Delete the net and spin applets, proctest, and the launch_authority metal row

[Japabu]

Deletes toybox's net and spin applets, the proctest program and the launch_authority metal row. Nothing runs the three programs, and the owner ruled the row an integration test of a kind ToyOS does not keep. toyos_manifest::launch::refused, left with one caller, moves into it. Two issues close, because these deletions meet their exits. What the row alone held is recorded: the supervisor's half in stage 2 of the supervisor track, and std's half in a new issue. A second new issue records a red the guest suite turned up.

The owner asked for net and proctest to go, and for any other test program that earns nothing to go with them. The design round's survey found nothing else that meets that bar: design/survey.sh, with its output at ecd6d1cc5 in design/survey.log. The orchestrator accepted the design on this pull request. The owner then amended it, in his words as the orchestrator recorded them:

"no those tests are simply invalid. they touch too much. they are too brittle. we dont like those kinds of tests. we try not to test integration between modules unless its the kernel. … those kinds of tests that install software and try to run that and then do this and that are giving me an ick. same even goes for our userspace programs. if theyre tested as units / modules then they shouldnt need separate integration tests. maybe a very cheap smoke test."

The orchestrator's reading of that ruling: launch_authority's metal row is deleted, not moved to another program. Its property is held by a host unit test of the supervisor's decision, and one is added only if none exists. No T14 boot is owed. A wider sweep of tests like it is a separate change.

What changed, per decision

1. toybox's net applet goes. This removes system/toybox/src/net.rs, its mod, its commands! arm and "bin/net" in images/system.toml. Nothing ran or named it. Its row holds no netstack, so it could only print net: connection failed. issues/toybox-net-cannot-reach-netstack.md goes with it, since its exit is "or is removed". host stays for name lookups.

2. toybox's spin applet goes. This removes system/toybox/src/spin.rs, its mod, its arm and "bin/spin". It is an infinite loop that nothing ran. The spin in counters_metal and tests/toyos.rs is that row's phase name, not this applet.

3. proctest goes. This removes tests/guest/proctest/, its workspace member, its lock entry, proctest = {}, and the starts entries that listed it on sshserver's, shell's and toybox's rows. Nothing ran /system/bin/proctest except itself and the unlisted arm of the launch_authority row. Together with 2, this meets the exit of issues/the-shipped-image-carries-two-test-programs.md: the shipped image names neither program. That issue goes too.

4. The launch_authority metal row goes, by the owner's ruling. This removes:

   • its guest binary, its RUST_SKIP entry, its judge, and its job in PROCTREECASE;
   • the rows of tests/images/proctreecase.toml that only it used. Those are test-runner's swap and update starts, toybox's starts = ["swap"], and the swap, update and proctest rows. No other job on that image names them (process_tree, launch_toctou, port_badge, fs_share and app_view were read for swap, update, stats and proctest).

   Its launch refusals are the supervisor's toyos_manifest::launch::may_start. The supervisor calls it for every launch and logs its Refusal (system/supervisor/src/main.rs). Existing host tests in lib/manifest/src/launch.rs hold both refusals, so no test is added:

   • NotListed, for an unlisted row from either session and either kind of caller, and for a row that lists nothing. This is rows 2, 3, 14 and 15 of a_caller_starts_what_its_row_lists_and_swap_and_update_only_in_a_login_session, plus nothing_listed_is_nothing_started_and_apps_names_no_row.
   • OutsideLogin, for swap and update.

