diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index d49a0bb..74252af 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -1850,6 +1850,31 @@ ordered, individually-gated execution list is in D-139's final section. **UNVERIFIED AND OWED BEFORE THE CARVE RUNS: the deployed jammy image's own `/etc/gai.conf`**, which can override the RFC 6724 default table that ruling B's deciding reason rests on. + **>>> D-139 RULING B's DECIDING REASON IS REFUTED BY MEASUREMENT 2026-08-01. THE RULING IS + FLAGGED FOR OPERATOR RECONSIDERATION, NOT AMENDED. <<<** Capture + `docs/audit/gai-conf-rfc6724-verification-20260801.txt`. The ruling was recorded with an + UNVERIFIED premise explicitly named as owed -- the deployed image's `/etc/gai.conf` -- and + closing it inverted the argument. **MEASURED, two steps.** (1) jammy's `libc-bin` + **2.35-0ubuntu3** ships `/etc/gai.conf` with **ZERO active lines** (every line commented), + so the image applies NO override and glibc's COMPILED-IN table governs. (2) glibc 2.35's + `default_precedence[]`, read in full from sourceware at tag `glibc-2.35` rather than cited + from memory, carries glibc's own comment **"See RFC 3484 for the details"** and is: + `::1/128 -> 50`, `2002::/16 -> 30`, `::/96 -> 20`, `::ffff:0:0/96 -> 10`, `::/0 -> 40`. + **THERE IS NO `fc00::/7` ENTRY IN THE PRECEDENCE TABLE** -- ULA falls through to `::/0` = 40, + exactly as GUA does. The `fc00::/7` entry that exists is in `default_labels[]` (label 6), + which drives SOURCE-selection rules 5/6, a DIFFERENT mechanism from destination precedence. + **CONSEQUENCE ON THE NODE IMAGE: ULA = 40, GUA = 40, IPv4-mapped = 10 -- ULA and GUA are + EQUAL and BOTH outrank IPv4.** D-139 ruling B was declared on "ULA loses to IPv4 (3 vs 35), + GUA wins (40 vs 35)", which is the **RFC 6724** table; RFC 6724 obsoletes RFC 3484 and does + define those values, but **glibc 2.35 does not implement it**. The claim is right about the + RFC and WRONG about the software this cloud runs -- the same + citation-content-versus-existence class this repo already has two scars from, caught this + time by opening the source. **WHAT SURVIVES:** conformance with Willamette (a REAL site) and + VR0 DC0, both full GUA; and MINIMIZE DELTA TO ROOSEVELT, whose `2602:f3e2:103::/48` is GUA + with no ULA and no plane carve yet. Those are the governing-constraint arguments and are + independent of the refuted one, so **the ruling may well stand on them -- but that is the + operator's call under GA-R5**, since they answered a question whose stated deciding reason + no longer holds. Nothing of D-139 has been executed, so nothing is half-built either way. - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal Roosevelt deployment (D-100, `docs/design-decisions.md:1946`). diff --git a/docs/audit/gai-conf-rfc6724-verification-20260801.txt b/docs/audit/gai-conf-rfc6724-verification-20260801.txt new file mode 100644 index 0000000..cfc2451 --- /dev/null +++ b/docs/audit/gai-conf-rfc6724-verification-20260801.txt @@ -0,0 +1,74 @@ +gai-conf-rfc6724-verification-20260801.txt +========================================== +READ-ONLY verification of the one premise D-139 ruling B was declared on: +that RFC 6724's default precedence table governs address selection on the +deployed node image. Host: vcloud. No cloud mutation. Nothing installed. + +RESULT: THE PREMISE IS REFUTED FOR THIS DEPLOYMENT. Details below. + +STEP 1 -- which package ships /etc/gai.conf, and does the image override it? + $ dpkg -S /etc/gai.conf -> libc-bin: /etc/gai.conf + jammy libc-bin version: 2.35-0ubuntu3 + pool/main/g/glibc/libc-bin_2.35-0ubuntu3_amd64.deb, /etc/gai.conf = 2584 bytes + ACTIVE (uncommented, non-blank) lines