From 69dcc431ecf389f4b8d4a1bcd1d7e30d0d834b91 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 10 Nov 2026 16:51:36 -0500 Subject: [PATCH] test: record native Apple keychain negative control --- .../native-retention/PURE_APPLE.md | 95 ++++++++ .../native-retention/PureAppleControl.c | 123 +++++++++++ .../native-retention/README.md | 6 + .../actual-run-build.log | 31 +++ ...al-run-fixture-before-harness-cleanup.json | 3 + .../actual-run-fixture-cleanup.json | 3 + .../actual-run-provenance.json | 39 ++++ .../actual-run-result.json | 129 +++++++++++ .../actual-run-samples.jsonl | 207 ++++++++++++++++++ .../first-build-only-build.log | 34 +++ .../first-build-only-fixture-cleanup.json | 5 + .../first-build-only-provenance.json | 37 ++++ .../2026-11-10-pure-apple/verification.json | 21 ++ .../native-retention/pure_apple.py | 135 ++++++++++++ 14 files changed, 868 insertions(+) create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/PURE_APPLE.md create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-build.log create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-before-harness-cleanup.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-cleanup.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-provenance.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-result.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-samples.jsonl create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-build.log create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-fixture-cleanup.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-provenance.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/verification.json create mode 100644 scripts/validation/opcua-lifecycle-memory/native-retention/pure_apple.py diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/PURE_APPLE.md b/scripts/validation/opcua-lifecycle-memory/native-retention/PURE_APPLE.md new file mode 100644 index 00000000..ebe2e358 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/PURE_APPLE.md @@ -0,0 +1,95 @@ +# Native empty-keychain control — negative retention result + +The plain C control completed **200 private keychain create/delete/CFRelease +operations successfully**, with `Security::AppleDatabase` heap inventory staying +at **1 object / 768 shallow bytes** before, after the first operation, after 200, +and after a five-second idle. This **does not reproduce** the retention seen in +private-PFX and SDK configured-store loading. Empty native create/delete/release +alone is therefore insufficient to explain that result on this machine. + +This does not rule out deletion/resource interactions for populated imported +keychains, identify the retaining owner, or assign an SDK, CLR or Apple defect. +Private-key/certificate materialization and its associated native interactions +remain distinct. No production mitigation, resource-budget decision, G4 pass or +#799 closure follows from this control. + +## Reviewed execution and isolation + +Astra reviewed the actual C/Python source before execution and afterward +independently verified all 207 JSONL rows, 200 ordered operations/status triples, +reference balance, default/search-list fingerprints, all four native heap +counts/bytes, FD/file counts, source/runner/binary hashes, cleanup and warnings. +Only **one actual native execution** ran, serialized after the coordinator's other +ownership control. Source is `PureAppleControl.c`; collector is `pure_apple.py`. + +The child is a plain native C program linked only to Security.framework, +CoreFoundation.framework and libSystem. It does not load certificates/PFX, the +OPC UA SDK or CLR. `SecKeychainCreate` used a fresh random filename beneath its +private mode-0700 task root, a generated password and `promptUser=false`. A returned +keychain's path had to exactly match that generated private filename/backing file +before deletion was allowed. Each returned create reference received exactly +one `CFRelease`, including failure paths. The program made no default/search-list +setter or restore call. Read-only `SecKeychainCopyDefault`, +`SecKeychainCopySearchList` and `SecKeychainGetPath` produced hashed before/after +fingerprints; owned Copy results were released, borrowed array elements were not +released separately. Existing keychain paths/passwords were never logged. + +Native checkpoints were before, first, 200 and five-second idle. Each parent +snapshot used `heap --noContent -s` and numeric lsof FDs, with Mach task resident +bytes reported by the child. It did not invoke GC or allocator-pressure APIs. +The original fixed 180-second checkpoint/child limit, 20-second heap and +five-second lsof limits, bounded final wait and terminate/kill reap remain in the +collector; those probe/reap bounds can extend total wall time beyond 180 seconds. +Actual child monotonic duration was **8.995 seconds**; parent wall time including +probes was **9.288 seconds**. The child exited zero and was reaped. + +## Actual results + +| Checkpoint | AppleDatabase count / shallow bytes | Numeric FDs | Owned keychain files / FDs | RSS bytes | +|---|---:|---:|---:|---:| +| Before | 1 / 768 | 3 | 0 / 0 | 7,372,800 | +| First | 1 / 768 | 3 | 0 / 0 | 8,028,160 | +| 200 | 1 / 768 | 3 | 0 / 0 | 8,699,904 | +| Five-second idle | 1 / 768 | 3 | 0 / 0 | 8,699,904 | + +All **200 create/path/delete OSStatus triples were `(0, 0, 0)`**. Each create +returned an owned reference, its private path was verified, and all **200/200** +references were released exactly once. All read-only default/path/search-list +query statuses were zero. Before/after fingerprints were identical, with search +list count **2** at both observations. Four query-owned Copy references were +released across the two fingerprint collections. No list setter was invoked. + +Default fingerprint: +`08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63`. +Search-list fingerprint: +`c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c`. + +Owned keychain files were already zero before harness cleanup. The fresh owned +fixture root was then removed. Native class count is a heap classification, not +an open-handle count or an exclusive attribution of the modest RSS change. + +The