From 9c9157507937b3e084a7ca1e79a2ebd77d0b0928 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 8 Oct 2026 17:11:35 +0200 Subject: [PATCH] docs(redesign): record P5-13 environment recovery blockers --- .../p5-13-semantic-qualification/README.md | 64 +++++++++- .../environment-recovery-checkpoint.json | 116 ++++++++++++++++++ 2 files changed, 178 insertions(+), 2 deletions(-) create mode 100644 docs/redesign/phase-5/p5-13-semantic-qualification/environment-recovery-checkpoint.json diff --git a/docs/redesign/phase-5/p5-13-semantic-qualification/README.md b/docs/redesign/phase-5/p5-13-semantic-qualification/README.md index 8c74dfa..5f63d20 100644 --- a/docs/redesign/phase-5/p5-13-semantic-qualification/README.md +++ b/docs/redesign/phase-5/p5-13-semantic-qualification/README.md @@ -1,10 +1,70 @@ # P5-13 — Configured-model semantic qualification -**Current decision: BLOCKED — configured target remains unavailable.** The environment checkpoint below attempted the authorized Docker recovery and inspected active non-secret configuration. It did not establish a reachable production-equivalent runtime. No generation/evaluation model run or human output review was completed. Zero observed failures from zero runs is not a factuality pass. P5-13 UI remains blocked. +**Current decision: BLOCKED — configured target remains unavailable.** The recovery checkpoint below identified the runtime entry as an AF_UNIX socket and reproduced the Docker failure. The supported Model Runner disable command also failed; neither Docker nor the actual deployed model identity was recovered. No generation/evaluation model run or human output review was completed. Zero observed failures from zero runs is not a factuality pass. P5-13 UI remains NO-GO. Parent: `2398ff354ed680c750500d1b417eee23e18f181d`, branch `codex/ui-redesign-phase4`. This is a documentation-only qualification checkpoint. The application, providers, prompts, proposal enforcement, revisions, rendering, dependencies and CI are unchanged. P5-13 UI, P5-14 and B07 have not begun. -The original corpus declaration was committed as `14e9e60ce5f37bbf4449087612e345d7186c9f81`. The subsequent bounded environment checkpoint starts from that commit, updates this record, and preserves the original [qualification results](qualification-results.json). Its current observations are in [environment-checkpoint.json](environment-checkpoint.json). The historical CONDITIONAL GO below is not the current environment acceptance decision. +The original corpus declaration was committed as `14e9e60ce5f37bbf4449087612e345d7186c9f81`. The first environment checkpoint is preserved in [environment-checkpoint.json](environment-checkpoint.json). This bounded recovery checkpoint starts from `d37b97ce390ba31ec3b7bcea6b371aff1057992c`; sanitized observations are in [environment-recovery-checkpoint.json](environment-recovery-checkpoint.json). Neither checkpoint changes the original [qualification results](qualification-results.json), corpus or rubric. The historical CONDITIONAL GO below is not the current environment acceptance decision. + +## Qualification-environment recovery — 2026-10-08 + +### Read-only filesystem diagnosis + +The exact inspected entry was the absolute current-account path expanded from `%LOCALAPPDATA%\Docker\run\dockerInference`, conventionally `C:\Users\\AppData\Local\Docker\run\dockerInference`. The live diagnostic retained the expanded path; the committed evidence omits the account name. No new rename, deletion, permission or reparse-point mutation was attempted. + +| Property / inspection | Observed result | +|---|---| +| Native `FindFirstFileW` enumeration | File entry, zero bytes, attributes `0x420` (`Archive`, `ReparsePoint`); not a directory | +| Reparse tag, from `WIN32_FIND_DATA.dwReserved0` | **`0x80000023`, `IO_REPARSE_TAG_AF_UNIX`**: an AF_UNIX socket endpoint, not a symlink/junction | +| Filesystem target / target existence | Not applicable: