ci(tls): investigate native retention qualification failures

.github/openclaw/tls-config-disassembly.py

@@ -0,0 +1,131 @@
+"""Inspect the exact retained shipping profile without executing it."""
+import hashlib
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import stat
+import struct
+import subprocess
+import zipfile
+
+RUN = 41238111110
+COMMIT = '510fef558b464c58de1209298f638fa476d03eef'
+ARTIFACT = 13056617461
+SIZE = 222623871
+DIGEST = 'c54dbe7ea29a336c76db1dd5ba491bbb117a6c211d938892c62f2f5e74251fcd'
+INPUT = Path(os.environ['RUNNER_TEMP']) / 'tls-disassembly-input'
+OUT = Path('tls-disassembly-proof')
+OUT.mkdir(exist_ok=True)
+
+
+def sha(path):
+    with path.open('rb') as stream:
+        return hashlib.file_digest(stream, 'sha256').hexdigest()
+
+
+def selected(archive, wanted, maximum):
+    entries = archive.infolist()
+    assert len(entries) <= 32
+    names = set()
+    for entry in entries:
+        path = PurePosixPath(entry.filename)
+        assert entry.filename and not path.is_absolute() and '..' not in path.parts
+        assert '\\' not in entry.filename and '\x00' not in entry.filename
+        assert str(path) == entry.filename.rstrip('/')
+        assert str(path) not in names
+        names.add(str(path))
+        mode = entry.external_attr >> 16
+        assert stat.S_IFMT(mode) in (0, stat.S_IFREG, stat.S_IFDIR)
+        assert not entry.flag_bits & 1
+    matches = [entry for entry in entries if entry.filename == wanted]
+    assert len(matches) == 1
+    entry = matches[0]
+    assert not entry.is_dir() and 0 < entry.file_size <= maximum
+    return entry
+
+
+def extract(archive_path, member, destination, maximum):
+    with zipfile.ZipFile(archive_path) as archive:
+        entry = selected(archive, member, maximum)
+        with archive.open(entry) as source, destination.open('xb') as target:
+            count = 0
+            while chunk := source.read(1024**2):
+                count += len(chunk)
+                assert count <= maximum
+                target.write(chunk)
+        assert count == entry.file_size
+    destination.chmod(0o600)
+
+
+def run(name, arguments):
+    result = subprocess.run(arguments, stdin=subprocess.DEVNULL,
+                            capture_output=True, timeout=120, check=False)
+    assert len(result.stdout) <= 32 * 1024**2 and len(result.stderr) <= 1024**2
+    (OUT / (name + '.stderr')).write_bytes(result.stderr)
+    assert result.returncode == 0 and not result.stderr, name
+    return result.stdout.decode('utf-8')
+
+
+archive = INPUT / 'artifact.zip'
+assert archive.stat().st_size == SIZE and sha(archive) == DIGEST
+metadata = json.loads((INPUT / 'metadata.json').read_text())
+assert metadata['id'] == ARTIFACT and metadata['name'] == 'build-linux-arm64'
+assert metadata['size_in_bytes'] == SIZE and metadata['digest'] == 'sha256:' + DIGEST
+assert not metadata['expired']
+assert metadata['workflow_run']['id'] == RUN and metadata['workflow_run']['head_sha'] == COMMIT
+profile_zip = INPUT / 'profile.zip'
+profile = INPUT / 'bun-profile.elf'
+extract(archive, 'bun-linux-aarch64-profile.zip', profile_zip, 1024**3)
+extract(profile_zip, 'bun-linux-aarch64-profile/bun-profile', profile, 2 * 1024**3)
+with profile.open('rb') as stream:
+    header = stream.read(64)
+assert header[:7] == b'\x7fELF\x02\x01\x01'
+assert struct.unpack_from('<H', header, 18)[0] == 183
+version = run('llvm-version', ['llvm-objdump-23', '--version'])
+assert re.search(r'LLVM version 23\.', version)
+symbols = run('nm', ['llvm-nm-23', '--defined-only', '--format=posix',
