Repository navigation
Decide hold coverage for system-scoped writes that reach held partitions #1887
Description
Problem
External-management holds (ADR 0193, ADR 0327) are checked only in partition-resolution paths. System-scoped writes that change or stop every partition on a managed system — system power off, system profile activation, hmc_restore_lpar_profiles — never resolve a partition, so they proceed while a partition on that system is held. The behaviour is documented, but a held kdive host can still be powered off through a system-level tool on the same hmcpctl host.
Evidence
docs/adr/0327-hold-store-schema-and-hold-id-plumbing.md:48-54(Decision 5) places these tools outside the hook;:84-87rejects refusing them while any hold exists, because nohold_idcan authorize every partition and the system tools that touch partitions have no registry marker.docs/mcp-server.md:552-558anddocs/kdive-tier-a-contract.md:125-128tell consumers these surfaces are unfenced; the handoff document lists them inunfenced/unchecked_tools.
Expected
A recorded decision, in a new ADR that amends ADR 0327 Decision 5, on whether system-scoped writes consult the hold store — for example refuse while a hold exists on the system unless every hold on it is presented, or require an explicit override — and, if adopted, the implementation with a registry marker for system-scoped tools that affect partitions.
Proposed approach
Design first: enumerate the system-scoped write tools that affect partitions, weigh the lock-out the ADR 0327 rejection names against the hazard, and write the ADR. Implement in the same PR only if the decision is small; otherwise split.
Dependencies
None. #1852's handoff contract would need its unfenced list updated if coverage changes.
Verification and boundaries
ADR review; if implemented, focused hold tests and just verify. No live HMC access is needed; the change is verifiable with focused tests and just verify.
Provenance
Filed by campaign 601fc41ce62e-1e90b4bf-a0bf-4a80-b3ac-c93b2596b8de from ADR 0327 Decision 5 (orchestrator review of #1851/#1852) follow-up review, against main at 3bc63ff3. The operator authorized filing all deduplicated follow-up candidates as unparented issues on 2026-11-04.
Activity
randomparity commentedon Nov 5, 2026
scope identity: #1887; annotation token q1887-92586ba1
outcome: Fence the host's MCP and CLI system-wide writes affecting existing partitions when their managed system carries an external-management hold, and record the successor to ADR 0327 Decision 5.
completion criteria: C1 enumerate current system-scoped writes and their CLI mirrors, record the decision and its consequences in ADR 0339, and amend only ADR 0327's Status (issue Expected/Proposed approach). C2 the six enumerated tools hmc_modify_system, hmc_power_on_system, hmc_power_off_system, hmc_activate_system_profile, hmc_restore_lpar_profiles and hmc_update_firmware refuse before HMC mutation when a hold exists on the selected system; holders release first and no hold_id/override bypass is added (operator policy decision). C3 a registry marker drives identical MCP/direct-invoke and existing CLI-mirror coverage; handoff unchecked_tools and consumer documentation reflect that coverage (issue Expected/Dependencies). C4 focused store, selector, registry and front-end tests prove refusal, unaffected systems/reads/library behavior and fail-closed unknown store state; run just verify and pinned prek before shipping; no live HMC run (issue Verification and project guardrails).
provenance: Issue #1887 body read at base 0dcb936 supplies C1, C3 and C4. Campaign identity 152593d7a535-fdfc969e-824d-4d69-a9ae-3ce95496903a. The campaign operator explicitly approved the exclusions/owners below and answered "Refuse while any system hold exists"; the campaign dispatch on 2026-11-04 conveys that exact decision for C2, including holders releasing first, no override or multi-token authorization. The normalized exclusion set is unchanged. Source enumeration confirms the six tools resolve the managed-system UUID before mutation, including restore before ownership override; the broader registry inventory is classified in the design. Existing ADR 0193 owns the front-end-only, resolver-time hold model. No parent epic and no persisted WORK:DIVINATION was present; the assessment below is derived from the issue and live source.
exclusions: Direct HMC, raw-command and library fencing — owner ADR 0193 Decision 6. Protection beyond system tools affecting partitions — owner operator.
surface: Extend existing registry metadata, call context, managed-system resolver and installed hold guard/store reader; annotate the six tools and propagate the marker through CLI mirrors. Update handoff coverage and consumer docs, focused tests, the design spec/ignored plan, and only ADR 0327 Status for supersession. No schema migration, new command, token, dependency or facade export. Existing partition-token semantics remain with their current owner. Reserved docs/adr/0339-system-write-hold-fence.md=0339. No ADR index or mandatory shared edits.
ambiguities: None; conservative whole-tool refusal includes name-only system modifications and validate-only system-profile calls. The six-tool set changes existing partition state/configuration or the system platform; resource-only/creation tools remain outside this bounded change and are enumerated with reasons.
interaction: interactive
Tracking metadata:
randomparity commentedon Nov 5, 2026
Design prepared for issue #1887; scope token q1887-92586ba1.
Campaign identity: 152593d7a535-fdfc969e-824d-4d69-a9ae-3ce95496903a.