this tag represents a socket endpoint, not a filesystem link to a target path | +| Created / last written (UTC) | **2026-08-19 16:12:50.512702 / 2026-09-14 07:56:57.680523**; unchanged after this attempt | +| Open the entry itself for attributes/security | `CreateFileW` with `FILE_FLAG_OPEN_REPARSE_POINT`, `FILE_FLAG_BACKUP_SEMANTICS`, `READ_CONTROL` and `FILE_READ_ATTRIBUTES` returned **1920**, “The file cannot be accessed by the system” | +| Filesystem ownership | **Unverified**. The entry cannot be opened for its security descriptor; independent `icacls /L` also failed with the same access error. A PowerShell `Get-Acl` module-load error was a separate tooling limitation, not filesystem evidence | +| Process/lock ownership | No Desktop/backend/Ollama processes before inspection or after cleanup. Read-only Restart Manager resource registration/listing returned **6 (`ERROR_INVALID_HANDLE`)**, so it did **not** prove that there are no other holders | +| Docker component association | Backend startup logs explicitly name the inference manager and this exact Unix listener path. This establishes the failing component, independently of the filename | +| Original creator | **Unverified**: no creation audit was available. Component association and timestamps do not prove which process originally created the entry | + +The native inspection used Python standard-library `ctypes` against Windows APIs; the scratch helper/output remain ignored under `.artifacts/p5-13-environment-recovery/`. Handles and Restart Manager sessions were closed; neither `RmShutdown` nor `RmRestart` was called. It enumerated the reparse entry without following it and did not read a socket payload. `DeviceIoControl(FSCTL_GET_REPARSE_POINT)`/security inspection could not proceed because the metadata/security open failed. + +**Diagnosed failure boundary:** Docker Desktop cannot remove an existing AF_UNIX socket entry while starting its inference-manager listener. The deeper Windows/filesystem cause of error 1920 remains unknown; this is not reported as confirmed ACL corruption, a junction target problem, a proven file lock or an Ollama/model failure. + +The previous checkpoint's **one failed `Move-Item -LiteralPath` attempt remains recorded below**. It created no backup and did not move the entry. This checkpoint did not repeat that operation or attempt a low-level reparse deletion. + +### Required application path and supported recovery attempt + +JobTracker's existing path is **API → private FastAPI `ai-service:8001` → ordinary Ollama HTTP `/api/generate` on port 11434**. [Compose](../../../../docker-compose.yml) supports an opt-in `bundled-ollama` container with persistent `ollama_data`, or an existing configured HTTP origin through `OLLAMA_BASE_URL`; the [provider implementation](../../../../tools/summarizer/app.py) does not use Docker Desktop Model Runner. A host/shared service is usable only if its actual identity/settings match the verified target. No host Ollama process or established equivalent endpoint was found. + +Docker Desktop's inference feature is therefore **not an application requirement**. Its failing manager nevertheless blocks this local Desktop engine before the normal containers can run. Disabling the nonessential feature was tested through the installed public CLI, without touching its socket or storage: + +| Bounded command / check | Result | +|---|---| +| Installed binaries/help | Desktop backend **4.86.0.236216**, Docker CLI **29.7.2**, Desktop plugin **v0.4.3**; `docker desktop disable model-runner --help` explicitly supports “Disable Docker Model Runner” | +| `rtk proxy docker desktop disable model-runner` before startup | Failed to update settings: `dockerBackendApiServer` named pipe unavailable | +| `rtk proxy docker desktop start --detach --timeout 45` | Startup accepted; **2026-10-08T15:04:06Z** backend log reproduced the same inference listener/socket-removal failure | +| Same