+                     '--print-size', '--radix=x', '--no-demangle', str(profile)])
+rows = []
+for line in symbols.splitlines():
+    fields = line.split()
+    if fields and re.fullmatch(
+            r'_RNv\w*11bun_runtime6socket11socket_body\w*20DuplexUpgradeContext6deinit', fields[0]):
+        assert len(fields) == 4 and fields[1] in ('T', 't')
+        rows.append(fields)
+assert len(rows) == 1, 'deinit missing or ambiguous'
+name, kind, address, size = rows[0]
+start, length = int(address, 16), int(size, 16)
+assert start > 0 and 0 < length <= 65536
+assembly = run('objdump', ['llvm-objdump-23', '--disassemble', '--start-address=' + hex(start),
+                          '--stop-address=' + hex(start + length), str(profile)])
+assert re.search(r'^0*' + format(start, 'x') + r' <' + re.escape(name) + r'>:$', assembly, re.M)
+instructions = []
+for line in assembly.splitlines():
+    match = re.match(r'^\s*([0-9a-f]+):\s+([0-9a-f]{8})\s+(\S+)', line)
+    if match:
+        address = int(match[1], 16)
+        assert start <= address < start + length
+        assert match[3] != '<unknown>'
+        instructions.append(address)
+assert instructions and instructions[0] == start
+assert instructions == sorted(set(instructions))
+notes = run('build-id', ['llvm-readelf-23', '--notes', str(profile)])
+build_ids = re.findall(r'Build ID: ([0-9a-f]+)', notes)
+assert len(build_ids) == 1
+assert sha(archive) == DIGEST
+receipt = dict(captured=True, control_flow_review_pending=True, producer_run=RUN,
+    commit=COMMIT, artifact_id=ARTIFACT, artifact_sha256=DIGEST,
+    profile_zip_sha256=sha(profile_zip), profile_sha256=sha(profile),
+    elf_machine='AArch64', build_id=build_ids[0], symbol=rows[0],
+    instruction_count=len(instructions), llvm_version=version)
+(OUT / 'deinit.asm').write_text(assembly.replace(str(profile), 'bun-profile.elf'))
+(OUT / 'receipt.json').write_text(json.dumps(receipt, indent=2) + '\n')
+(OUT / 'symbol.txt').write_text(' '.join(rows[0]) + '\n')
+(OUT / 'build-id.txt').write_text(notes)
+files = sorted(OUT.iterdir())
+assert len(files) <= 12 and sum(path.stat().st_size for path in files) <= 2 * 1024**2
+(OUT / 'manifest.json').write_text(json.dumps({
+    path.name: dict(bytes=path.stat().st_size, sha256=sha(path)) for path in files
+}, indent=2) + '\n')
+print(json.dumps(receipt))

.github/openclaw/tls-config-repair.patch

@@ -0,0 +1,27 @@
+diff --git a/src/runtime/socket/socket_body.rs b/src/runtime/socket/socket_body.rs
+index 2752cbc894159817f1557df3e7d0f518895a3a18..5fa5d59042a200a50106415325b8f6d1b4255f83 100644
+--- a/src/runtime/socket/socket_body.rs
++++ b/src/runtime/socket/socket_body.rs
+@@ -5118,7 +5118,9 @@ impl DuplexUpgradeContext {
+                     Self::release_connection(this);
+                     return;
+                 }
+-                this.ssl_config.set(None); // Drop frees.
++                if this.ssl_config.get().is_some() {
++                    this.ssl_config.set(None); // Drop frees.
++                }
+                 // Bytes the peer sent while this task was still queued were
+                 // staged by `UpgradedDuplex::on_internal_receive_data` (the
+                 // engine did not exist yet to receive them). Feed them now
+@@ -5189,7 +5191,10 @@ impl DuplexUpgradeContext {
+             debug_assert!(!ctx.native_shutdown_callback.get());
+             ctx.tls.set(None);
+             // Close raced ahead of StartTLS — drop the unconsumed config / ctx.
+-            ctx.ssl_config.set(None);
++            // An absent config has an inactive payload that must not spill onto the JS stack.