   The mutations below red each one. Two things the row also held are now held by no test:

   • That the supervisor applies may_start to a launch. The supervisor has no host tests. issues/the-supervisor-is-host-tested-and-owns-the-stop.md stage 2 owes "launch resolution and every launcher refusal" as host-tested decisions, each with a mutation.
   • The row's last arm: a child spawned directly holds no launcher, either under the launcher label or in the svc it inherits. Two decisions make that true, and each has one record:
     • The supervisor's decision is to endow a row's launcher under launcher and never in svc (launcher_namespace). That is namespace selection, which stage 2 of issues/the-supervisor-is-host-tested-and-owns-the-stop.md already owes as a host test with a mutation. Its exit now names that mutation: the launcher endowed as an entry of svc.
     • Std's decision is that a direct spawn endows the child no launcher (sdk/std/sys/process.rs). This is recorded in issues/nothing-holds-that-a-child-spawned-directly-holds-no-launcher.md, owned by the orchestrator. Its exit is a test on the cheapest tier that reaches it, and a mutation in which the spawn endows the child its caller's launcher.

5. toyos_manifest::launch::refused moves into its one caller. It had two callers: the supervisor's say! on a refused launch, and the row's metal judge, which read the line whole. Now that the judge is gone, the function's format string becomes that say!'s arguments (system/supervisor/src/main.rs), and the function is deleted. The line is the same bytes. Nothing else calls it:

   • A search of the tree outside issues/ finds no launch::refused or authority::refused.
   • No fork clone, cargo checkout or toolchain library names toyos-manifest at all.

6. issues/consent-prompts-click-on-an-open-launchers-row-made-no-launch.md is new. The guest suite went red on consent_prompt alone at host load 47 (see Gates). At c24bee1db, where the suite ran, the only change this branch made to anything that test boots or runs was the doc comment refused had then. Root CLAUDE.md asks that a red seen under load be recorded as a defect with the host's load. It differs from both recorded consent_prompt failures: here the click on an open launcher's row launched nothing.

Mentions left in issues/. These are not edited, per root CLAUDE.md's Prose rule:

• apps-that-build-or-run-on-toyos-alone.md keeps its proctest row. build/userlandhost.rs's owed reads only from a manifest to its issue, so the stale row reds nothing. --ci host below is green.
• the-tree-says-who-uses-each-thing.md keeps its proctest in the tree sketch.
• the-host-cannot-reach-the-t14-while-it-runs-toyos.md keeps its launch_authority sentence.
• consent-prompts-click-on-an-open-launchers-row-made-no-launch.md, filed by this branch, still names refused's doc comment. That is what c24bee1db, the tree it records, changed.

The one existing issue edited is the-supervisor-is-host-tested-and-owns-the-stop.md, in stage 2's exit. reviewer.md's Guest tests rule names a stage of a track as where a cut row's unheld behaviour is recorded.

Kept. screen and locale are tools for the person at the machine: one sets the resolution, the other picks the layout. usbd is the userland xHCI driver under construction. The mask_windows row reads its windows across idle_span.

Gates

The logs are on ToyOSOrg/evidence pr-889. This head's logs are at c1001fe1, with the exits in exits.txt. The scripts and patches they ran are at 45412587 and c7a625dd. Each exit below is the command's own.

gate	head	exit	log
cargo run -- --ci host	68c50f52a	0: 76 steps, all green	ci-host.log
cargo run -- --build-only (x86-64)	68c50f52a	0	build-x86_64.log
cargo run -- --build-only --arch aarch64	68c50f52a	0	build-aarch64.log
cargo test, the whole guest suite	c24bee1db	1: 62 of 63 passed, and consent_prompt red at its 600 s ceiling	guest.log
git grep of every deleted name and path, bare and qualified, outside issues/	68c50f52a	0: each search exit 1	grep.log, grep.sh
git grep of launch::refused and authority::refused outside issues/	68c50f52a	0: the search exit 1	grep-refused.log, grep-refused.sh
grep -rIl of the deleted names over ~/.cargo/git/checkouts, the primary's rust/library and the fork clones	after 05dff83e8	1, both: no match	forks.log
grep -rIl of toyos_manifest, toyos-manifest and launch::refused over the same three	43a843c81	0: each search exit 1	forks.log, forks.sh
mutation: may_start stops refusing NotListed	68c50f52a	red, cargo test -p toyos-manifest exit 101: the two tests above	mutate-notlisted.log, patch
mutation: may_start stops refusing OutsideLogin	68c50f52a	red, exit 101: row 8 of the table test	mutate-outsidelogin.log, patch

Each mutation script checks the patch, applies it, builds (exit 0), runs, reverses the patch and asserts the tree is clean.