first attempt stopped at **compilation**, before a native child or API call: +strict C11 headers did not declare `explicit_bzero`. Replacing only that +caller-owned buffer wipe with a volatile-byte wipe made the build succeed; empty +fixture creation was moved after successful compilation. The failed build is +retained separately. Both compile attempts emitted **five unsuppressed +deprecated-public-API warnings** for the intentionally exercised legacy keychain +APIs. This is not a zero-warning build and no warning suppression was added. + +## Evidence and reproduction + +Selected, home-path-redacted receipts are under +`evidence/2026-11-10-pure-apple/`; `verification.json` retains the unchanged local +raw receipt hashes. Actual raw output is +`/tmp/opcua2-pure-apple-20261110b`; the first compile-only failure is +`/tmp/opcua2-pure-apple-20261110a`. Raw native snapshots stay private/local. + +```sh +python3 scripts/validation/opcua-lifecycle-memory/native-retention/pure_apple.py \ + --output /tmp/opcua2-pure-apple-FRESH +``` + +The output must be fresh. Fixed counts are not configurable; all generated paths +are task-owned and no user/fleet PKI is used. This negative control refines the +[A/B directory-load findings](README.md), and does not approve another experiment, +a native workaround, a public upstream post or a long run. diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c b/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c new file mode 100644 index 00000000..b845fc4a --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c @@ -0,0 +1,123 @@ +// Diagnostic only: private SecKeychainCreate/Delete/CFRelease, with no certificate, PFX, SDK or CLR. +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define REPETITIONS 200 +static char root[PATH_MAX]; +static struct timespec started; +static unsigned created_refs, released_refs, query_releases; +static double elapsed(void) { + struct timespec now; clock_gettime(CLOCK_MONOTONIC, &now); + return (double)(now.tv_sec-started.tv_sec)+(double)(now.tv_nsec-started.tv_nsec)/1e9; +} +static void die(const char *message) { + fprintf(stdout,"{\"kind\":\"failed\",\"message\":\"%s\",\"createdRefs\":%u,\"releasedRefs\":%u,\"elapsedSeconds\":%.6f}\n",message,created_refs,released_refs,elapsed()); + fflush(stdout); exit(1); +} +static void hex(const unsigned char *bytes, size_t length, char *out) { + const char *alphabet="0123456789abcdef"; + for(size_t i=0;i>4];out[i*2+1]=alphabet[bytes[i]&15];} + out[length*2]=0; +} +static void wipe(void *memory, size_t length) { + volatile unsigned char *bytes=(volatile unsigned char *)memory; + while(length--)*bytes++=0; +} +static OSStatus keychain_path(SecKeychainRef keychain, char *path) { + UInt32 length=PATH_MAX-1; + OSStatus status=SecKeychainGetPath(keychain,&length,path); + if(status==errSecSuccess && length=sizeof(next))die("Checkpoint path overflow"); + while(access(next,F_OK)!=0){if(elapsed()>180)die("Checkpoint deadline exceeded");struct timespec pause={0,25000000};nanosleep(&pause,NULL);} +} +static int absent(const char *path){struct stat state;if(lstat(path,&state)==0)return 0;return errno==ENOENT;} +static void operation(unsigned iteration) { + unsigned char random[48];if(SecRandomCopyBytes(kSecRandomDefault,sizeof(random),random)!=errSecSuccess)die("Secure random failed"); + char suffix[33],password[65];hex(random,16,suffix);hex(random+16,32,password);wipe(random,sizeof(random)); + char path[PATH_MAX],backing[PATH_MAX];int n=snprintf(path,sizeof(path),"%s/tmp/native-retention-%s.keychain",root,suffix); + if(n<0 || (size_t)n>=sizeof(path))die("Fixture path overflow"); + n=snprintf(backing,sizeof(backing),"%s-db",path);if(n<0 || (size_t)n>=sizeof(backing))die("Fixture backing path overflow"); + if(!absent(path)||!absent(backing))die("Generated private fixture path already exists"); + SecKeychainRef keychain=NULL; + OSStatus create_status=SecKeychainCreate(path,(UInt32)strlen(password),password,false,NULL,&keychain); + wipe(password,sizeof(password)); + OSStatus path_status=errSecInvalidKeychain,delete_status=INT32_MIN; + int verified=0,released=0; + if(keychain){ + created_refs++; + char actual[PATH_MAX];memset(actual,0,sizeof(actual));path_status=keychain_path(keychain,actual); + // Only a returned reference whose path is exactly this generated private fixture can be deleted. + verified=path_status==errSecSuccess && (!strcmp(actual,path)||!strcmp(actual,backing)); + if(verified)delete_status=SecKeychainDelete(keychain); + // Exactly one CFRelease for this returned owned reference, irrespective of delete status. + CFRelease(keychain);keychain=NULL;released_refs++;released=1; + } + fprintf(stdout,"{\"kind\":\"operation\",\"iteration\":%u,\"createStatus\":%d,\"pathStatus\":%d,\"deleteStatus\":%d,\"returnedRef\":%s,\"privatePathVerified\":%s,\"releasedExactlyOnce\":%s}\n",iteration,(int)create_status,(int)path_status,(int)delete_status,released?"true":"false",verified?"true":"false",released?"true":"false");fflush(stdout); + if(create_status || path_status || delete_status || !verified || !released)die("Private keychain lifecycle operation failed"); +} +int main(int argc,char **argv) { + clock_gettime(CLOCK_MONOTONIC,&started); + if(argc!=2 || !realpath(argv[1],root))die("Expected existing private fixture root"); + struct stat state;if(stat(root,&state) || !S_ISDIR(state.st_mode) || (state.st_mode&077))die("Fixture root must be mode0700"); + struct fingerprint before=fingerprint("before");checkpoint("before",0); + for(unsigned i=1;i<=REPETITIONS;i++){operation(i);if(i==1)checkpoint("first",i);} + checkpoint("repeated",REPETITIONS); + struct timespec idle={5,0};while(nanosleep(&idle,&idle)!=0){if(errno!=EINTR)die("Idle delay failed");} + struct fingerprint after=fingerprint("after"); + checkpoint("idle",REPETITIONS); + int unchanged=!strcmp(before.default_sha,after.default_sha)&&!strcmp(before.search_sha,after.search_sha)&&before.search_count==after.search_count; + if(!unchanged || created_refs!=REPETITIONS || released_refs!