AI-window failsafe arming check self-matches: pgrep -f 'sleep 4200' reports armed when nothing is armed #89

New Issue

2026-08-30T02:47:09-04:00

logan commented

2026-08-30 02:47:09 -04:00

Found and reproduced during the unattended run of 2026-08-30. Searched open and closed for a duplicate: none. This is a live money defect in the operating procedure, not in shipped code.

The defect

.claude/scheduled/drb-worksession.md STEP 5a arms a server-side shutoff so an AI evaluation window closes even if the agent crashes, then confirms it with:

ssh drb "pgrep -f 'sleep 4200'"

Run over SSH, the literal string sleep 4200 is part of the remote shell's own command line. pgrep -f matches against the full command line, so it matches itself and prints a PID whether or not the failsafe was ever armed.

Reproduction, 2026-08-30

ssh drb 'pgrep -f "sleep 4200"' → returned PID 2867433.
ssh drb 'ps -o pid,etime,cmd -p 2867433' → no such process. It was the pgrep's own SSH shell.
ssh drb 'pgrep -af "sleep 42[0]0" || echo NONE_ARMED' → NONE_ARMED.

The process table was empty of failsafes the whole time. The check said otherwise.

Why this one matters

STEP 5a's own rule is "If arming fails, DO NOT open the window." That rule is the only thing standing between a crashed run and an AI window that bills every minute until a human notices. The check meant to enforce it cannot fail, so the rule has never actually been tested — every run so far has believed it was protected.

The same self-match is in the STEP 5d teardown, pkill -f 'sleep 4200'. There pkill would try to kill the SSH shell issuing it, so the teardown can report having done something while a real failsafe survives and fires against a later window, closing it early and wasting the spend that window was opened to justify.

Fixed in the runbook this run

Both call sites now use a self-excluding bracket pattern, plus an explicit liveness re-check and a NONE_ARMED sentinel:

ssh drb "pgrep -af 'sleep 42[0]0' || echo NONE_ARMED"
ssh drb "pkill -f 'sleep 42[0]0'"

NONE_ARMED, or a PID not still alive on a second check, now counts as arming failed.

Second, smaller drift fixed in the same pass

The runbook told each run to write the shutoff to drb:/opt/drb/ai_off.py. The working tooling has actually lived at /opt/drb/aiwin/ since 2026-08-26 — ai_on.py, ai_off.py, ai_state.py, ai_common.py, corr_dump.py and .sh wrappers. Following the runbook literally meant re-creating a file next to a working copy at a different path, with the wrapper still pointing at the old one. The runbook now names /opt/drb/aiwin/ and says to reuse what is there.

State confirmed while checking, both good

No failsafe is currently armed.
AI is off in production — stt_enabled: false, correlation_enabled: false. No window was left open. Last window ran 2026-08-26.

Why this is filed rather than just fixed

The runbook is a local file at the Version 5C root, which is not a git repository, so the fix has no commit and no history. This issue is the durable record. Related: #57 (standing correlation-quality evaluation procedure) owns the window procedure and should absorb this if it is ever rewritten.

Refs #57, #62.