The guest suite was not re-run at 68c50f52a. c24bee1db..68c50f52a brings in three things: main's #888 and #890, which change only .claude/agents/; the issues/ files; and item 5. Item 5 is the only change a guest boots. It changes how the supervisor's refused-launch line is formatted, and the line's bytes stay the same. No test reads that line: git grep -n "may not start" -- tests/ exits 1.

The guest suite's red. consent_prompt boots tests/images/consentcase.toml, which runs no toybox, proctest, swap or update. Its host driver in tests/toyos.rs is unchanged, so at c24bee1db this branch differed from main there only in the doc comment refused had then. At skip the host saw the launcher open and clicked its row. Nothing launched, and the job ran out its 600 s ceiling. Load average a minute after the suite ended was 34.22, 38.33 and 47.31 on 14 cores (load-after-guest.txt). It was not re-run. It is recorded in item 6's issue.

The checks root CLAUDE.md asks of a change to production code

• Negative control. The branch claims nothing new about behaviour. It claims three things: nothing used what it deletes; the host tests hold the deleted row's launch refusals; and the supervisor's refused-launch line is unchanged.
  • For the first claim, a missed user would have to be found by some reader. The searches above found none outside issues/. The host suites and both images ran at this head with the deletions in, and the guest suite ran at c24bee1db. The whole change reverted is main, which is what this branch's tests already ran against apart from these deletions.
  • For the second claim, the two mutations are the controls. Each reds a named host test at this head.
  • For the third claim, the format string and its four arguments moved without a change. A caller left anywhere would fail to build, and a caller in a fork or checkout would have to name toyos-manifest, which none does.
• Independent oracle. None applies: no external specification says what a tree uses.
• Guest tests cut. The launch_authority metal row is cut by the owner's ruling, which Integration between modules is tested only for the kernel, and an integration test outside it is cut #890 has since written into reviewer.md's Tests. The tests named in item 4 hold its launch refusals on the host tier. What the row alone held is recorded in two places: stage 2's exit for the supervisor's half, and the std issue for std's half. No guest test is added or changed.
• Dependencies. None added.
• Growth. git diff --shortstat origin/main...68c50f52a gives 19 files, 74 insertions and 413 deletions:
  • production: system/, lib/, images/, Cargo.toml and Cargo.lock, −76 net;
  • tests: tests/, −287 net;
  • issues: −40 for the two closed, +60 for the two filed, and +6 −2 in stage 2's exit.

Unsure

• Integration between modules is tested only for the kernel, and an integration test outside it is cut #890's Tests asks that, where what a cut integration test checked matters, a unit or module test of its program holds it. Two things the row checked are held by no test yet, only owed: the supervisor applying may_start, and the child arm (item 4). The review weighed these against reviewer.md before Integration between modules is tested only for the kernel, and an integration test outside it is cut #890 and found no blocker. Whether that weighing holds under Integration between modules is tested only for the kernel, and an integration test outside it is cut #890 is the orchestrator's call.

🤖 Generated with Claude Code

https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy

[Japabu]

Design acceptance, by the orchestrator. The owner asked for net and proctest to go, and for unused test programs to be deleted. The plan is accepted: delete the net and spin toybox applets, proctest, and the two issues whose exits they meet. One change to it: launch_authority's stand-in program must be one that stays in the base system. The owner is weighing moving the apps (doom, snake, calc, paint, toyfetch, editor) out of the tree into packages, so don't use toyfetch. Pick an empty-row program among the system ones, or say why none fits. The metal staging folder is /Users/jan/.claude/jobs/2280e09e/tmp/scratchpad/prune/metal.