=REPETITIONS)die("Fingerprint or native ownership guard failed"); + fprintf(stdout,"{\"kind\":\"complete\",\"operations\":200,\"createdRefs\":%u,\"releasedRefs\":%u,\"readOnlyDefaultAndSearchListUnchanged\":true,\"elapsedSeconds\":%.6f,\"fullSoakGate\":false}\n",created_refs,released_refs,elapsed());fflush(stdout);return 0; +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/README.md b/scripts/validation/opcua-lifecycle-memory/native-retention/README.md index 2187bbc6..71e07681 100644 --- a/scripts/validation/opcua-lifecycle-memory/native-retention/README.md +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/README.md @@ -211,3 +211,9 @@ any failed-run private fixture material must not be redistributed wholesale. No long run, deployment, trust weakening, SDK fork/version change, budget change, public upstream post or #799 closure is authorized or claimed by these results. + +A separately reviewed [plain native Apple empty-keychain control](PURE_APPLE.md) +then executed 200 successful create/delete/CFRelease operations and kept native +AppleDatabase at 1 throughout. That negative result rules out empty native +create/delete/release alone as sufficient here; it does not identify the +private-key/certificate import retaining owner. diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-build.log b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-build.log new file mode 100644 index 00000000..3f5a8175 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-build.log @@ -0,0 +1,31 @@ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:40:21: warning: 'SecKeychainGetPath' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 40 | OSStatus status=SecKeychainGetPath(keychain,&length,path); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:474:10: note: 'SecKeychainGetPath' has been explicitly marked deprecated here + 474 | OSStatus SecKeychainGetPath(SecKeychainRef __nullable keychain, UInt32 *ioPathLength, char *pathName) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:51:29: warning: 'SecKeychainCopyDefault' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 51 | OSStatus default_status=SecKeychainCopyDefault(&default_keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:384:10: note: 'SecKeychainCopyDefault' has been explicitly marked deprecated here + 384 | OSStatus SecKeychainCopyDefault(SecKeychainRef * __nonnull CF_RETURNS_RETAINED keychain) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:55:28: warning: 'SecKeychainCopySearchList' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 55 | OSStatus search_status=SecKeychainCopySearchList(&search); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:404:10: note: 'SecKeychainCopySearchList' has been explicitly marked deprecated here + 404 | OSStatus SecKeychainCopySearchList(CFArrayRef * __nonnull CF_RETURNS_RETAINED searchList) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:94:28: warning: 'SecKeychainCreate' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 94 | OSStatus create_status=SecKeychainCreate(path,(UInt32)strlen(password),password,false,NULL,&keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:309:10: note: 'SecKeychainCreate' has been explicitly marked deprecated here + 309 | OSStatus SecKeychainCreate(const char *pathName, UInt32 passwordLength, const void * __nullable password, Boolean promptUser, SecAccessRef __nullable initialAccess, SecKeychainRef * __nonnull CF_RETURNS_RETAINED keychain) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:103:35: warning: 'SecKeychainDelete' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 103 | if(verified)delete_status=SecKeychainDelete(keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:319:10: note: 'SecKeychainDelete' has been explicitly marked deprecated here + 319 | OSStatus SecKeychainDelete(SecKeychainRef __nullable keychainOrArray) + | ^ +5 warnings generated. diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-before-harness-cleanup.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-before-harness-cleanup.json new file mode 100644 index 00000000..f63b95c8 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-before-harness-cleanup.json @@ -0,0 +1,3 @@ +{ + "remainingOwnedKeychainFiles": 0 +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-cleanup.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-cleanup.json new file mode 100644 index 00000000..6cfc926d --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-fixture-cleanup.json @@ -0,0 +1,3 @@ +{ + "ownedFixtureRootRemoved": true +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-provenance.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-provenance.json new file mode 100644 index 00000000..f7dab04a --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-provenance.json @@ -0,0 +1,39 @@ +{ + "sourceSha256": "78354b154778fa61a7fe67fdef3fab6ea04ac5bdf2ae8190a2e7414781e1397d", + "runnerSourceSha256": "1b2148f1c20578529355379ab94b439931d7241608a5d5effce8fc86f4af7bc6", + "compileCommand": [ + "clang", + "-std=c11", + "-O0", + "-g", + "-Wall", + "-Wextra", + "/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c", + "-framework", + "Security", + "-framework", + "CoreFoundation", + "-o", + "/private/tmp/opcua2-pure-apple-20261110b/PureAppleControl" + ], + "compiler": "Apple clang version 21.0.0 (clang-2100.0.123.102)\nTarget: arm64-apple-darwin25.5.0\nThread model: posix\nInstalledDir: /Library/Developer/CommandLineTools/usr/bin\n", + "os": "ProductName:\t\tmacOS\nProductVersion:\t\t26.5.2\nBuildVersion:\t\t25F84\n", + "architecture": "arm64", + "repetitions": 200, + "idleSeconds": 5, + "stages": [ + "before", + "first", + "repeated", + "idle" + ], + "fullSoakGate": false, + "readOnlyKeychainQueries": [ + "SecKeychainCopyDefault", + "SecKeychainCopySearchList", + "SecKeychainGetPath" + ], + "doesNotCallAnyDefaultOrSearchListSetter": true, + "binarySha256": "6c87f4394c0e51bcf26f27187628d0a867feacf9b8c7a20fb94ab42baeb1d087", + "linkedLibraries": "/private/tmp/opcua2-pure-apple-20261110b/PureAppleControl:\n\t/System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 61901.101.4)\n\t/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 4424.1.255)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0)\n" +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-result.