Found and **reproduced** during the unattended run of 2026-08-30. Searched open and closed for a duplicate: none. This is a live money defect in the operating procedure, not in shipped code. ## The defect `.claude/scheduled/drb-worksession.md` STEP 5a arms a server-side shutoff so an AI evaluation window closes even if the agent crashes, then confirms it with: ``` ssh drb "pgrep -f 'sleep 4200'" ``` Run over SSH, the literal string `sleep 4200` **is part of the remote shell's own command line**. `pgrep -f` matches against the full command line, so it matches itself and prints a PID **whether or not the failsafe was ever armed**. ## Reproduction, 2026-08-30 - `ssh drb 'pgrep -f "sleep 4200"'` → returned PID `2867433`. - `ssh drb 'ps -o pid,etime,cmd -p 2867433'` → **no such process**. It was the pgrep's own SSH shell. - `ssh drb 'pgrep -af "sleep 42[0]0" || echo NONE_ARMED'` → `NONE_ARMED`. The process table was empty of failsafes the whole time. The check said otherwise. ## Why this one matters STEP 5a's own rule is **"If arming fails, DO NOT open the window."** That rule is the only thing standing between a crashed run and an AI window that bills every minute until a human notices. The check meant to enforce it **cannot fail**, so the rule has never actually been tested — every run so far has believed it was protected. The same self-match is in the STEP 5d teardown, `pkill -f 'sleep 4200'`. There `pkill` would try to kill the SSH shell issuing it, so the teardown can report having done something while a real failsafe survives and fires against a *later* window, closing it early and wasting the spend that window was opened to justify. ## Fixed in the runbook this run Both call sites now use a self-excluding bracket pattern, plus an explicit liveness re-check and a `NONE_ARMED` sentinel: ``` ssh drb "pgrep -af 'sleep 42[0]0' || echo NONE_ARMED" ssh drb "pkill -f 'sleep 42[0]0'" ``` `NONE_ARMED`, or a PID not still alive on a second check, now counts as **arming failed**. ## Second, smaller drift fixed in the same pass The runbook told each run to write the shutoff to `drb:/opt/drb/ai_off.py`. The working tooling has actually lived at **`/opt/drb/aiwin/`** since 2026-08-26 — `ai_on.py`, `ai_off.py`, `ai_state.py`, `ai_common.py`, `corr_dump.py` and `.sh` wrappers. Following the runbook literally meant re-creating a file next to a working copy at a different path, with the wrapper still pointing at the old one. The runbook now names `/opt/drb/aiwin/` and says to reuse what is there. ## State confirmed while checking, both good - **No failsafe is currently armed.** - **AI is off in production** — `stt_enabled: false`, `correlation_enabled: false`. No window was left open. Last window ran 2026-08-26. ## Why this is filed rather than just fixed The runbook is a local file at the `Version 5C` root, which is not a git repository, so the fix has no commit and no history. This issue is the durable record. Related: #57 (standing correlation-quality evaluation procedure) owns the window procedure and should absorb this if it is ever rewritten. Refs #57, #62.

logan referenced this issue

2026-08-31 02:45:50 -04:00

Board 2026-08-31 - Dev progress, the #64 side-door, and the past-due credential docket - COO draft #90

logan commented

2026-08-31 02:45:54 -04:00

Closing - fixed and verified, unattended run 2026-08-31.

Both halves of this now use a pattern that cannot match itself:

.claude/scheduled/drb-worksession.md (sections 5a and 5d) uses pgrep -af 'sleep 42[0]0', and carries an explicit warning explaining why the naive pattern self-matches over SSH and why a false positive here is the dangerous direction - it would open an AI window with no backstop at all.
The server-side tooling at drb:/opt/drb/aiwin/ (ai_common.py, ai_off.py, ai_on.py, ai_state.py, corr_dump.py) contains no occurrence of pgrep -f 'sleep 4200' anywhere.

No broken occurrence of the self-matching check remains in either the runbook or the server tooling.

**Closing - fixed and verified, unattended run 2026-08-31.** Both halves of this now use a pattern that cannot match itself: - `.claude/scheduled/drb-worksession.md` (sections 5a and 5d) uses `pgrep -af 'sleep 42[0]0'`, and carries an explicit warning explaining why the naive pattern self-matches over SSH and why a false positive here is the dangerous direction - it would open an AI window with no backstop at all. - The server-side tooling at `drb:/opt/drb/aiwin/` (`ai_common.py`, `ai_off.py`, `ai_on.py`, `ai_state.py`, `corr_dump.py`) contains **no** occurrence of `pgrep -f 'sleep 4200'` anywhere. No broken occurrence of the self-matching check remains in either the runbook or the server tooling.

logan closed this issue

2026-08-31 02:46:01 -04:00

logan referenced this issue

2026-09-01 02:45:01 -04:00

Board 2026-08-31 - Dev progress, the #64 side-door, and the past-due credential docket - FINAL MINUTES #97

logan referenced this issue

2026-09-01 02:46:36 -04:00

Board process defect: the 2026-08-31 sitting filed four drafts and no final minutes for 24h #99

logan added the area/governance

type

bug

labels 2026-10-05 02:04:41 -04:00