t0013: ACL xattr / TMPFS_XATTR (v9fs/test#28)

[ericvh]

Work Slice

Human Goal

Make t0013 ACL a non-XFAIL integration result by locating the EOPNOTSUPP 95 on system.posix_acl_*: guest export fs / missing TMPFS_XATTR, versus the 9p/diod xattr path. This is next because mapping issue #1 landed; it is independent of t0011.

Product tracker: v9fs/test#28

Evidence Anchor

• Source of truth: v9fs/linux Image config + v9fs/test harness + chaos/diod + Actions artifacts
• Version/commit/hash/date:
  • linux v7.2 = 8d3ae59288f1e7d58d76558a6ee96d533bc5019f (Image kernel-latest / kernel-v7.2)
  • harness at mapping run = 94b2182f54b30a073d893990db8f64e69f0d911a
  • Actions 32929975795 (2026-08-26), eval unexpected: 0
  • diod de51d1ee1bd5ccf1d8c16b96227c8bb03ec50106
  • Publish config: TMPFS_POSIX_ACL on; TMPFS_XATTR not set
• Relevant paths, interfaces, scenarios, or data: t0013-v9fs-acl.t; mount -o posixacl succeeds; Txattrwalk of system.posix_acl_* returns EOPNOTSUPP 95
• Existing proof and known gaps: Mapped on Formulate first slice: map t0011/t0013 tip residuals (v9fs/test#28) #1 / PR Map t0011/t0013 tip residuals (M0 evidence) #2 (E0003/E0005). Discriminator correction from PR Map t0011/t0013 tip residuals (M0 evidence) #2 review: the mapping text said there was no Txattrcreate. On run 32929975795, t0013-v9fs-acl.diod.log has two Txattrcreate calls (system.posix_acl_access, system.posix_acl_default). Rxattrcreate and the 44-byte Twrite succeed; the following Tclunk is Rlerror ecode 95, and later walks still return 95. Creates are issued and do not persist; walks stay EOPNOTSUPP.

Target Change

• Component/API/artifact: v9fs/test (and maybe linux Image config for TMPFS_XATTR). Not mixed with t0011.
• Behavioral contract: in-guest setfacl on local /tmp (not 9p) decides the path. EOPNOTSUPP ⇒ TMPFS_XATTR / export fs. PASS on local /tmp ⇒ 9p/diod xattr path. Then land the matching fix so t0013 PASSes without XFAIL.
• Invariants: linux stays a rebase-clean mirror (config-only if Image changes; no .github in linux); keep diod/xfail.txt t0013 rows until PASS.

Proof Promotion

• Current level: Mapped
• Target level: Integration
• Exact commands or generated artifacts: in-guest local /tmp setfacl observation; then named diod-regression t0013 without matching XFAIL rows
• Discriminating negative/failure evidence: “posixacl mount option not parsed” is already rejected (-o posixacl mounts; client issues Txattrwalk and Txattrcreate). A 9p-only fix must not be claimed if local /tmp setfacl is still EOPNOTSUPP.

Complete this sentence:

The proof would fail if the implementation used a 9p/diod xattr fix while guest tmpfs still lacked xattrs (or the reverse) because in-guest setfacl on local /tmp (not 9p) would still be EOPNOTSUPP versus PASS, and clunk/walk would still return 95 even though two Txattrcreate writes already succeeded.

Review Focus

• Highest-risk semantics: treating missing Txattrcreate as the bug (it is issued); or flipping TMPFS_XATTR without the local /tmp discriminator
• What could pass broad tests while still being wrong: t0013 still XFAIL while Image config or comments change; mixing this slice with t0011 on the same harness files
• Rollback, compatibility, security, migration, or observability concern: keep XFAIL until PASS; linux config changes stay in the Image/publish path, not a non-upstream file in v9fs/linux

Boundaries

• In scope: t0013 ACL xattr / TMPFS_XATTR vs 9p/diod path on the pinned versions
• Explicitly not claimed: t0011 squashuser; chaos/diod source unless the discriminator points there; Debian apt diod
• Deferred dependencies: drop matching diod/xfail.txt rows only after PASS

Backlog Position

• Rank in planned horizon: 3
• Predecessor: #1 (closed; mapping landed via PR Map t0011/t0013 tip residuals (M0 evidence) #2)
• Unblocks: drop matching t0013 XFAIL rows; product closeout on Tip XFAIL residuals: t0011 allsquash and t0013 ACL test#28 for ACL only
• Dependency boundary: t0013 only (E0003/E0005)
• Proof boundary: Mapped → Integration on t0013 only
• Parallel lane: independent of #5, but must not share an implementer or write the same v9fs/test harness files at the same time
• Integration order: orchestrator sequences vs t0011; if linux Image config is required, name linux vs test merge order on the implementation PR
• Next issue: none until this or #5 lands a non-XFAIL assertion

Ownership and Authority

• Authority level/exceptions: A2; no merge to v9fs/linux; no .github on linux; kernel and harness merges stay human-gated
• Orchestrator: ericvh
• Evidence mapper: Formulate first slice: map t0011/t0013 tip residuals (v9fs/test#28) #1 mapping (landed); discriminator wording corrected here from PR Map t0011/t0013 tip residuals (M0 evidence) #2 review
• Implementer/write scope: later assigned; likely v9fs/test and maybe linux Image/TMPFS_XATTR. Not this closeout run.
• Independent reviewer: distinct from the implementer (required before ready)
• CI/proof owner: v9fs/test diod-regression
• State closer: after independent review and product merge

Durable State

• Evidence-map rows: E0003, E0005 (t0013 only)
• Proof-ledger rows: promote a t0013 claim off P0002 when integration evidence exists
• Decision/experiment/risk rows: none new at open
• Methodology trigger: none

Done

• Evidence map and proof plan are current.
• Predecessor, authority, ownership, and write scope are confirmed.
• Local /tmp setfacl discriminator is recorded before the fix is chosen.
• Implementation satisfies the bounded contract.
• Focused and required broad verification pass (t0013 PASS; XFAIL rows removed only then).
• Independent review is resolved and approved.
• Follow-ups have bounded dispositions.
• Durable evidence and GitHub state are reconciled.