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-result.json new file mode 100644 index 00000000..499bab10 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-result.json @@ -0,0 +1,129 @@ +{ + "status": "passed", + "exitCode": 0, + "wallSecondsIncludingProbes": 9.287588333012536, + "samples": [ + { + "kind": "checkpoint", + "mode": "pure-apple", + "stage": "before", + "operations": 0, + "processId": 93020, + "utc": "2026-11-10T21:47:09.322Z", + "elapsedSeconds": 0.004359, + "rssBytes": 7372800, + "createdRefs": 0, + "releasedRefs": 0, + "managedRuntimePresent": false, + "AppleDatabaseCount": 1, + "AppleDatabaseShallowBytes": 768, + "AppleDatabaseClassAbsent": false, + "databaseManagerClassPresent": true, + "fdCount": 3, + "ownedTemporaryFdCount": 0, + "ownedKeychainFdCount": 0, + "ownedKeychainFileCount": 0 + }, + { + "kind": "checkpoint", + "mode": "pure-apple", + "stage": "first", + "operations": 1, + "processId": 93020, + "utc": "2026-11-10T21:47:10.311Z", + "elapsedSeconds": 0.993379, + "rssBytes": 8028160, + "createdRefs": 1, + "releasedRefs": 1, + "managedRuntimePresent": false, + "AppleDatabaseCount": 1, + "AppleDatabaseShallowBytes": 768, + "AppleDatabaseClassAbsent": false, + "databaseManagerClassPresent": true, + "fdCount": 3, + "ownedTemporaryFdCount": 0, + "ownedKeychainFdCount": 0, + "ownedKeychainFileCount": 0 + }, + { + "kind": "checkpoint", + "mode": "pure-apple", + "stage": "repeated", + "operations": 200, + "processId": 93020, + "utc": "2026-11-10T21:47:11.859Z", + "elapsedSeconds": 2.541567, + "rssBytes": 8699904, + "createdRefs": 200, + "releasedRefs": 200, + "managedRuntimePresent": false, + "AppleDatabaseCount": 1, + "AppleDatabaseShallowBytes": 768, + "AppleDatabaseClassAbsent": false, + "databaseManagerClassPresent": true, + "fdCount": 3, + "ownedTemporaryFdCount": 0, + "ownedKeychainFdCount": 0, + "ownedKeychainFileCount": 0 + }, + { + "kind": "checkpoint", + "mode": "pure-apple", + "stage": "idle", + "operations": 200, + "processId": 93020, + "utc": "2026-11-10T21:47:17.582Z", + "elapsedSeconds": 8.264326, + "rssBytes": 8699904, + "createdRefs": 200, + "releasedRefs": 200, + "managedRuntimePresent": false, + "AppleDatabaseCount": 1, + "AppleDatabaseShallowBytes": 768, + "AppleDatabaseClassAbsent": false, + "databaseManagerClassPresent": true, + "fdCount": 3, + "ownedTemporaryFdCount": 0, + "ownedKeychainFdCount": 0, + "ownedKeychainFileCount": 0 + } + ], + "fingerprints": [ + { + "kind": "fingerprint", + "stage": "before", + "defaultStatus": 0, + "defaultPathStatus": 0, + "searchStatus": 0, + "searchPathStatus": 0, + "defaultSha256": "08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63", + "searchSha256": "c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c", + "searchCount": 2, + "ownedQueryReferencesReleased": 2 + }, + { + "kind": "fingerprint", + "stage": "after", + "defaultStatus": 0, + "defaultPathStatus": 0, + "searchStatus": 0, + "searchPathStatus": 0, + "defaultSha256": "08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63", + "searchSha256": "c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c", + "searchCount": 2, + "ownedQueryReferencesReleased": 4 + } + ], + "complete": { + "kind": "complete", + "operations": 200, + "createdRefs": 200, + "releasedRefs": 200, + "readOnlyDefaultAndSearchListUnchanged": true, + "elapsedSeconds": 8.994713, + "fullSoakGate": false + }, + "fullSoakGate": false, + "nativeInventoryIsNotOpenHandlesOrExclusiveRss": true, + "nativeDeleteOsStatusesAllZero": true +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-samples.jsonl b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-samples.jsonl new file mode 100644 index 00000000..4a9a2b4a --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/actual-run-samples.jsonl @@ -0,0 +1,207 @@ +{"kind":"fingerprint","stage":"before","defaultStatus":0,"defaultPathStatus":0,"searchStatus":0,"searchPathStatus":0,"defaultSha256":"08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63","searchSha256":"c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c","searchCount":2,"ownedQueryReferencesReleased":2} +{"kind":"checkpoint","mode":"pure-apple","stage":"before","operations":0,"processId":93020,"utc":"2026-11-10T21:47:09.322Z","elapsedSeconds":0.004359,"rssBytes":7372800,"createdRefs":0,"releasedRefs":0,"managedRuntimePresent":false} +{"kind":"operation","iteration":1,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"checkpoint","mode":"pure-apple","stage":"first","operations":1,"processId":93020,"utc":"2026-11-10T21:47:10.311Z","elapsedSeconds":0.993379,"rssBytes":8028160,"createdRefs":1,"releasedRefs":1,"managedRuntimePresent":false} +{"kind":"operation","iteration":2,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":3,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":4,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":5,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":6,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":7,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":8,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":9,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":10,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":11,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":12,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":13,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":14,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":15,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":16,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":17,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":18,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":19,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":20,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":21,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":22,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":23,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":24,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":25,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":26,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":27,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":28,