in the SHIPPED jammy file: 0 + => the image applies NO override; glibc's COMPILED-IN table governs. + (vcloud/noble also measured: 0 active lines.) + +STEP 2 -- what IS glibc 2.35's compiled-in table? +Source: sourceware.org glibc.git, tag glibc-2.35, sysdeps/posix/getaddrinfo.c +(fetched and read in full, 65016 bytes -- not cited from memory). + + static const struct prefixentry default_precedence[] = + { + /* See RFC 3484 for the details. */ <-- glibc's OWN comment + ::1/128 -> 50 + 2002::/16 -> 30 + ::/96 -> 20 + ::ffff:0:0/96 -> 10 <-- IPv4-mapped + ::/0 -> 40 <-- catch-all + }; + + THERE IS NO fc00::/7 ENTRY IN THE PRECEDENCE TABLE. + ULA therefore falls through to ::/0 = 40, exactly as GUA does. + + The fc00::/7 entry that DOES exist is in default_labels[] (label 6), beside + fec0::/10 (5) and 2001::/32 (7), under glibc's comment "The next two entries + differ from RFC 3484." Labels drive SOURCE-selection rules 5/6 (prefer a + matching label), NOT destination precedence. So ULA<->ULA source pairing is + correct; that is a different mechanism from the one the ruling cited. + +STEP 3 -- consequence, stated plainly. + + ON glibc 2.35 (jammy, the node image): + ULA = 40 GUA = 40 IPv4-mapped = 10 + => ULA and GUA are EQUAL, and BOTH outrank IPv4. + + D-139 ruling B was declared on: "RFC 6724 ranks IPv4-mapped at 35 and ULA at + 3 while GUA falls under ::/0 at 40, so on a dual-stack plane a ULA leg LOSES + address selection to IPv4 and is decorative, whereas GUA WINS." + That is the RFC 6724 table. RFC 6724 obsoletes RFC 3484 and does introduce + those values -- but GLIBC 2.35 DOES NOT IMPLEMENT IT. The claim is correct + about the RFC and WRONG about the software this cloud runs. + + => The stated DECIDING REASON for full GUA does not hold here. + +STEP 4 -- what survives, and what does not. + + REFUTED (1) the RFC 6724 precedence argument. + STANDS (2) conformance with Willamette (a REAL site) and VR0 DC0, both of + which carve GUA on every plane. + STANDS (3) minimize delta to Roosevelt -- the governing project constraint. + Roosevelt holds 2602:f3e2:103::/48, GUA, no ULA, and no plane + carve yet, so whatever VR1 proves it inherits. + STANDS (4) isolation is unaffected either way -- containment is at the + FORWARDING layer (SEC-010, D-125, D-107), not addressing scope. + + Reasons 2 and 3 are the governing-constraint arguments and are independent of + the refuted one. The ruling MAY well stand on them. THAT IS THE OPERATOR'S + CALL, NOT MINE (GA-R5): the operator answered a question whose stated + deciding reason has since been refuted, so the ruling is FLAGGED FOR + RECONSIDERATION rather than silently amended or silently kept. + + NOT ARGUED EITHER WAY HERE, because it is now the honest state: with the + precedence argument gone, ULA and GUA are equivalent for selection behaviour + on jammy, so the choice rests purely on conformance and Roosevelt delta. diff --git a/docs/changelog-20260731-snap-proxy-apply-ipv6.md b/docs/changelog-20260731-snap-proxy-apply-ipv6.md index 3471053..06f423e 100644 --- a/docs/changelog-20260731-snap-proxy-apply-ipv6.md +++ b/docs/changelog-20260731-snap-proxy-apply-ipv6.md @@ -369,3 +369,62 @@ Not a permission-harness refusal and NOT retried in an altered shape. **This blocks the next phase**, which is `add-model` + spaces + `deploy` under D-138 (cloud-facing clients run from INSIDE the DC). Owed before that phase starts. + +--- + +## Item 10 -- D-139 RULING B's DECIDING REASON IS REFUTED. Ruling FLAGGED, not amended. + +**What.** `docs/audit/gai-conf-rfc6724-verification-20260801.txt` (NEW) + +`docs/CURRENT-STATE.md`. No script, no cloud change, and **no edit to D-139 itself**. + +**Why it was checked at all.