial_output_keeps_retained_prefi
     outbox.consume_front(outbox.queued_bytes());
     const std::array<std::byte, 512> payload{};
     LT_ASSERT(sink.push(payload).kind == hd::body_push::accepted);
-    LT_CHECK_EQ(budget.in_use(hs::resource::response_queue_bytes), 512u);
+    LT_CHECK_EQ(budget.in_use(hs::resource::response_queue_bytes), retained_capacity);
     LT_CHECK_EQ(outbox.consume_front(511), 511u);
     LT_CHECK_EQ(outbox.queued_bytes(), 1u);
-    LT_CHECK_EQ(budget.in_use(hs::resource::response_queue_bytes), 512u);
+    LT_CHECK_EQ(budget.in_use(hs::resource::response_queue_bytes), retained_capacity);
     hd::http1_response_outbox sibling({512, 512}, budget);
     auto& excess = sibling.open(1, {});
     LT_CHECK(excess.start(request, http::status::from_code(200), fields).code() == http::outcome_code::limit_exceeded);

test/unit/task_resume_signal_lifetime_test.cpp

@@ -38,6 +38,28 @@ namespace h = httpserver;
 #endif
 #ifndef LHS_SKIP_NEW_OVERRIDE
 namespace {
+struct suspended_probe {
+    struct promise_type {
+        suspended_probe get_return_object() {
+            return suspended_probe(std::coroutine_handle<promise_type>::from_promise(*this));
+        }
+        std::suspend_always initial_suspend() noexcept { return {}; }
+        std::suspend_always final_suspend() noexcept { return {}; }
+        void return_void() noexcept {}
+        void unhandled_exception() { std::terminate(); }
+    };
+    explicit suspended_probe(std::coroutine_handle<promise_type> frame) : frame(frame) {}
+    suspended_probe(const suspended_probe&) = delete;
+    suspended_probe& operator=(const suspended_probe&) = delete;
+    std::coroutine_handle<promise_type> frame;
+    ~suspended_probe() { if (frame) frame.destroy(); }
+};
+suspended_probe count_resumptions(int* count) {
+    for (;;) {
+        ++*count;
+        co_await std::suspend_always{};
+    }
+}
 thread_local void (*allocation_hook)() = nullptr;
 std::shared_ptr<h::detail::resume_state> state;
 std::unique_ptr<h::resume_waiter> waiter;
@@ -106,6 +128,8 @@ LT_BEGIN_AUTO_TEST(resume_lifetime_suite, published_waiter_can_die_during_timeou
     static_cast<void>(h::detail::default_timer_queue());
     for (int winner : {1, 2}) {
         trigger = winner; deliveries = 0; hook_calls = 0;
+        int resumptions = 0;
+        auto probe = count_resumptions(&resumptions);
         observed = h::resume_outcome::timeout;
         state = std::make_shared<h::detail::resume_state>();
         waiter = std::make_unique<h::resume_waiter>(state,
@@ -114,15 +138,20 @@ LT_BEGIN_AUTO_TEST(resume_lifetime_suite, published_waiter_can_die_during_timeou
         auto* previous = h::detail::current_executor_slot();
         h::detail::current_executor_slot() = &target;
         allocation_hook = reclaim_on_timer_allocation;
-        auto continuation = waiter->await_suspend(std::noop_coroutine());
+        auto continuation = waiter->await_suspend(probe.frame);
         h::detail::current_executor_slot() = previous;
         allocation_hook = nullptr;
-        LT_CHECK(continuation == std::noop_coroutine());
+        LT_CHECK_EQ(resumptions, 1);
+        LT_ASSERT(continuation);
+        continuation.resume();
+        LT_CHECK_EQ(resumptions, 1);
         LT_CHECK_EQ(hook_calls, 1);
         LT_CHECK_EQ(deliveries, 1);
         LT_CHECK(observed == (winner == 1 ? h::resume_outcome::resumed : h::resume_outcome::cancelled));
         LT_CHECK(!waiter);
         LT_CHECK(!state->head);
+        probe.frame.destroy();
+        probe.frame = {};
     }
 #endif
 LT_END_AUTO_TEST(published_waiter_can_die_during_timeout_registration)