++            if ctx.ssl_config.get().is_some() {
++                ctx.ssl_config.set(None);
++            }
+             ctx.owned_ctx.set(None);
+         }
+         // `UpgradedDuplex` cleanup

.github/openclaw/tls-config-repair.py

@@ -0,0 +1,136 @@
+"""Qualify the reviewed empty-config repair without publishing the runtime branch."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import signal
+import subprocess
+import time
+from xml.etree import ElementTree
+
+SOURCE = Path('/work/source')
+OUT = Path('/work/repair-proof')
+INPUTS = Path(__file__).resolve().parent
+BUN = '454a78a4d3b0202ecdbedf7dd051fc84ffc59e9e'
+WEBKIT = 'b82bc917e99110b61c3a21202d6def7457aa194c'
+OWNER = 'src/runtime/socket/socket_body.rs'
+BEFORE = '66121e98f4e8537520f976ff572ef538cc7baedf3e59c8ab2fdfce5fe4bc2afc'
+AFTER = '2a40a7df44cfbc9344eb92ced128da282ade137fe2a08f5319d85b23c297dfb0'
+PATCH = 'a0fbcc59fae14006b39c60d5cd71d0b71f80f151c6b0eac7d689db5fcbcfc25b'
+FIXTURE = 'test/js/bun/net/socket-retention.test.ts'
+FIXTURE_SHA = 'd4c04a72b89bc7d33c292a16a57c38f5da540815dc2e141adfd58c1bd9973af2'
+BUILD = SOURCE / 'build/tls-empty-config'
+ENV = {k: v for k, v in os.environ.items() if not any(x in k.upper() for x in ('TOKEN', 'SECRET', 'PASSWORD'))}
+ENV.update(CI='true', CARGO_BUILD_JOBS='2')
+DEADLINE = time.monotonic() + 240 * 60
+STEPS = []
+
+
+def sha(path):
+    with path.open('rb') as stream:
+        return hashlib.file_digest(stream, 'sha256').hexdigest()
+
+
+def git(*args):
+    return subprocess.check_output(['git', '-C', str(SOURCE), *args], timeout=120, text=True).strip()
+
+
+def save(**facts):
+    (OUT / 'proof.json').write_text(json.dumps(dict(passed=False, bun=BUN, webkit=WEBKIT,
+        patch_sha256=PATCH, source_before=BEFORE, source_after=AFTER, steps=STEPS, **facts), indent=2) + '\n')
+
+
+def run(name, argv, seconds):
+    log = OUT / (name + '.log')
+    step = dict(name=name, argv=argv, exit_code=None, timed_out=False)
+    STEPS.append(step)
+    save()
+    with log.open('xb') as stream:
+        process = subprocess.Popen(argv, cwd=SOURCE, env=ENV, stdin=subprocess.DEVNULL,
+            stdout=stream, stderr=subprocess.STDOUT, start_new_session=True)
+        started = time.monotonic()
+        try:
+            while process.poll() is None:
+                if time.monotonic() >= min(DEADLINE, started + seconds):
+                    step['timed_out'] = True
+                    raise TimeoutError(name)
+                assert sum(p.stat().st_size for p in OUT.iterdir() if p.is_file()) <= 64 * 1024**2, 'proof exceeds 64 MiB'
+                time.sleep(1)
+        finally:
+            try:
+                os.killpg(process.pid, signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+            process.wait()
+            stream.flush()
+            step['exit_code'] = process.returncode
+            save()
+    assert process.returncode == 0 and not step['timed_out'], name
+    return log.read_text(errors='replace')
+
+
+def source_state(adapted):
+    assert git('rev-parse', 'HEAD') == BUN
+    assert git('write-tree') == original_tree
+    assert git('diff', '--no-renames', '--name-only', 'HEAD').splitlines() == ([OWNER] if adapted else [])
+    assert not git('ls-files', '--others', '--exclude-standard')
+    assert sha(SOURCE / OWNER) == (AFTER if adapted else BEFORE)
+    assert sha(SOURCE / FIXTURE) == FIXTURE_SHA
+
+
+OUT.mkdir(exist_ok=True)
+original_tree = git('rev-parse', 'HEAD^{tree}')
+source_state(False)
+assert os.uname().machine == 'aarch64'
+assert sha(INPUTS / 'tls-config-repair.patch') == PATCH
