funman300
4156dc5810
The reboot-survival gate is a test no operator can stand inside: the machine under test is the machine running the session. So the machine records its own recovery. openfut-boot-evidence.service polls until the anchor, Core and host agree on a namespace (or a 180s deadline expires), then writes a JSON file with the boot id, anchor/Core/host pids and netns inodes, unit states, restart counts, whether the reconciler had to act this boot, mount count, four non-mutating probes, route ownership, and the full economy snapshot — plus the journal for the boot so ordering is read from real timestamps rather than inferred from unit dependencies. It observes only; it never starts, stops or repairs anything, and carries no Requires= or ordering that anything else waits on, so it cannot affect the boot it is measuring. If the chain is broken the file says so, which is the point. Polling rather than a fixed sleep means a boot-time reconcile retry is recorded as "settled late" rather than as a failure.
21 lines
719 B
Desktop File
21 lines
719 B
Desktop File
[Unit]
|
|
Description=OpenFUT: record unattended proof that supervision recovered after boot
|
|
Documentation=file:///home/alex/OpenFUT/scripts/systemd/README.md
|
|
After=openfut-host.service openfut-netns-reconcile.timer docker.service
|
|
Wants=openfut-host.service
|
|
# Observation only. Deliberately no Requires= and no ordering that anything else
|
|
# waits on: this unit must never be able to affect the boot it is measuring.
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/home/alex/OpenFUT/scripts/systemd/openfut-boot-evidence.sh
|
|
TimeoutStartSec=300
|
|
# Never fail the boot over evidence collection.
|
|
SuccessExitStatus=0 1
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=openfut-boot-evidence
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|