Gladex Agent Logs

anchor = "# an error must never be mistaken for drift, and vice versa\n"
block = open('/tmp/opencode/probe30/block30.txt').read()
src = open(path).read()
assert src.count(anchor) == 1, src.count(anchor)
assert 'control30' not in src, 'already present'
src = src.replace(anchor, block + anchor, 1)
open(path, 'w').write(src)
print('inserted', len(block.splitlines()), 'lines')
PY
bash -n tests/test_ip_drift_cron.sh && echo "bash -n OK"; wc -l tests/test_ip_drift_cron.sh
inserted 373 lines
bash -n OK
1335 tests/test_ip_drift_cron.sh
> build · mimo-v2.6-flash-free
$ cd /data/repo && bash tests/test_ip_drift_cron.sh > /tmp/opencode/probe30/after.log 2>&1; echo "rc=$?"; tail -3 /tmp/opencode/probe30/after.log; echo "=== control30 lines ==="; grep -c "control30" /tmp/opencode/probe30/after.log; grep "FAIL" /tmp/opencode/probe30/after.log | head -20
rc=0
  ok   - C8 guard mode keeps only the two UNGUARDED opens

=== Results: 283 passed, 0 failed ===
=== control30 lines ===
59
> build · mimo-v2.6-flash-free
Green: **283 passed / 0 failed** (baseline 224 + 59). Now proving the fence can actually fail — decorative edit + plants, post-block:
$ cd /data/repo && grep -n "git " tests/test_ip_drift_cron.sh | head; echo "=== build fake tree ==="; F=/tmp/opencode/probe30/fake; rm -rf "$F"; mkdir -p "$F"; cp -a /data/repo/tests "$F/tests"; cp -a /data/repo/tools "$F/tools"; ls "$F"; echo OK
=== build fake tree ===
tests
tools
OK
> build · mimo-v2.6-flash-free
$ F=/tmp/opencode/probe30/fake; bash "$F/tests/test_ip_drift_cron.sh" > /tmp/opencode/probe30/fake-baseline.log 2>&1; echo "fake-baseline rc=$?"; tail -1 /tmp/opencode/probe30/fake-baseline.log
fake-baseline rc=0
=== Results: 283 passed, 0 failed ===
> build · mimo-v2.6-flash-free
$ cd /data/repo && python3 - <<'PY'
import re, shutil, subprocess, os
BODIES = {
    'egress is a public IP but differs from DNS.',
    'WireGuard tunnel likely DOWN (egress fell back to NAT).',
    'egress is NOT an IP address (public_ip could not be parsed).',
}
def decorate(path):
    src = open(path).read()
    pat = re.compile(r'(assert_lacks "[^"]*" \\\n *)"(' + '|'.join(re.escape(b) for b in BODIES) + r')"')
    new, n = pat.subn(r'\1"DIAGNOSIS: \2"', src)
    assert n == 6, n
    open(path, 'w').write(new)
    return n

# (a) PRE-block suite (HEAD bytes), decorated
pre = subprocess.run(['git', 'show', 'HEAD:tests/test_ip_drift_cron.sh'],
                     capture_output=True, text=True, check=True).stdout
os.makedirs('/tmp/opencode/probe30/pre/tests', exist_ok=True)
open('/tmp/opencode/probe30/pre/tests/test_ip_drift_cron.sh', 'w').write(pre)
shutil.rmtree('/tmp/opencode/probe30/pre/tools', ignore_errors=True)
shutil.copytree('/data/repo/tools', '/tmp/opencode/probe30/pre/tools')
shutil.copytree('/data/repo/tests', '/tmp/opencode/probe30/pre/tests', dirs_exist_ok=True)
open('/tmp/opencode/probe30/pre/tests/test_ip_drift_cron.sh', 'w').write(pre)
print('pre-block copy written')

# (b) POST-block suite, decorated
post = '/tmp/opencode/probe30/fake/tests/test_ip_drift_cron.sh'
shutil.copy('/data/repo/tests/test_ip_drift_cron.sh', post)
print('decorated post-block rows:', decorate(post))
# and a decorated PRE-block copy in its own tree
os.makedirs('/tmp/opencode/probe30/predec/tests', exist_ok=True)
open('/tmp/opencode/probe30/predec/tests/test_ip_drift_cron.sh', 'w').write(pre)
shutil.copytree('/data/repo/tools', '/tmp/opencode/probe30/predec/tools', dirs_exist_ok=True)
shutil.copytree('/data/repo/tests', '/tmp/opencode/probe30/predec/tests', dirs_exist_ok=True)
print('predec rows:', decorate('/tmp/opencode/probe30/predec/tests/test_ip_drift_cron.sh'))
PY
pre-block copy written
decorated post-block rows: 6
predec rows: 6
> build · mimo-v2.6-flash-free
$ cd /data/repo && python3 - <<'PY'
import re, shutil, subprocess, os
BODIES = [
