🔴 DO-NOT-MERGE-YET: airvpn killswitch — close the fail-open, stop root-sourcing the site config, fix the apply/doc order

[ZacxDev]

🔴 DO NOT MERGE — this needs YOU, on a host you can physically reach

scripts/airvpn-updown is a LIVE fail-closed killswitch on the workbench's uplink. Every
claim below is from unit tests, bash -n, nft -c and reading the code. The bar skill's
mandatory re-test protocol has NOT been run and I cannot run it.

The protocol lives in claude/skills/bar/airvpn.md (11 steps, pinned by nine tests). Read it
there, not here.

🔴 Round 3 fixed the step that the entire banner exists for. Step 11 said
ssh zach@10.42.0.30 — the workbench's own nebula address — while step 1 puts you on the
LAN. Followed literally that is a self-ssh; from another LAN host it is a same-LAN hop.
Neither touches the nebula direct-punch path that the section's opening line says a LAN-only
test cannot reach, and that locked the host out in #118. The step carrying the whole "off-LAN"
claim never said which host to run it from, so it passed unconditionally. It now names the
source host, carries a still-on-the-LAN guard, defines PASS / FAIL / INVALID, and says the
protocol cannot be completed without an off-LAN host rather than letting the self-ssh stand
in for one.

---

Now based on main

#350 has merged, so this is rebased onto current main and retargeted to main. The
stacked-parent hazard is gone, and branch CI now shows the truth rather than the pre-existing
breakage #356/#357 fixed. It still deletes the scripts/airvpn-updown PENDING_SCRUB entry
#350 added — required, because that ratchet fails in both directions.

---

Round 3 — what the delta audit found

The audit confirmed a lot: F1's scrub verified across 17 encodings over all 702 tracked files;
F3 over 19 byte-level fixtures including every CR shape; F4's atomicity confirmed, and the
missing-table footgun confirmed real and confirmed guarded (a bare delete table on a missing
table aborts the file with rc=1; table X {} + delete + definition gives rc=0); G1, G6, G4,
G3 correct and distinct; X2/X3/Y1 all killed at their own assertions. These are the findings
that were not sound.

🔴 P1 — step 11 (above)

🟡 1 — ARMED(none): a FOURTH state my own F4 made reachable

Before the atomic load, "both loads failed" implied the table had already been flushed, so
NOT-ARMED was the only reachable outcome. After F4 the previous table survives, so
ks_present is true with KS_RULESET=none — and the arm line read ARMED(none) while the
line immediately above it said FALLBACK … uplink is NOT filtered, which is now false in that
corner. Worse than meaningless: the surviving ruleset was built for a different endpoint and
fwmark, so it can read as armed while the tunnel is dead. No test covered it.

Now STALE(previous), loud, with both contradictory lines fixed. The four states are pinned
pairwise distinct across every corner of (load outcome × kernel answer), and the skill's
"three states" list is now a four-row table with a bail column.

🟡 3 — M12: the fallback path's atomicity was untested

test_the_load_is_ONE_atomic_transaction drove the harness with no failure injected, so it
only ever inspected the primary path. Open-coding the old add+flush+load inside
arm_failclosed survived all 83 tests — the "second caller open-codes the old sequence"
shape, de-atomising precisely the path that runs when things are already going wrong. Both
callers are pinned now, every rendered load must be self-contained, and a reachability
control proves the fallback actually produced a second load.

🟡 4 — $EP and $GW reached the ruleset with no validation

valid_ip — hardened for exactly this — was applied to the lighthouse only. Measured with
nft -c: a gateway-less default route (default dev eth0) makes the awk yield the literal
eth0; a peer with no endpoint makes wg show print (none); an IPv6 endpoint survives the
sed. Each fails the primary load → blanket fallback → no meta mark accept → the
tunnel dies. nft also tries to DNS-resolve these tokens, as root, inside wg-quick's
PostUp. Both producers validate now, with a positive control that valid values still land
(a validator that rejects everything is not a validator).

🟡 2 and 🟡 5 — two comments that were false

"A failure here changes NOTHING" is true of the helper and false of the composed path:
four lines later arm_failclosed replaces whatever survived with the blanket fallback. And the
\r comment still carried the theory I retracted last round — measured false, the rtrim
strips it — corrected in the test docstring but not in the script.

🟢 M5 — the 10# radix pin was unreachable, and the comment credited it anyway

The leading-zero check fired first, so deleting 10# made zero behavioural difference.
Rather than ship an untestable guard with corrected prose, the two checks are reordered:
radix-pinned range check first, leading-zero second. Identical verdict for every input, and
10# is now load-bearing — a mutant deleting it dies on value too great for base.

🟢 P3 / P4 / P5

The precondition tested existence, not up-ness (ip link show airvpn succeeds for an
interface left by a half-failed wg-quick up, and prints TUNNEL-UP) — it now requires the link
UP and a non-zero wg handshake. The install step never said to confirm the branch,
which is exactly how the deployed helper was found stale. And ARMED(fallback) was called
merely "degraded" with no instruction to bail — step 6 now says BAIL NOW for both
ARMED(fallback) and STALE(previous), so you do not walk into step 10's curl and get a
confusing failure instead of a diagnosed one.