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":29,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":30,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":31,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":32,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":33,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":34,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":35,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":36,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":37,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":38,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":39,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":40,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":41,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":42,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":43,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":44,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":45,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":46,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":47,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":48,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":49,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":50,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":51,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":52,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":53,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":54,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":55,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":56,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":57,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":58,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":59,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":60,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":61,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":62,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":63,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":64,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":65,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":66,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":67,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":68,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":69,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":70,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":71,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":72,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":73,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":74,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":75,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":76,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":77,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":78,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":79,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":80,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":81,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":82,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":83,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":84,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":85,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":86,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":87,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":88,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":89,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":90,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":91,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":92,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":93,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":94,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":95,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":96,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":97,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":98,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":99,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":100,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":101,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":102,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":103,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":104,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":105,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":106,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":107,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":108,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":109,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":110,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":111,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":112,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":113,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":114,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":115,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":116,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":117,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":118,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":119,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":120,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":121,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":122,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":123,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":124,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":125,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":126,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":127,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":128,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":129,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":130,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":131,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":132,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":133,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":134,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":135,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":136,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":137,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":138,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":139,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":140,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":141,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":142,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":143,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":144,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":145,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":146,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":147,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":148,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":149,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":150,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":151,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":152,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":153,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":154,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":155,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":156,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":157,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":158,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":159,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":160,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":161,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":162,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":163,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":164,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":165,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":166,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":167,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":168,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":169,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":170,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":171,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":172,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":173,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":174,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":175,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":176,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":177,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":178,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":179,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":180,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":181,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":182,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":183,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":184,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":185,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":186,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":187,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":188,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":189,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":190,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":191,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":192,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":193,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":194,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":195,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":196,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":197,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":198,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":199,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"operation","iteration":200,"createStatus":0,"pathStatus":0,"deleteStatus":0,"returnedRef":true,"privatePathVerified":true,"releasedExactlyOnce":true} +{"kind":"checkpoint","mode":"pure-apple","stage":"repeated","operations":200,"processId":93020,"utc":"2026-11-10T21:47:11.859Z","elapsedSeconds":2.541567,"rssBytes":8699904,"createdRefs":200,"releasedRefs":200,"managedRuntimePresent":false} +{"kind":"fingerprint","stage":"after","defaultStatus":0,"defaultPathStatus":0,"searchStatus":0,"searchPathStatus":0,"defaultSha256":"08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63","searchSha256":"c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c","searchCount":2,"ownedQueryReferencesReleased":4} +{"kind":"checkpoint","mode":"pure-apple","stage":"idle","operations":200,"processId":93020,"utc":"2026-11-10T21:47:17.582Z","elapsedSeconds":8.264326,"rssBytes":8699904,"createdRefs":200,"releasedRefs":200,"managedRuntimePresent":false} +{"kind":"complete","operations":200,"createdRefs":200,"releasedRefs":200,"readOnlyDefaultAndSearchListUnchanged":true,"elapsedSeconds":8.994713,"fullSoakGate":false} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-build.log b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-build.log new file mode 100644 index 00000000..1d6f98fd --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-build.log @@ -0,0 +1,34 @@ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:36:21: warning: 'SecKeychainGetPath' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 36 | OSStatus status=SecKeychainGetPath(keychain,&length,path); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:474:10: note: 'SecKeychainGetPath' has been explicitly marked deprecated here + 474 | OSStatus SecKeychainGetPath(SecKeychainRef __nullable keychain, UInt32 *ioPathLength, char *pathName) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:47:29: warning: 'SecKeychainCopyDefault' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 47 | OSStatus default_status=SecKeychainCopyDefault(&default_keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:384:10: note: 'SecKeychainCopyDefault' has been explicitly marked deprecated here + 384 | OSStatus SecKeychainCopyDefault(SecKeychainRef * __nonnull CF_RETURNS_RETAINED keychain) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:51:28: warning: 