    'egress is a public IP but differs from DNS.',
    'WireGuard tunnel likely DOWN (egress fell back to NAT).',
    'egress is NOT an IP address (public_ip could not be parsed).',
]
def decorate(path):
    src = open(path).read()
    pat = re.compile(r'(assert_lacks "[^"]*" \\\n *)"(' + '|'.join(re.escape(b) for b in BODIES) + r')"')
    new, n = pat.subn(r'\1"DIAGNOSIS: \2"', src)
    assert n == 6, n
    open(path, 'w').write(new)
    return n

pre = subprocess.run(['git', 'show', 'HEAD:tests/test_ip_drift_cron.sh'],
                     capture_output=True, text=True, check=True).stdout
base = '/tmp/opencode/probe30/predec'
shutil.rmtree(base, ignore_errors=True)
os.makedirs(base + '/tests')
shutil.copytree('/data/repo/tools', base + '/tools')
shutil.copytree('/data/repo/tests', base + '/tests', dirs_exist_ok=True)
open(base + '/tests/test_ip_drift_cron.sh', 'w').write(pre)   # PRE-block bytes, after the copy
print('pre-block decorated rows:', decorate(base + '/tests/test_ip_drift_cron.sh'))
print('pre file has control30?', 'control30' in open(base + '/tests/test_ip_drift_cron.sh').read())
PY
echo "=== run PRE-block suite, decorated absence needles ==="
bash /tmp/opencode/probe30/predec/tests/test_ip_drift_cron.sh > /tmp/opencode/probe30/predec.log 2>&1; echo "rc=$?"; tail -1 /tmp/opencode/probe30/predec.log
echo "=== run POST-block suite, decorated absence needles ==="
bash /tmp/opencode/probe30/fake/tests/test_ip_drift_cron.sh > /tmp/opencode/probe30/postdec.log 2>&1; echo "rc=$?"; tail -1 /tmp/opencode/probe30/postdec.log; grep "FAIL" /tmp/opencode/probe30/postdec.log
pre-block decorated rows: 6
pre file has control30? False
=== run PRE-block suite, decorated absence needles ===
rc=0
=== Results: 224 passed, 0 failed ===
=== run POST-block suite, decorated absence needles ===
rc=1
=== Results: 262 passed, 3 failed ===
  FAIL - control30 src: found 3 presence + 0 absence read(s), expected 3 + 6 — an edit changed what this block believes exists
  FAIL - control30 src: the extracted set is not the contract — 4,9d3;< lacks	$DCC	egress is NOT an IP address (public_ip could not be parsed).;< lacks	$DCC	egress is a public IP but differs from DNS.;< lacks	$DCP	WireGuard tunnel likely DOWN (egress fell back to NAT).;
  FAIL - control30 §23: this file extracted 3 of the nine class-internal reads, want 9
> build · mimo-v2.6-flash-free
$ bash /tmp/opencode/probe30/run.sh 2>&1 | tail -70
FAIL - control30 borrow public: its own diagnosis vanished, so something other than a borrow changed
                   FAIL - control30 borrow private-or-cgnat: its own diagnosis vanished, so something other than a borrow changed
                   FAIL - control30 swap public: no foreign diagnosis landed, so the rotation moved nothing
                   FAIL - control30 swap private-or-cgnat: its own diagnosis survived the rotation, so no presence row could fail here
                   FAIL - control30 swap private-or-cgnat: no foreign diagnosis landed, so the rotation moved nothing
                   FAIL - control30 private-or-cgnat: 'drift_cgnat → own diagnosis present (the four absences read a real log)' reads a log that lacks its own diagnosis
                   FAIL - control30 private-or-cgnat: the swapped writer's private-or-cgnat run still carries this diagnosis ('WireGuard tunnel likely DOWN (egress fell back to NAT).'), so 'drift_cgnat → own diagnosis present (the four absences read a real log)' would not redden there
                   FAIL - control30 public: 'drift_pub → own diagnosis present (the four absences read a real log)' reads a log that lacks its own diagnosis
                   FAIL - control30 private-or-cgnat: 'drift_cgnat → does not borrow the unparseable class's diagnosis' did not bite: the private-or-cgnat borrow carries no 'egress is NOT an IP address (public_ip could not be parsed).'