supported disable command after startup | Also failed with the unavailable backend settings named pipe; no successful disable/re-enable claimed | +| `rtk proxy docker ps --format "{{.Names}}\|{{.Status}}\|{{.Ports}}"` | Linux-engine API unavailable; `dockerDesktopLinuxEngine` named pipe missing | +| `rtk proxy docker desktop stop --timeout 15` | Timed out; only the eight Desktop/backend PIDs observed starting during this attempt were stopped, with process-name/start-time identity checks | +| Final verification | Zero Desktop/backend processes, original socket still present, previous proposed backup absent; native tag/size/timestamps unchanged | + +The table's escaped separators display the literal `|` characters passed to `--format`. Selected non-secret settings `EnableDockerAI=true` and `InferenceCanUseGPUVariant=true` were unchanged; no explicit Model Runner enabled flag was present in the inspected keys. This limited inspection is not a complete settings-file equality claim. No guessed setting was edited. No factory reset, reinstall, WSL unregister, volume/image/container deletion, application/database modification or production operation occurred. + +### Deployed identity and alternative transport + +The local current-code candidate remains **Ollama `qwen2.5:7b`**, with the existing generation/evaluation settings; it is **not verified deployed identity**. Independent read-only deployment inspection still finds `/opt/job-tracker/shared/.env` plus process overrides and CI references to `PROD_HOST`, `PROD_USER`, `PROD_SSH_KEY`, without a usable public connection value. Local SSH configuration remains absent. No secret was retrieved and no production/staging endpoint was contacted. + +An existing Docker-independent **partial** diagnostic route was identified: authenticated `GET /api/jobapplications/ai-metrics` (alias `summarizer-metrics`), or authorised admin `GET /api/admin/system`. These obtain live private-sidecar health through [SummarizerService](../../../../JobTrackerApi/Services/SummarizerService.cs). Use **`ollamaModel`**, not the separate DistilBART `model` value. They can establish configured model/reachability/available model names; admin diagnostics also identify the backend revision. They require an established deployed application origin and authorised session, unavailable here. They omit full provider/routing, model digest and sidecar image/prompt identity, so even a successful response would only supply part of the gate. + +The existing private sidecar `/health`, deployed non-secret settings, runtime image/source hashes and the actual service's Ollama inventory are still needed to complete identity. An ordinary HTTP transport may avoid local Desktop, but **no same-target alternative is established**. Neither Gemini nor another local model was substituted, no model was downloaded, and no corpus call was made against a guess. + +### Recovery result, validation and next operator action + +**BLOCKED — configured target remains unavailable. Docker was not safely recovered.** Actual deployed provider/model/digest/settings remain unverified, target reachability remains unestablished, smoke test **not run**, qualification **0/366**, human reviews **0**, factuality failures **unmeasured**. The frozen corpus/rubric and deterministic application protections are unchanged. P5-13 UI remains **NO-GO**. + +Further socket/filesystem repair is uncertain because filesystem ownership and original creation are unproved and ordinary metadata/security operations fail. Obtain a supported Docker/Windows diagnosis for this exact **AF_UNIX tag + error 1920 + inference startup log**, preserving Docker/WSL/application data. Do not delete this entry or reset storage on the basis of its name alone. No destructive recovery proposal was executed or represented as necessary. + +Independently, the operator must provide the existing authorised deployed/staging connection or sanitized