test: record partial native bridge import control

2026-11-10 17:28:30 -05:00
parent ce21f5db09
commit 2e4905f112
13 changed files with 1009 additions and 0 deletions
@@ -0,0 +1,64 @@
+# Installed native bridge diagnostic — attempt A stopped at its ownership guard
+
+The approved fixed-200 diagnostic did **not complete**. One measured native
+child started; it stopped during its first operation because the harness required
+an identity keychain association that the installed .NET wrapper allows to be
+absent. This is a diagnostic model error. There is no repeated native retention
+result, no production mitigation or resource-budget decision, and no change to
+#799's status.
+
+The separate SDK 2.0.1 seed completed with the expected RSA leaf/key pair,
+observed application manager disposal, and private fixture files. The measured C
+child loaded the pinned native bridge, checked its export image and rejected CLR
+and SDK images. The C build succeeded with six unsuppressed deprecation warnings
+for the exercised public keychain APIs; the seed build reported zero warnings
+and errors. This was macOS **26.5.2** build **25F84** arm64; installed managed
+cryptography was .NET **10.0.14**. [The inspected design](NATIVE_IMPORT_DESIGN.md)
+records the exact native/managed binary paths and ABI.
+
+| Observation | Recorded result |
+|---|---|
+| Before snapshot | AppleDatabase **1 / 768 shallow bytes**; Mach RSS **7,815,168 bytes**; 3 numeric FDs |
+| DER import, modern RSA creation, private keychain create/lock, external representation and legacy ephemeral import | All reached bridge calls succeeded |
+| Move to private keychain | Bridge return **1**, OSStatus **0**; post-move certificate keychain copy returned a verified private association |
+| Post-move identity keychain copy | Bridge-normalized OSStatus **0**, **no returned keychain reference** |
+| Stop | Before identity certificate copy; its uncalled status is the `INT32_MIN` sentinel, not a native OSStatus |
+| Error-path cleanup | **9** owned CF outputs / **9** releases; logical owners **0**; verified private keychain native delete OSStatus **0**; no fallback cleanup |
+| Process and fixture | Native exit **1**, reported elapsed **1.172310 s**; both builds, seed and native process confirmed reaped; no remaining owned keychain files before collector cleanup; private task files overwritten and unlinked after reaping; root removed |
+
+Only four JSONL rows exist: before fingerprint, before checkpoint, partial
+operation 1, failure. No first/repeated/idle snapshot or after fingerprint was
+collected. The before-only default/search query succeeded; equality across the
+attempt was **not measured**. The measured child made no setter or restore call.
+No estimate of native heap growth can be drawn from its single before sample.
+
+## Why the guard did not match the installed wrapper
+
+`SafeTemporaryKeychainHandle.TrackItem` obtains a copied keychain and returns
+without adding a logical owner when the copied handle is invalid. The installed
+native bridge `AppleCryptoNative_SecKeychainItemCopyKeychain` at `0x8a04` normalizes
+`errSecNoSuchKeychain` (`-25294`) and `errSecInvalidItemRef` (`-25304`) to success;
+the receipt records the bridge result, not the underlying raw Apple status. The
+installed move wrapper validates the move result and identity handle; it does
+not require the identity's `TrackItem` to add an owner. Attempt A incorrectly
+made that association mandatory before identity certificate copy.
+
+Any separately reviewed follow-up should model ownership from actual validated
+associations: keep all nine expected native copy calls and their statuses; add a
+logical owner only when the returned keychain matches the generated private
+reference/path; record no association when it is null. Reject a disappearing
+association during Untrack of a previously tracked owner. Record the actual
+zero-owner deletion stage and which item/copy references remain alive, rather
+than requiring deletion at identity Untrack. A single partial attempt cannot
+predict the copied certificate's association or a fixed number of non-null
+copies. This correction concerns the diagnostic only, not production SDK
+ownership or certificate selection.
+
+Selected receipts and verified raw/projection hashes are in
+[`evidence/2026-11-10-native-import-attempt-a`](evidence/2026-11-10-native-import-attempt-a/verification.json).
+The unchanged raw directory is `/tmp/opcua2-native-import-20261110a`. It contains
+raw native snapshots but no retained private fixture. The native executable
+SHA-256 is `e5c5caf2a8f882f82b738396156b378fd157ebd1a825d462449cd2a0497830fd`;
+the seed DLL SHA-256 is
+`1fa7de542aee11acab18dcc8d4096b21fcbc16e4edc1fca2243159dd1176adc0`.
+This was a single serialized execution. No retry or counterfactual arm ran.