Branch: feat/system-write-hold-fence-1887; base main at 0dcb936; design commit 2fa80e8.
The recorded operator choice remains "Refuse while any system hold exists", with holders releasing first and no override or multi-token authorization. The approved exclusion/owner set is unchanged from WORK:SCOPE.
The design enumerates six system-wide tools and three existing CLI mirrors, using a registry marker and the existing managed-system resolver/hold guard. It includes ADR 0339, an ADR 0327 Status-only amendment, the design spec and the ignored implementation plan.
Validation: ADR numbering, generated documentation freshness, tool reference check, diff whitespace check and lint passed; the normal commit's 14 pre-commit static hooks all passed. Existing full baseline was independently qualified for this unchanged runtime tree; no implementation tests or final-candidate proof are claimed yet.
Next phase: the campaign coordinates isolated combined design review and oathbind. No implementation before those gates. Design review attempts 0, valid passes 0; branch/security review rounds 0; no open findings or deferrals. Full-spec M/250, combined design 380 lines (1.52x, below-note). No PR or live HMC action yet.
randomparity commentedon Nov 5, 2026
Issue #1887 implementation is ready for independent branch and security review; scope token q1887-92586ba1.
Campaign identity: 152593d7a535-fdfc969e-824d-4d69-a9ae-3ce95496903a.
Branch: feat/system-write-hold-fence-1887; base main at 0dcb936; candidate 66c9aba.
The six enumerated system-wide tools and three existing CLI mirrors now refuse while their selected system has any hold. The recorded policy remains "Refuse while any system hold exists", with holders releasing first and no override or multi-token authorization. The frozen exclusion/owner set is unchanged.
Both combined-design phases approved without findings, including the corrected implementation estimate; both independent scope audits approved without scope findings or deferrals. The same four disclosed failure limits remain: resolver-time admission race, conservative argument-variant lockout, independent writers outside this host fence, and resource/creation tools outside the six-tool set. ADR 0339 now records the approved decision as Accepted.
Cast contract evidence: initial focused run had 20 failures and 84 passes; implementation passed 104 focused tests and 467 bounded integration tests. A controlled resolver-check bypass reached the mocked mutation boundary and failed as intended; exact source was restored. All 14 normal pre-commit static hooks passed. No live HMC action occurred. Final full candidate verification and pinned prek remain due after review and simplification.
The completed implementation is 408 added-plus-removed lines, matching the corrected estimate of 390–440. The transient plan was archived privately and removed from its ignored implementation location. The strict private Cast handoff records build-complete; it does not replace independent quest reviews.
Next: independent whole-branch review and security scan. Cumulative completed review rounds: 2, one frozen charter; completed scope audits: 2; branch/security rounds: 0/0. No open findings, deferrals, PR or push.
randomparity commentedon Nov 5, 2026
outcome: handed off — PR #1941 green and mergeable, awaiting campaign-root merge.
Issue #1887 now refuses the six selected system-wide writes and their three CLI mirrors while any selected-system hold remains. Holders release all holds first; no token, caller identity or ownership override bypass is provided.
Validation: one final full local
just verifyrun passed in 1,319.100 seconds; separately required pinneduv run --no-sync prek run --all-filespassed in 114.862 seconds. The existing baseline proof was qualified and reused, without a duplicate baseline run. Focused tests, 467-test bounded integration and the controlled resolver-bypass failure/restoration passed earlier. CI run 41962983305 passed, including amd64 Python 3.11–3.14, wheel and library gates. No live HMC action was performed.The two design phases, both scope audits, whole-branch review and static security scan approved without findings. Simplification made no changes. Review publication: #1941 (comment).
The PR body and review comment disclose resolver-time admission races, conservative name-only/validate-only lockout, ADR 0193's independent-writer exclusions, the bounded six-tool surface and the reviewed estimate correction. No open findings, owned deferrals or follow-up candidates remain. The implementation estimate changed because the required composed test matrix was larger, not because scope expanded.
Campaign workflow handoff only: the worker leaves the branch and worktree intact for the root's serialized merge gate and any required base refresh. No merge or cleanup was performed.
MERGE-READY: #1941 @ 66c9aba
randomparity commentedon Nov 5, 2026
Derivative handoff for PR #1941 after a bounded base refresh.
Original author-approved head: 66c9aba
Current refreshed head: feb2c83
Exact-head checks and the captured base passed.
MERGE-READY: #1941 @ feb2c83
randomparity commentedon Nov 5, 2026
Campaign merge completed — issue #1887
PR #1941 merged at 713ef29 after exact-head CI and guarded merge checks for feb2c83. One bounded base refresh and root-assigned ADR0343 renumbering preserved the operator-approved six-tool/three-mirror hold fence. Full local verification and pinned hooks passed on the refreshed head. Issue closure independently verified. Resolver-time admission, conservative variant lockout and ADR0193 independent-writer boundaries remain disclosed. Post-merge base CI remains unverified. No new follow-ups or occurrences.