                   FAIL - control30 private-or-cgnat: the real $DCC already carries a foreign diagnosis ('egress is a public IP but differs from DNS.'), so nothing below would be a reading
                   FAIL - control30 private-or-cgnat: the PREFIXED needle matched the borrow, so this family had no reason to read bodies
                   FAIL - control30 public: the real $DCP already carries a foreign diagnosis ('WireGuard tunnel likely DOWN (egress fell back to NAT).'), so nothing below would be a reading
                   FAIL - control30 public: the PREFIXED needle matched the borrow, so this family had no reason to read bodies
                   FAIL - control30 public: 'drift_pub → does not borrow the unparseable class's diagnosis' did not bite: the public borrow carries no 'egress is NOT an IP address (public_ip could not be parsed).'
borrow-pub     rc=1  === Results: 235 passed, 17 failed
                   FAIL - drift_pub → does not borrow the private-or-cgnat class's diagnosis (unexpected: WireGuard tunnel likely DOWN (egress fell back to NAT).)
                   FAIL - drift_pub → does not borrow the unparseable class's diagnosis (unexpected: egress is NOT an IP address (public_ip could not be parsed).)
                   FAIL - control30 borrow public: the plant did not apply (this class's DIAGNOSIS line occurs 0 time(s), want exactly 1) — no planted log to read below
                   FAIL - control30 borrow private-or-cgnat: the plant did not apply (arm public moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 borrow unparseable: the plant did not apply (arm public moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 swap: the plant did not apply (a class DIAGNOSIS line occurs 0/1/1 time(s), want 1/1/1) — no swapped world to read below
                   FAIL - control30 private-or-cgnat: no swapped world to read (its plant failed above) — 'drift_cgnat → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 public: no swapped world to read (its plant failed above) — 'drift_pub → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 unparseable: no swapped world to read (its plant failed above) — 'drift_unparse → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the public class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: the real $DCP already carries a foreign diagnosis ('WireGuard tunnel likely DOWN (egress fell back to NAT).'), so nothing below would be a reading
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: the real $DCP already carries a foreign diagnosis ('egress is NOT an IP address (public_ip could not be parsed).'), so nothing below would be a reading
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the public class's diagnosis' could not be shown able to fail
borrow-cgn     rc=1  === Results: 235 passed, 17 failed
                   FAIL - drift_cgnat → does not borrow the public class's diagnosis (unexpected: egress is a public IP but differs from DNS.)
                   FAIL - drift_cgnat → does not borrow the unparseable class's diagnosis (unexpected: egress is NOT an IP address (public_ip could not be parsed).)
                   FAIL - control30 borrow public: the plant did not apply (arm private-or-cgnat moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 borrow private-or-cgnat: the plant did not apply (this class's DIAGNOSIS line occurs 0 time(s), want exactly 1) — no planted log to read below
                   FAIL - control30 borrow unparseable: the plant did not apply (arm private-or-cgnat moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 swap: the plant did not apply (a class DIAGNOSIS line occurs 1/0/1 time(s), want 1/1/1) — no swapped world to read below
                   FAIL - control30 private-or-cgnat: no swapped world to read (its plant failed above) — 'drift_cgnat → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 public: no swapped world to read (its plant failed above) — 'drift_pub → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 unparseable: no swapped world to read (its plant failed above) — 'drift_unparse → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: the real $DCC already carries a foreign diagnosis ('egress is NOT an IP address (public_ip could not be parsed).'), so nothing below would be a reading
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: the real $DCC already carries a foreign diagnosis ('egress is a public IP but differs from DNS.'), so nothing below would be a reading
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the public class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the public class's diagnosis' could not be shown able to fail
borrow-unp     rc=1  === Results: 233 passed, 19 failed
                   FAIL - unparseable → does NOT claim the egress is a public IP (unexpected: egress is a public IP but differs from DNS)
                   FAIL - unparseable → does NOT blame the tunnel either (unexpected: WireGuard tunnel likely DOWN)
                   FAIL - drift_unparse → does not borrow the public class's diagnosis (unexpected: egress is a public IP but differs from DNS.)
                   FAIL - drift_unparse → does not borrow the private-or-cgnat class's diagnosis (unexpected: WireGuard tunnel likely DOWN (egress fell back to NAT).)