runtime diagnostics: provider/routing/model settings, model digest, actual sidecar/API image revisions and prompt-source hashes. This can remove the identity blocker without repairing local Desktop. Once a semantically identical isolated target is verified/reachable, run one uncached synthetic smoke request through the application routing before the unchanged 366-call qualification and full human-review packet. A local default or API health response alone cannot clear the whole identity gate. + +Fresh checks for this **documentation-only** recovery checkpoint: configuration/Compose **3/3**, frozen LF-normalized hashes, JSON integrity/decision/count checks, current-document local links, staged secret scan and Git whitespace/scope checks. Application suites were **not rerun**. Inherited counts remain **1,021 backend / 455 frontend / 49 sidecar / 106 focused AI / 112 browser / 1 real HTTP / 5 revision**, **16/16 fidelity (36 = 36 pages)**, **8/8 settings exports (24 = 24 pages)** and **9/6/1/3 security/configuration**; no test-count changes. No application, environment template, Compose, dependency or CI file changed. All unrelated debt, including F04, remains open. Work stops before P5-13 UI, P5-14 and B07. ## Configured-model environment checkpoint — 2026-10-08 diff --git a/docs/redesign/phase-5/p5-13-semantic-qualification/environment-recovery-checkpoint.json b/docs/redesign/phase-5/p5-13-semantic-qualification/environment-recovery-checkpoint.json new file mode 100644 index 0000000..8731a73 --- /dev/null +++ b/docs/redesign/phase-5/p5-13-semantic-qualification/environment-recovery-checkpoint.json @@ -0,0 +1,116 @@ +{ + "schemaVersion": "jobtracker.cv-semantic-qualification-environment-recovery.v1", + "observedDate": "2026-10-08", + "sourceCheckpoint": "d37b97ce390ba31ec3b7bcea6b371aff1057992c", + "decision": "BLOCKED — configured target remains unavailable", + "p513UiReadiness": "NO-GO", + "applicationChanged": false, + "runtimeEntry": { + "sanitizedPath": "%LOCALAPPDATA%\\Docker\\run\\dockerInference", + "absolutePathInspected": true, + "attributesHex": "0x420", + "attributes": ["Archive", "ReparsePoint"], + "isDirectory": false, + "sizeBytes": 0, + "reparseTagHex": "0x80000023", + "reparseTagName": "IO_REPARSE_TAG_AF_UNIX", + "type": "AF_UNIX socket endpoint; not a symlink or junction", + "filesystemTarget": null, + "targetExistence": "not applicable to socket endpoint", + "createdUtc": "2026-08-19T16:12:50.512702Z", + "lastWrittenUtc": "2026-09-14T07:56:57.680523Z", + "metadataMethod": "FindFirstFileW, WIN32_FIND_DATA.dwReserved0; enumerate entry without following it", + "securityOpenMethod": "CreateFileW: READ_CONTROL | FILE_READ_ATTRIBUTES, share read/write/delete, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS", + "securityOpenError": 1920, + "icaclsLinkQuery": "failed: The file cannot be accessed by the system", + "filesystemOwner": null, + "ownerStatus": "unverified; security descriptor unavailable", + "lockQuery": "read-only Restart Manager register/list, error 6 ERROR_INVALID_HANDLE", + "otherProcessLockStatus": "inconclusive; not a no-lock pass", + "initialDesktopBackendOllamaProcesses": 0, + "finalDesktopBackendProcesses": 0, + "componentAssociation": "Docker backend startup names its inference-manager Unix listener and exact path", + "originalCreator": "unverified; no creation audit available", + "underlyingWindowsFilesystemCause": "unestablished; not claimed ACL corruption or confirmed stale handle", + "mutationAttemptedInThisCheckpoint": false, + "tagSizeAndTimestampsUnchangedAfterAttempt": true, + "previousFailedRenamePreserved": true, + "previousRenameCreatedBackup": false + }, + "applicationAiPath": { + "path": "API -> private ai-service:8001 -> Ollama HTTP /api/generate on port 11434", + "desktopModelRunnerRequired": false, + "supportedOllamaOrigins": "opt-in bundled-ollama container or existing