'SecKeychainCopySearchList' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 51 | OSStatus search_status=SecKeychainCopySearchList(&search); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:404:10: note: 'SecKeychainCopySearchList' has been explicitly marked deprecated here + 404 | OSStatus SecKeychainCopySearchList(CFArrayRef * __nonnull CF_RETURNS_RETAINED searchList) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:84:83: error: call to undeclared function 'explicit_bzero'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] + 84 | char suffix[33],password[65];hex(random,16,suffix);hex(random+16,32,password);explicit_bzero(random,sizeof(random)); + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:90:28: warning: 'SecKeychainCreate' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 90 | OSStatus create_status=SecKeychainCreate(path,(UInt32)strlen(password),password,false,NULL,&keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:309:10: note: 'SecKeychainCreate' has been explicitly marked deprecated here + 309 | OSStatus SecKeychainCreate(const char *pathName, UInt32 passwordLength, const void * __nullable password, Boolean promptUser, SecAccessRef __nullable initialAccess, SecKeychainRef * __nonnull CF_RETURNS_RETAINED keychain) + | ^ +/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c:99:35: warning: 'SecKeychainDelete' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations] + 99 | if(verified)delete_status=SecKeychainDelete(keychain); + | ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:319:10: note: 'SecKeychainDelete' has been explicitly marked deprecated here + 319 | OSStatus SecKeychainDelete(SecKeychainRef __nullable keychainOrArray) + | ^ +5 warnings and 1 error generated. diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-fixture-cleanup.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-fixture-cleanup.json new file mode 100644 index 00000000..44556aad --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-fixture-cleanup.json @@ -0,0 +1,5 @@ +{ + "compileExitCode": 1, + "nativeProcessNeverStarted": true, + "emptyOwnedFixtureRootRemoved": true +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-provenance.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-provenance.json new file mode 100644 index 00000000..01ae6db8 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/first-build-only-provenance.json @@ -0,0 +1,37 @@ +{ + "sourceSha256": "f3d5b393f4bfcb350b37d610a8b6602b480e573e632f697b311813df276be347", + "runnerSourceSha256": "22f0ee93b2998f1cb337aa5f763dcf578b2efe4616502ad095a309cc774c3c76", + "compileCommand": [ + "clang", + "-std=c11", + "-O0", + "-g", + "-Wall", + "-Wextra", + "/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/PureAppleControl.c", + "-framework", + "Security", + "-framework", + "CoreFoundation", + "-o", + "/private/tmp/opcua2-pure-apple-20261110a/PureAppleControl" + ], + "compiler": "Apple clang version 21.0.0 (clang-2100.0.123.102)\nTarget: arm64-apple-darwin25.5.0\nThread model: posix\nInstalledDir: /Library/Developer/CommandLineTools/usr/bin\n", + "os": "ProductName:\t\tmacOS\nProductVersion:\t\t26.5.2\nBuildVersion:\t\t25F84\n", + "architecture": "arm64", + "repetitions": 200, + "idleSeconds": 5, + "stages": [ + "before", + "first", + "repeated", + "idle" + ], + "fullSoakGate": false, + "readOnlyKeychainQueries": [ + "SecKeychainCopyDefault", + "SecKeychainCopySearchList", + "SecKeychainGetPath" + ], + "doesNotCallAnyDefaultOrSearchListSetter": true +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/verification.json b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/verification.json new file mode 100644 index 00000000..c347a1ac --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-pure-apple/verification.json @@ -0,0 +1,21 @@ +{ + "actualNativeExecutions": 1, + "earlierAttemptWasCompileOnly": true, + "rawActualOutput": "/tmp/opcua2-pure-apple-20261110b", + "rawCompileOnlyOutput": "/tmp/opcua2-pure-apple-20261110a", + "rawSha256": { + "actual-run-result.json": "70b7f3c57a5d14baf9cc593c16670da85adcb525e5f60bb419c8f0f01e206347", + "actual-run-provenance.json": "aa181c0213588aede6d20888ede49ef2a74bb409c075d90a6bad214cfbdac29f", + "actual-run-samples.jsonl": "4ebb9870e0e66d1a217ce489058a1658b0be71a5928115bbf347478bc1e6066a", + "actual-run-build.log": "786ee9f813146b634d814e1cdb8f35fe1d9ef88a9ea96265bc3ffdafe4c61b6e", + "actual-run-fixture-before-harness-cleanup.json": "eaaf36a5e7f7d1d3635e987d8f9a2600ce55f6482011ec9a7abf3e4dd759d9c4", + "actual-run-fixture-cleanup.json": "1785d6ee67b2f7e77037a469ca2bdb9b07c8892781ea830a985f6ef505f84d69", + "first-build-only-build.log": "ebaa2a34424167053a50f410ee04c6ed0988566c5c68e7c2473a55579baf1818", + "first-build-only-provenance.json": "7236bb169732e2fe03d78af2691be3d41632bf1e9a79902ae74aa0ed4c6a539b", + "first-build-only-fixture-cleanup.json": "e5551f93e5a2d898cf35b59f775ef8b6fecc06c673680cf8486019e73b44866f" + }, + "redaction": "Selected text replaces only the local home prefix; raw receipts were not modified.", + "review": "Astra independently verified all207 rows,200 ordered operations/status triples, reference balance, fingerprints, all4 native counts/bytes, FD/file counts, hashes, cleanup and5 unsuppressed warnings.", + "retentionReproducedByEmptyNativeLifecycle": false, + "fullSoakGate": false +} diff --git a/scripts/validation/opcua-lifecycle-memory/native-retention/pure_apple.py b/scripts/validation/opcua-lifecycle-memory/native-retention/pure_apple.py new file mode 100644 index 00000000..37ff1571 --- /dev/null +++ b/scripts/validation/opcua-lifecycle-memory/native-retention/pure_apple.py @@ -0,0 +1,135 @@ +#!/usr/bin/env python3 +"""Bounded, attribution-only native Apple keychain lifecycle, without PFX/SDK/CLR.""" +import argparse +import hashlib +import json +import os +from pathlib import Path +import re +import shutil +import subprocess +import sys +import time + +HERE = Path(__file__).resolve().parent +STAGES = ['before', 'first', 'repeated', 'idle'] + + +def save(path, value): + path.write_text(json.dumps(value, indent=2) + '\n') + + +def complete_rows(path): + return [json.loads(line) for line in path.read_text().split('\n')[:-1]] + + +def snapshot(pid, task, output, stage): + heap = subprocess.run(['/usr/bin/heap', '--noContent', '-s', str(pid)], text=True, stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, timeout=20, check=True) + (output / ('heap-' + stage + '.txt')).write_text(heap.stdout) + database = re.search(r'^\s*(\d+)\s+(\d+)\s+[\d.]