[Japabu]

The owner's ruling, which amends this acceptance (recorded by the orchestrator):

"no those tests are simply invalid. they touch too much. they are too brittle. we dont like those kinds of tests. we try not to test integration between modules unless its the kernel. … those kinds of tests that install software and try to run that and then do this and that are giving me an ick. same even goes for our userspace programs. if theyre tested as units / modules then they shouldnt need separate integration tests. maybe a very cheap smoke test."

So launch_authority's metal row is deleted, not moved to another program. The property it checks (a launcher refuses a program its caller's row does not list) is held as a unit test of the supervisor's decision on the host, if no such test exists already. No T14 boot is owed for it. A wider sweep of tests of this kind is a separate change.

[Japabu]

Review of #889 at b36458c00, against .claude/agents/reviewer.md on origin/main. Net: 17 files, +73 −406. Production −71, tests −287, issues +65 −40.

Weighed: consent_prompt's red does not block. The Evidence rule asks for green on the guest tests the change reaches, and the change does not reach this one:

• tests/images/consentcase.toml starts logkeeper, diskserver, fileserver, compositor, filepicker, test-runner, shell, grants and /apps. It runs no toybox, proctest, swap or update.
• The supervisor's only change is a one-line doc comment, on a line that did not move, in toyos-manifest.
• The harness's Consent driver is unchanged. RUST_SKIP lost launch_authority, and the binary went with it, so the set of jobs it runs is the same.
• The guest log (c24bee1db, 62 of 63) has every other test green, and c24bee1db..b36458c00 touches only .claude/agents/orchestrator.md and issues/.
• The red is recorded as a defect, with the host's load, as root CLAUDE.md asks.

Checked: citations. git grep at b36458c00 outside issues/ finds none of these: proctest, tests/guest/proctest, launch_authority, test_rs_launch_authority, bin/net, bin/spin, toybox net, toybox spin, either deleted slug, or toybox's net/spin arms. That covers .github/, .claude/, every CLAUDE.md, images/console.toml and every test image. What remains is only in issues/, and the rules keep those.

Checked: what the may_start host tests hold of the deleted row.

• NotListed: rows 2, 3, 14 and 15, plus nothing_listed_is_nothing_started_and_apps_names_no_row.
• OutsideLogin for swap and update: rows 8 and 10.
• The row's started arms: rows 9, 11 and 12.
• Both mutations are red at launch.rs blob 4d7347cb9, which is the head's.
• Two things are not held by these tests, and the body discloses both. The first is the supervisor applying may_start and answering MSG_REFUSED (system/supervisor/src/main.rs:1863, :1906), which stage 2 of the supervisor track owes. The second is the child arm.
• The five rows left on proctreecase.toml were read: no job or judge names swap, update, proctest or toybox's starts. A slots row is minted only at its start (main.rs:1031), so pruning update changes nothing at boot. every_config_renders_its_manifest is green in the host log.

BLOCKER

None.

NOTE

• lib/manifest/src/launch.rs:256: refused has one caller now that this branch deleted the metal judge, its other caller (system/supervisor/src/main.rs:1906). Inline its format! into that say! and delete the function. Why: Growth, an abstraction with one caller, and this branch made it one. The body offers this and holds it back as outside the design. The orchestrator widens the fence for it or records why not.
• issues/nothing-holds-that-a-child-spawned-directly-holds-no-launcher.md:18: the owner's ruling covers deleting the child arm. The problem is where the branch records it: a standalone tooling file. The Guest-tests rule names a stage of a track, in the same diff, as the record of a cut's unheld behaviour. The file's first decision, launcher_namespace, is one that stage 2 of issues/the-supervisor-is-host-tested-and-owns-the-stop.md:54 already owes ("namespace and claim selection", each with a mutation), so two records now owe one host test. Name the svc mutation in stage 2's exit, and keep this file to std's direct spawn (sdk/std/sys/process.rs) alone. Why: one record per owed test, in the form the rule names.

LAND AFTER NAMED CHANGES