+save()
+run('apply-check', ['git', 'apply', '--check', str(INPUTS / 'tls-config-repair.patch')], 60)
+run('apply', ['git', 'apply', str(INPUTS / 'tls-config-repair.patch')], 60)
+source_state(True)
+run('rustfmt', ['rustup', 'run', 'nightly-2026-09-15', 'rustfmt', '--edition', '2024',
+    '--config-path', 'rustfmt.toml', '--config', 'skip_children=true', '--check', OWNER], 120)
+source_state(True)
+run('build', ['bun', 'scripts/build.ts', '--profile=release', '--ci=on', '--os=linux',
+    '--arch=aarch64', '--abi=gnu', '--build-dir=build/tls-empty-config', '-j2'], 13800)
+source_state(True)
+binary, profile = BUILD / 'bun', BUILD / 'bun-profile'
+assert binary.is_file() and profile.is_file()
+identity = json.loads(run('identity', [str(binary), '-e',
+    'console.log(JSON.stringify({commit:Bun.revision,webkit:process.versions.webkit,platform:process.platform,arch:process.arch}))'], 60))
+assert identity == dict(commit=BUN, webkit=WEBKIT, platform='linux', arch='arm64'), identity
+node = json.loads(run('node', ['node', '-e',
+    'console.log(JSON.stringify({node:process.versions.node,bun:process.versions.bun??null,platform:process.platform,arch:process.arch}))'], 60))
+assert node == dict(node='26.12.1', bun=None, platform='linux', arch='arm64'), node
+symbols = run('symbols', ['llvm-nm', '--defined-only', '--format=posix', str(profile)], 120)
+names = [line.split()[0] for line in symbols.splitlines() if re.fullmatch(
+    r'_RNv\w*11bun_runtime6socket11socket_body\w*20DuplexUpgradeContext6deinit', line.split()[0])]
+assert len(names) == 1, 'repair deinit symbol missing or ambiguous'
+run('deinit-disassembly', ['llvm-objdump', '--disassemble-symbols=' + names[0], '--demangle', str(profile)], 120)
+files = json.loads(run('test-files', ['bun', '-e',
+    'import {tlsQualificationFiles} from "./scripts/openclaw-release/release.ts";console.log(JSON.stringify(tlsQualificationFiles))'], 60))
+assert len(files) == 6 and len(set(files)) == 6 and FIXTURE in files
+fixture_hashes = {name: sha(SOURCE / name) for name in files}
+cases = []
+for index, name in enumerate(files):
+    xml = OUT / ('tls-' + str(index) + '.xml')
+    run('tls-' + str(index), [str(binary), 'test', name, '--reporter=junit', '--reporter-outfile=' + str(xml)], 600)
+    selected = list(ElementTree.parse(xml).iter('testcase'))
+    assert selected and all(c.find('failure') is None and c.find('error') is None for c in selected), name
+    assert any(c.find('skipped') is None for c in selected), name
+    cases += selected
+    source_state(True)
+for name in ['a TLS Duplex completion retains its owner and is inert after destroy',
+             'TLS Duplex cycles collect after startup while a retained origin keeps its wrapper alive']:
+    selected = [case for case in cases if case.get('name') == name]
+    assert len(selected) == 1 and selected[0].find('skipped') is None, name
+assert len(cases) == 291 and sum(c.find('skipped') is not None for c in cases) == 8
+assert fixture_hashes == {name: sha(SOURCE / name) for name in files}
+identities = dict(binary=sha(binary), profile=sha(profile), build_ninja=sha(BUILD / 'build.ninja'))
+run('restore', ['git', 'restore', '--source=' + BUN, '--worktree', '--', OWNER], 60)
+source_state(False)
+save(completed=True, identity=identity, binary_sha256=identities, fixture_sha256=fixture_hashes,
+     passed_cases=283, skipped_cases=8, source_restored=True)
+result = json.loads((OUT / 'proof.json').read_text())
+result['passed'] = True
+(OUT / 'proof.json').write_text(json.dumps(result, indent=2) + '\n')