                   FAIL - control30 borrow public: the plant did not apply (arm unparseable moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 borrow private-or-cgnat: the plant did not apply (arm unparseable moved — the plant is not surgical) — no planted log to read below
                   FAIL - control30 borrow unparseable: the plant did not apply (this class's DIAGNOSIS line occurs 0 time(s), want exactly 1) — no planted log to read below
                   FAIL - control30 swap: the plant did not apply (a class DIAGNOSIS line occurs 1/1/0 time(s), want 1/1/1) — no swapped world to read below
                   FAIL - control30 private-or-cgnat: no swapped world to read (its plant failed above) — 'drift_cgnat → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 public: no swapped world to read (its plant failed above) — 'drift_pub → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 unparseable: no swapped world to read (its plant failed above) — 'drift_unparse → own diagnosis present (the four absences read a real log)' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 private-or-cgnat: no planted log to read (its plant failed above) — 'drift_cgnat → does not borrow the public class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 public: no planted log to read (its plant failed above) — 'drift_pub → does not borrow the unparseable class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: the real $DCU already carries a foreign diagnosis ('WireGuard tunnel likely DOWN (egress fell back to NAT).'), so nothing below would be a reading
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the private-or-cgnat class's diagnosis' could not be shown able to fail
                   FAIL - control30 unparseable: the real $DCU already carries a foreign diagnosis ('egress is a public IP but differs from DNS.'), so nothing below would be a reading
                   FAIL - control30 unparseable: no planted log to read (its plant failed above) — 'drift_unparse → does not borrow the public class's diagnosis' could not be shown able to fail
> build · mimo-v2.6-flash-free
$ for f in swap borrow-pub borrow-cgn borrow-unp; do printf '%-12s ' "$f"; grep -o '=== Results: [0-9]* passed, [0-9]* failed' /tmp/opencode/probe30/$f.log | tail -1; done; echo "=== swap probe, control30 reds only ==="; sed -n '/=== Results/q;p' /tmp/opencode/probe30/swap.log | grep "FAIL - control30" | wc -l; grep "FAIL" /tmp/opencode/probe30/swap.log | head -3; tail -1 /tmp/opencode/probe30/swap.log
swap         === Results: 264 passed, 19 failed
borrow-pub   === Results: 235 passed, 17 failed
borrow-cgn   === Results: 235 passed, 17 failed
borrow-unp   === Results: 233 passed, 19 failed
=== swap probe, control30 reds only ===
14
  FAIL - CGNAT → diagnosis says the tunnel is likely down (missing: WireGuard tunnel likely DOWN)
  FAIL - drift_pub → own diagnosis present (the four absences read a real log) (missing: egress is a public IP but differs from DNS.)
  FAIL - drift_pub → does not borrow the private-or-cgnat class's diagnosis (unexpected: WireGuard tunnel likely DOWN (egress fell back to NAT).)
=== Results: 264 passed, 19 failed ===

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Mon Oct  5 19:01:02 2026] 127.0.0.1:38944 Accepted
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38944 Closing
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38950 Accepted
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38950 Closing
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38960 Accepted
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38960 Closing
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38964 Accepted
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38964 Closing
[Mon Oct  5 19:01:02 2026] 127.0.0.1:38966 Accepted
[Mon Oct  5 19:01:03 2026] 127.0.0.1:38966 Closing
[Mon Oct  5 19:01:03 2026] 127.0.0.1:38982 Accepted
[Mon Oct  5 19:01:03 2026] 127.0.0.1:38982 Closing
[Mon Oct  5 19:08:16 2026] 127.0.0.1:40148 Accepted
[Mon Oct  5 19:08:16 2026] 127.0.0.1:40148 Closing
[Mon Oct  5 19:09:39 2026] 127.0.0.1:41944 Accepted
[Mon Oct  5 19:09:39 2026] 127.0.0.1:41944 Closing
[Mon Oct  5 19:09:39 2026] 127.0.0.1:41952 Accepted
[Mon Oct  5 19:09:39 2026] 127.0.0.1:41952 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58184 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58184 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58192 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58192 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58202 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58202 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58214 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58214 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58220 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58220 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58224 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58224 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58232 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58232 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58242 Accepted
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58242 Closing
[Mon Oct  5 19:15:09 2026] 127.0.0.1:58258 Accepted
[Mon Oct  5 19:15:10 2026] 127.0.0.1:58258 Closing
[Mon Oct  5 19:15:10 2026] 127.0.0.1:58274 Accepted
[Mon Oct  5 19:15:10 2026] 127.0.0.1:58274 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36532 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36532 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36538 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36538 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36542 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36542 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36554 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36554 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36556 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36556 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36570 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36570 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36578 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36578 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36588 Accepted
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36588 Closing
[Mon Oct  5 19:15:56 2026] 127.0.0.1:36602 Accepted
[Mon Oct  5 19:15:57 2026] 127.0.0.1:36602 Closing
[Mon Oct  5 19:15:57 2026] 127.0.0.1:36610 Accepted
[Mon Oct  5 19:15:57 2026] 127.0.0.1:36610 Closing
[Mon Oct  5 19:28:49 2026] 127.0.0.1:60092 Accepted