The auditor's real X11 and X15, which my reconstruction had missed

I had guessed these from their IDs and said so. Both were the G11-shaped defect and both are
now folded in:

• X11 — printf 'NEBULA_LIGHTHOUSE=%s\n' → %s survived because the fixture asserted
  .strip()-ed content, erasing the very byte F3 is about. Now exact bytes.
• X15 — moving the whole prerequisite block to the end of the skill file survived because
  doc.index("/etc/airvpn-updown.env") is satisfied by Procedure step 1's own command. Now
  anchored on the 🔴 block's own text, plus an assertion that it still precedes ## Procedures.

The 30 leaked processes

Thank you for killing those. That was my FIFO fixture: subprocess.run kills its direct child
on timeout, but a shell blocked in open() on a writer-less FIFO can outlive it, and the X11g
mutant (which removes the -f gate) makes that reachable. The fixture now opens the write end
non-blocking and unlinks — on the green path too, because a cleanup that only fires on
failure is a cleanup that is never exercised.

---

🔴 A-1, restated (unchanged, and still REASONED not measured)

meta skuid is a firewall ACCEPT; the dropped ip route replace <lighthouse> via <gw> is a
ROUTING bypass, and the first does not restore the second. With suppress_prefixlength 0, only
a more-specific main-table route beats the tunnel default, so with the /32 gone the lighthouse
routes into the tunnel. Your audit strengthened this: meta skuid precedes the
lighthouse accept, so that accept was dominated — a no-op — in both rulesets. Only the
/32 ever mattered.

Scope: WORKBENCH-ONLY. REASONED, NOT MEASURED — I have not observed a routing table with
the /32 absent. Step 7 (ip route get <lighthouse>) is how you measure it.

---

What is measured

94 tests (was 85). Red/green: 12 failed / 82 passed at 4fa6f4f (10 distinct test
functions), 94 passed at HEAD. Both tiers agree.

🔴 Four of this round's guards are INVARIANT guards, green at base, and I am labelling them
rather than counting them as regression coverage — their value is mutation-proof, not
base-red:

guard	why it is green at base	proven by
…load_is_ONE_atomic_transaction (both callers)	the fix was in the TEST; both callers were already atomic	M12
apply fixture asserting exact bytes	the apply script already wrote the newline	X11
prereq-ordering anchored on the 🔴 block	the block was already in the right place	X15
…LEADING_ZERO_octet_is_REJECTED	the verdict is unchanged; only the check ORDER moved	M5

Mutation battery — 32 mutants, 32 killed, each at its own assertion. Two survived my first
attempt and are worth naming, because both were my own harness being weaker than it looked:

• G4b (delete the endpoint validation) survived because EP is only computed inside the
  if [[ -n "$GW" && -n "$PHYS" ]] branch — with the harness's default no-op ip, my endpoint
  test never reached endpoint_ip at all. It needed a real default route to become reachable,
  and now carries a control asserting the gateway landed.
• P1m (change the off-LAN step's source host back) survived an assertion written as
  A or B — the mutant only broke A. Now and.

group	mutants	result
original battery M1–M10	10	10 killed
audit-named survivors X2/X3/X4/X11g/X15g/Y5/Y6/Z1/Z2/Z3/Z4/Z6	12	12 killed
the auditor's real X11, X15	2	2 killed
new: M12, M5, S1, G4a, G4b, P1m, P3m, P4m, P5m	9	9 killed

Authoritative gate, re-baselined against current main (60e6d9d) — no longer attributing
anything to a pre-existing red gate, since main is green:

	origin/main (60e6d9d)	this branch
collected	6311	6405 (+94)
passed	6310	6404 (+94)
skipped	1	1
failed	0	0
verdict	RESULT: PASS	RESULT: PASS

Node tier: 1024/1024, PASS. bash -n clean on both scripts. The local (non-sandbox) tier
shows 26 failures on both main and this branch — identical set, environment-dependent,
unchanged by this PR.

Correction accepted: my test_browser_agent "ceiling crossing" diagnosis was wrong. Your
measurement (171.04s on main, 171.99s on the merged tree, 481 passed both) does not reproduce
it; the 291.68s run accompanied two real failures from the stale base, so the wall time was
inflated by an assertion timeout, not a budget crossing. Wall-time decomposition was the right
instrument and I drew the wrong conclusion from it.

What is NOT verified

• The re-test protocol. Not run — the whole of the banner at the top.
• nft -c's semantic pass (unprivileged: syntax only).
• The real up path against a real kernel. The harness stubs every external command;
  nothing here arms, disarms, routes or loads a ruleset.
• The A-1 routing claim, as stated above.
• 🔴 G10 still stands: the suite covers env resolution, ruleset RENDERING and arm-state
  derivation — not the packet-level behaviour of the chain. Nine behaviour mutants survived
  your earlier audit (inverting the uplink guard, never calling arm_failclosed, dropping the
  /32 route) and this round does not close them. That is the gap the operator protocol exists
  to cover, which is why P1 mattered.

🤖 Generated with Claude Code