** D-139 ruling B was recorded WITH its own unverified premise +named in the entry: "UNVERIFIED and owed before the carve is executed: the deployed jammy +image's own `/etc/gai.conf`, which can override the RFC 6724 default table that ruling B's +deciding reason rests on." Closing that owed item is what produced this. **The discipline of +naming an unverified premise at ruling time is the only reason this was caught before the +carve rather than after it.** + +**MEASURED, in two steps, neither inferred.** +1. jammy's `libc-bin` **2.35-0ubuntu3** ships `/etc/gai.conf` with **ZERO active lines** -- + every line commented. So the node image applies NO override and glibc's compiled-in table + governs. (noble/vcloud measured identically.) +2. glibc 2.35's `default_precedence[]`, fetched in full from sourceware at tag `glibc-2.35` + and read rather than recalled, carries glibc's OWN comment `/* See RFC 3484 for the + details. */` and is: `::1/128 -> 50`, `2002::/16 -> 30`, `::/96 -> 20`, + `::ffff:0:0/96 -> 10`, `::/0 -> 40`. **There is NO `fc00::/7` entry.** + +**THE INVERSION.** ULA has no precedence entry, so it falls through to `::/0` = **40** -- +identical to GUA. IPv4-mapped is **10**. So on the node image **ULA = GUA = 40, both +outranking IPv4 = 10**. Ruling B was declared on "ULA loses to IPv4 (3 vs 35), GUA wins (40 +vs 35)" -- the **RFC 6724** table. RFC 6724 obsoletes RFC 3484 and does define those values; +**glibc 2.35 does not implement it.** The claim is correct about the RFC and wrong about the +software this cloud runs. + +**The `fc00::/7` entry that DOES exist is in `default_labels[]` (label 6)**, beside +`fec0::/10` (5) and `2001::/32` (7), under glibc's comment "The next two entries differ from +RFC 3484". Labels drive SOURCE-selection rules 5/6 -- a different mechanism from destination +precedence, and not what the ruling cited. Recorded so the two are not later conflated into +"glibc does handle ULA specially, so the argument stands". + +**This is the citation class again, third instance.** A citation is an EXISTENCE claim; only +its CONTENT is evidence -- and here the citation (RFC 6724) was real, current and correctly +quoted, yet still wrong for this deployment because **nobody had checked whether the +implementation follows the RFC**. That is a NEW variant worth naming: it is not enough to +open the source and check its status and dates; for a standards citation you must also check +that the software actually implements it. + +**WHAT SURVIVES, and why the ruling is not simply withdrawn.** Three of ruling B's four +reasons are untouched: conformance with Willamette (a REAL site) and VR0 DC0, both full GUA; +MINIMIZE DELTA TO ROOSEVELT, whose `2602:f3e2:103::/48` is GUA with no ULA and no plane carve +yet; and isolation being unaffected either way because containment lives at the FORWARDING +layer. Those are the governing-constraint arguments and are independent of the refuted one. + +**FLAGGED, NOT AMENDED, and this is deliberate.** GA-R5 makes a ruling the operator's. They +answered a question whose stated DECIDING reason no longer holds, so the honest action is to +put the refutation back to them -- not to silently keep the ruling because I still like the +answer, and not to silently reverse it. D-139's text is UNCHANGED; CURRENT-STATE carries the +refutation and the flag. **Nothing of D-139 is executed, so nothing is half-built in either +direction and the reconsideration costs nothing but the exchange.** + +**Revert.** `git rm docs/audit/gai-conf-rfc6724-verification-20260801.txt` and drop the +CURRENT-STATE paragraph. Note that reverting does not un-refute the measurement.