t0011: squashuser vs owner assertion (v9fs/test#28)

[ericvh]

Work Slice

Human Goal

Decide and land a non-XFAIL t0011 allsquash ownership assertion: either pass --squashuser=$(id -un) so exp/ matches $(id -u):$(id -g), or change the test to expect nobody (uid 65534). This is next because mapping issue #1 landed; t0011 is independent of t0013.

Product tracker: v9fs/test#28

Evidence Anchor

• Source of truth: v9fs/test harness + chaos/diod --allsquash + Actions artifacts
• Version/commit/hash/date:
  • linux v7.2 = 8d3ae59288f1e7d58d76558a6ee96d533bc5019f (Image kernel-latest / kernel-v7.2)
  • harness at mapping run = 94b2182f54b30a073d893990db8f64e69f0d911a
  • Actions 32929975795 (2026-08-26), eval unexpected: 0
  • diod de51d1ee1bd5ccf1d8c16b96227c8bb03ec50106 (chaos/diod master since 2026-06-23)
• Relevant paths, interfaces, scenarios, or data: t0011-v9fs-allsquash.t; diod --allsquash (default squashuser nobody / export uid 65534); test stats exp/ and expects $(id -u):$(id -g)
• Existing proof and known gaps: Mapped on Formulate first slice: map t0011/t0013 tip residuals (v9fs/test#28) #1 / PR Map t0011/t0013 tip residuals (M0 evidence) #2 (E0005/E0006). XFAIL rows remain; XFAIL is not integration proof. t0012 is green.

Target Change

• Component/API/artifact: v9fs/test (diod invocation and/or t0011 assertion). Kernel squash path is already working.
• Behavioral contract: one chosen mechanism makes t0011 PASS without XFAIL: --squashuser=$(id -un) or assert uid/gid 65534, not both mixed with t0013.
• Invariants: linux stays mirror-only; keep diod/xfail.txt t0011 rows until this test PASSes; do not treat floating DIOD_REF=master as a SHA pin.

Proof Promotion

• Current level: Mapped
• Target level: Integration
• Exact commands or generated artifacts: named v9fs/test diod-regression run of t0011 without matching XFAIL rows; eval must not hide a real FAIL
• Discriminating negative/failure evidence: FAIL if squash is actually dropped (t0012 would also fail; Rgetattr uid 65534 would be absent). FAIL if the assertion still expects $(id -u) while export remains nobody 65534.

Complete this sentence:

The proof would fail if the implementation used “v9fs dropped squash” as the fix because t0011 export Rgetattr uid 65534 and green t0012 would not match that story, while exp/ would still be 65534 unless --squashuser=$(id -un) or the assertion is changed.

Review Focus

• Highest-risk semantics: copying an expected uid into the test without a squashuser trial, or mixing this slice with t0013
• What could pass broad tests while still being wrong: leaving t0011 in diod/xfail.txt and calling the slice done; or changing assertion and squashuser at once so the discriminator is lost
• Rollback, compatibility, security, migration, or observability concern: keep XFAIL until PASS; do not add synthetic FAIL rows

Boundaries

• In scope: t0011 squashuser vs ownership assertion on the pinned kernel/diod/harness versions
• Explicitly not claimed: t0013 ACL; kernel squash rewrite; chaos/diod source change unless a later pin proves it; Debian apt diod
• Deferred dependencies: drop matching diod/xfail.txt rows only after PASS; optional DIOD_REF SHA pin is a separate follow-up

Backlog Position

• Rank in planned horizon: 2
• Predecessor: #1 (closed; mapping landed via PR Map t0011/t0013 tip residuals (M0 evidence) #2)
• Unblocks: drop matching t0011 XFAIL rows; product closeout on Tip XFAIL residuals: t0011 allsquash and t0013 ACL test#28 for allsquash only
• Dependency boundary: t0011 only (E0005/E0006)
• Proof boundary: Mapped → Integration on t0011 only
• Parallel lane: independent of #6, but must not share an implementer or write the same v9fs/test harness files at the same time
• Integration order: one implementer on t0011 harness files; t0013 waits or uses a disjoint write scope sequenced by the orchestrator
• Next issue: #6 (t0013; do not mix)

Ownership and Authority

• Authority level/exceptions: A2; no merge to v9fs/linux; no .github on linux; product merges stay human-gated
• Orchestrator: ericvh
• Evidence mapper: Formulate first slice: map t0011/t0013 tip residuals (v9fs/test#28) #1 mapping (landed)
• Implementer/write scope: later assigned; v9fs/test (diod flags / t0011 / diod/xfail.txt). Not this closeout run.
• Independent reviewer: distinct from the implementer (required before ready)
• CI/proof owner: v9fs/test diod-regression
• State closer: after independent review and product merge

Durable State

• Evidence-map rows: E0005, E0006 (t0011 only)
• Proof-ledger rows: promote a t0011 claim off P0002 when integration evidence exists
• Decision/experiment/risk rows: none new at open
• Methodology trigger: none

Done

• Evidence map and proof plan are current.
• Predecessor, authority, ownership, and write scope are confirmed.
• Implementation satisfies the bounded contract.
• Focused and required broad verification pass (t0011 PASS; XFAIL rows removed only then).
• Independent review is resolved and approved.
• Follow-ups have bounded dispositions.
• Durable evidence and GitHub state are reconciled.