Lane SB (2026-10-22): the twin, security and proof items of the stinky list
The owner said "do them all". Lane SB took the twin, security and proof rows. Each row below has its own branch with a RED commit and then a GREEN commit, merged --no-ff to main. The tests ran on dwarf in nordisk-cargo-toolchain:live, one cargo job at a time.
| # | item | status | what changed | proof |
| 34 | A twin starts the job workers | DONE | JobQueue::follow_role: on a twin the queue starts no worker and admits no job (holger-twin-20). A primary that is elected a twin live stands its workers down on every road (TwinPosture::on_become_twin), and the inbox and intel timers queue nothing. |
jobs::tests::a_twin_starts_no_job_workers_and_admits_no_job |
| 36 | The role comes from the environment or the RON | DONE | HOLGER_ROLE, HOLGER_PRIMARY, HOLGER_TWIN_POLL_SECONDS and a config role: key are refused by name (holger-twin-21). The role is the pairing's election (holger-role.ron) only. holger-twin-6 is retired. |
twin::tests::a_role_named_by_the_environment_or_the_config_is_refused_by_name, the_role_comes_only_from_the_pairing |
| 35 | Twin follow: gaps and retention | DONE | Gap detection covers three cases: the first cycle in a process, a restarted primary and a rewound head. The backfill forgets change-map entries the store does not hold, so the twin fetches them again. The roster turns an applied sequence into a moment (followed_to_ms, persisted). The retention executor skips every delete until each enrolled twin has followed past the newest write (holger-twin-22). |
a_gap_is_detected_and_backfilled_against_what_the_store_holds, a_twins_follow_point_is_persisted_as_the_moment_it_holds_everything_before, a_reclaim_waits_until_the_twin_has_followed (twice) |
| 19 | No audit query surface | DONE | AuditService.QueryDownloads and GET /-/audit/downloads?ident=&repo=&since_nanos=&until_nanos=&limit= return download rows by ident and/or repository in a time range. Each row carries its seq and chain hash. Only an Auditor or an Admin may read it. |
what_c_downloaded_is_answered, audit::query::tests |
| 39 | TLS 1.2 on the public door | DONE | The HTTP door and the gRPC door speak TLS 1.3 only. The gRPC door terminates TLS on holger's own rustls config, because tonic's config offered 1.2. Under a client CA it requires a client certificate, unless client_auth_optional is set. The browser door needs no client certificate. The peer probe dials 1.3 only. |
exposed::tls::tests::every_door_speaks_tls_1_3_only_and_box_doors_require_a_client_certificate, mirror_mtls_e2e, paired_holgers_e2e |
| 22 | Env-policy leftovers | DONE | Every retired environment policy is refused at boot and by every promotion engine. The gate keys refuse with holger-promote-2, even under a gated rung. The property requirement and the HOLGER_PLUGIN_TRUST_ROOT fallback refuse with holger-server-13. |
tests::a_security_policy_named_by_the_environment_is_refused_by_name, promote_cli |
| 37 | Election capacity is disk only | DONE | CapacityReply now carries cpu_cores (9) and ram_bytes (10). The box's join and the RPC share one RAM reader. |
capacity_measures_the_installed_data_root, capacity::tests::the_ram_is_memtotal_in_bytes |
| 41 | Immutable box | DONE (guard) | A scan of every proto rpc and every /-/ route finds no self-update door. The named exceptions are ImportBundle, ImportIntelBundle and InstallTwinCertificate. |
the_box_has_no_self_update_door |
| 32 | CI runs only cargo audit | DONE (file) | .forgejo/workflows/ci.yml lays the sibling checkouts (secrets.SIBLINGS_TOKEN; without it the job is refused by name). It runs a rustfmt ratchet on added files, clippy, the silenced-test guard, cargo xtask test and server-lib with supply-chain and with supply-chain,metered. |
It has not run yet: the repository needs Actions enabled and the secret. |
| 33/46 | Twin over mTLS proven only in-process | CODE DONE; VM PROOF PENDING | The twin's first whole follow over mutual TLS 1.3 is said once at WARN. pmo gate holger gains the twin-follows-over-mtls check. |
the_first_whole_follow_over_mtls_is_said_once, pmo gate::tests |
| 48 | Console bundle not on the medium | DONE | cargo xtask estate-media refuses every run whose holger-ui console is not built ([estate-media-front-no-console]). pmo gate holger gains the front-carries-console check. |
estate_media::tests::a_front_medium_without_the_console_is_refused |
| 49 | Ops functest on the mock never run | OPEN | Not run. It needs the KVM mock and the private-holger-ops functest. | Next step: the gate lane runs it after the next gate holger. |
| 47 | No loaded_as_a_plugin test for holger media | OPEN | The roster lives in dwarves and tunnr. They are not checked out in this lane. | Next step: in dwarves, port Gunnar's loaded_as_a_plugin roster for holger's declared() installers. |
| 42 | HOLGER-PLAN ?-items | RE-CHECKED | Still open for the owner: ?28, ?11, ?31, ?38, ?42 and the paid-formats question. Still open for code work: ?36 and ?43. Answered by code or obsolete: ?3, ?4, ?6/3, ?7, ?16, ?17, ?29, ?32, ?35, ?41, ?47, ?48, ?49 (bind) and Q2. ?44 and ?45 cannot be checked from here. | Duplicate ids: ?49, ?29, ?31, ?39, ?46. |
Two findings were not changed:
- edda
estate-frontserves the public web door with TLS 1.2 and 1.3 (web/serve.rs:328). The crate is shared with Gunnar's front, so the owner decides. twin_follow::artifact_countstill turns a failed listing into 0.
The merges on main
| # | merge |
| 34 | 26edf09c |
| 36 | c897efbd |
| 35 | bdbd784c |
| 19 | 7492403d |
| 37 | f0526d4b |
| 39 | 831a8dee |
| 22 | 850ac09f |
| 41 | f98f45d4 |
| 48 | f41e0b27 |
| 33/46 | c67be352 |
| 32 | 7d59a3c8 |
The tests ran on the stack of all branches over main 26edf09c, on dwarf: server-lib supply-chain 1018/0, supply-chain,metered 1059/0, jobs 12/0, errcode 9/0, holger (the server CLI) 24/0 and xtask 87/1. The one failure is main's silenced-test guard over three sign-gated targets that another lane added, not this lane. The RED runs failed as intended, every new test by its own assertion.
Media inputs changed. The holger server (twin jobs, role refusal, TLS 1.3, the env-policy refusal, the capacity fields, the mTLS line) and the front's build.rs warning text both changed. The estate-media door now refuses a run without holger-ui's built dist/. A fresh installtest and gate holger are needed. The gate needs pmo feat/holger-gate-mtls-console-2026-10-22 and a holger-ui cargo xtask build before estate-media.