OLLAMA_BASE_URL", + "hostOllamaProcessFound": false, + "localCandidateModel": "qwen2.5:7b", + "localCandidateEstablishesDeployedIdentity": false + }, + "boundedRecovery": { + "desktopVersion": "4.86.0.236216", + "dockerCliVersion": "29.7.2", + "desktopPluginVersion": "v0.4.3", + "supportedCommand": "docker desktop disable model-runner", + "helpVerified": true, + "disableAttempts": 2, + "disableResult": "both failed to update settings: dockerBackendApiServer named pipe unavailable", + "disableSucceeded": false, + "startAccepted": true, + "failureReproducedAtUtc": "2026-10-08T15:04:06Z", + "failureBoundary": "Inference manager cannot remove existing AF_UNIX runtime entry; error 1920, listener invalid filename syntax", + "linuxEngineAvailable": false, + "dockerPsResult": "dockerDesktopLinuxEngine named pipe missing", + "gracefulStop": "docker desktop stop --timeout 15; context deadline exceeded", + "processCleanup": "only eight PIDs launched in this attempt; names and start times verified, eventual zero remaining", + "selectedSettingsBeforeAfter": {"EnableDockerAI": true, "InferenceCanUseGPUVariant": true}, + "explicitModelRunnerEnabledFlagFound": false, + "completeSettingsEqualityClaimed": false, + "settingsManuallyEdited": false, + "factoryResetOrReinstall": false, + "dockerWslOrApplicationDataDeleted": false, + "modelOrSidecarServicesStarted": 0, + "recovered": false + }, + "deployedIdentity": { + "provider": null, + "model": null, + "digest": null, + "runtimeSettingsVerified": false, + "imageAndPromptRevisionVerified": false, + "establishedConnectionAvailable": false, + "localSshConfigPresent": false, + "dockerIndependentExistingDiagnostics": ["authenticated /api/jobapplications/ai-metrics", "authenticated /api/jobapplications/summarizer-metrics", "authorised admin /api/admin/system"], + "diagnosticLimits": "Ollama model/reachability/inventory names and admin backend revision only; no complete routing/digest/sidecar identity", + "diagnosticsCalled": false, + "targetReachability": "unestablished", + "semanticallyIdenticalAlternativeEstablished": false, + "substituteModelUsed": false + }, + "qualification": { + "smokeTest": "not run: identity and reachability gates incomplete", + "plannedCalls": 366, + "attemptedCalls": 0, + "completedCalls": 0, + "humanReviews": 0, + "criticalFactualityFailures": null, + "factualityStatus": "unmeasured, not a zero-failure qualification pass", + "corpusSha256LfNormalized": "bd9869e102932817cd471036fd93429aff376b5dd72334f1f0519a4b6b805a7d", + "rubricSha256LfNormalized": "0de49fc9a11ba5626ff4049bb1ae0baa201932ba589cbb0cfa4bdb9f0939557e" + }, + "validation": { + "freshConfigurationTests": 3, + "applicationSuitesRerun": false, + "countChanges": 0, + "inherited": {"backend": 1021, "frontend": 455, "sidecar": 49, "focusedAi": 106, "browser": 112, "realHttp": 1, "revision": 5, "fidelity": 16, "previewPages": 36, "pdfPages": 36, "settingsExports": 8, "settingsPreviewPages": 24, "settingsPdfPages": 24, "rateLimit": 9, "ingress": 6, "pdfAdmission": 1, "configuration": 3} + }, + "preservation": {"affectedEvidenceContracts": ["PRES-C11", "PRES-C01", "PRES-C07", "PRES-C10", "PRES-S04", "PRES-E09"], "capabilityOrRouteChanged": false, "corpusRubricAndOriginalResultsChanged": false, "proposalRevisionRendererOrPrivacyBoundaryChanged": false}, + "remainingOperatorActions": [ + "Obtain supported Docker/Windows diagnosis of exact AF_UNIX endpoint/error 1920 without resetting storage or deleting an entry whose owner is unproved.", + "Provide established authorised deployed/staging connection or sanitized runtime provider/model/digest/settings/image/prompt identity evidence.", + "Verify same-target isolated routing and one uncached synthetic smoke request before frozen 366 calls and complete human review." + ], + "privacy": {"secretsExposedOrCommitted": false, "realUserDataSent": false, "productionOrStagingContacted": false}, + "f04": "open", + "p513UiStarted": false, + "p514Started": false, + "b07Started": false +}