+\s+Security::AppleDatabase\s', heap.stdout, re.MULTILINE) + manager = re.search(r'^\s*(\d+)\s+(\d+)\s+[\d.]+\s+Security::AppleDatabaseManager\s', heap.stdout, re.MULTILINE) + if database is None and manager is None: + raise RuntimeError('Native inventory could not classify the database or its manager; do not silently infer zero') + descriptors = subprocess.run(['/usr/sbin/lsof', '-a', '-p', str(pid), '-Fnf'], text=True, + stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=5, check=True) + (output / ('lsof-' + stage + '.txt')).write_text(descriptors.stdout) + total = temp = keychain = 0 + in_descriptor = False + for line in descriptors.stdout.splitlines(): + if line.startswith('f'): + in_descriptor = len(line) > 1 and line[1].isdigit() + total += int(in_descriptor) + elif in_descriptor and line.startswith('n/'): + path = Path(line[1:].removesuffix(' (deleted)')).resolve() + owned = path == task / 'tmp' or task / 'tmp' in path.parents + temp += int(owned) + keychain += int(owned and '.keychain' in path.name) + return {'AppleDatabaseCount': int(database[1]) if database else 0, + 'AppleDatabaseShallowBytes': int(database[2]) if database else 0, + 'AppleDatabaseClassAbsent': database is None, + 'databaseManagerClassPresent': manager is not None, 'fdCount': total, + 'ownedTemporaryFdCount': temp, 'ownedKeychainFdCount': keychain, + 'ownedKeychainFileCount': sum(p.is_file() and '.keychain' in p.name for p in (task / 'tmp').rglob('*'))} + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--output', required=True, type=Path, help='Fresh private output directory') + options = parser.parse_args() + if sys.platform != 'darwin': + parser.error('Native control requires macOS') + output = options.output.resolve() + output.mkdir(parents=True, exist_ok=False) + os.chmod(output, 0o700) + task = output / 'task' + binary = output / 'PureAppleControl' + command = ['clang', '-std=c11', '-O0', '-g', '-Wall', '-Wextra', str(HERE / 'PureAppleControl.c'), + '-framework', 'Security', '-framework', 'CoreFoundation', '-o', str(binary)] + source_hash = hashlib.sha256((HERE / 'PureAppleControl.c').read_bytes()).hexdigest() + provenance = {'sourceSha256': source_hash, 'runnerSourceSha256': hashlib.sha256((HERE / 'pure_apple.py').read_bytes()).hexdigest(), 'compileCommand': command, + 'compiler': subprocess.check_output(['clang', '--version'], text=True), + 'os': subprocess.check_output(['sw_vers'], text=True), 'architecture': os.uname().machine, + 'repetitions': 200, 'idleSeconds': 5, 'stages': STAGES, 'fullSoakGate': False, + 'readOnlyKeychainQueries': ['SecKeychainCopyDefault', 'SecKeychainCopySearchList', 'SecKeychainGetPath'], + 'doesNotCallAnyDefaultOrSearchListSetter': True} + save(output / 'provenance.json', provenance) + with (output / 'build.log').open('w') as log: + subprocess.run(command, stdout=log, stderr=subprocess.STDOUT, timeout=60, check=True) + provenance['binarySha256'] = hashlib.sha256(binary.read_bytes()).hexdigest() + provenance['linkedLibraries'] = subprocess.check_output(['otool', '-L', str(binary)], text=True) + if 'libcoreclr' in provenance['linkedLibraries'] or 'Opc.Ua' in provenance['linkedLibraries']: + raise RuntimeError('Pure Apple control must not load SDK or CLR') + save(output / 'provenance.json', provenance) + task.mkdir(mode=0o700) + (task / 'tmp').mkdir(mode=0o700) + started = time.monotonic() + with (output / 'samples.jsonl').open('w') as log: + process = subprocess.Popen([str(binary), str(task)], stdout=log, stderr=subprocess.STDOUT, + env=dict(os.environ, TMPDIR=str(task / 'tmp'))) + try: + deadline = time.monotonic() + 180 + samples = [] + for stage in STAGES: + while True: + rows = complete_rows(output / 'samples.jsonl') + if any(row['kind'] == 'failed' for row in rows): + raise RuntimeError('Native control failed; preserve raw status rows') + checkpoints = [row for row in rows if row.get('stage') == stage and row['kind'] == 'checkpoint'] + if checkpoints: + samples.append({**checkpoints[0], **snapshot(process.pid, task, output, stage)}) + (task / ('continue-' + stage)).touch() + break + if process.poll() is not None or time.monotonic() >= deadline: + raise RuntimeError('Native checkpoint exceeded bound: ' + stage) + time.sleep(.05) + status = process.wait(timeout=15) + rows = complete_rows(output / 'samples.jsonl') + operations = [r for r in rows if r['kind'] == 'operation'] + fingerprints = [r for r in rows if r['kind'] == 'fingerprint'] + complete = [r for r in rows if r['kind'] == 'complete'] + if status or len(operations) != 200 or len(fingerprints) != 2 or len(complete) != 1: + raise RuntimeError('Incomplete native execution count') + if any(r['createStatus'] or r['deleteStatus'] or not r['privatePathVerified'] or not r['releasedExactlyOnce'] for r in operations): + raise RuntimeError('Native lifecycle status/ownership failed') + if any(samples[-1][k] for k in ['ownedKeychainFdCount', 'ownedKeychainFileCount']): + raise RuntimeError('Private native keychain files/descriptors retained') + result = {'status': 'passed', 'exitCode': status, 'wallSecondsIncludingProbes': time.monotonic() - started, + 'samples': samples, 'fingerprints': fingerprints, 'complete': complete[0], 'fullSoakGate': False, + 'nativeInventoryIsNotOpenHandlesOrExclusiveRss': True, 'nativeDeleteOsStatusesAllZero': True} + save(output / 'result.json', result) + finally: + if process.poll() is None: + process.terminate() + try: + process.wait(timeout=10) + except subprocess.TimeoutExpired: + process.kill(); process.wait(timeout=5) + save(output / 'fixture-before-harness-cleanup.json', {'remainingOwnedKeychainFiles': sum(p.is_file() and '.keychain' in p.name for p in (task / 'tmp').rglob('*'))}) + shutil.rmtree(task) + save(output / 'fixture-cleanup.json', {'ownedFixtureRootRemoved': not task.exists()}) + print(output) + + +if __name__ == '__main__': + main()