Skip to content

vms-843a: wrapped OpenSSH sshd on a booted distro via the aux-launch path — inbound SSH lands an authenticated DCL session - #1128

Open
baron-3dl wants to merge 1 commit into
mainfrom
work/vms-843a-ssh-launch
Open

vms-843a: wrapped OpenSSH sshd on a booted distro via the aux-launch path — inbound SSH lands an authenticated DCL session#1128
baron-3dl wants to merge 1 commit into
mainfrom
work/vms-843a-ssh-launch

Conversation

@baron-3dl

@baron-3dl baron-3dl commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

What

Launch the wrapped OpenSSH sshd (VMSSSHD.EXE) on a booted OVMX distro via the proven (B) TCP/IP aux-server ACP-stage path (vms-21b / #1116), and prove an inbound ssh SYSTEM@host password login lands an authenticated DCL session — SSH → SYSUAF → DCL, end to end. SSH is the second, harder rider on the launch mechanism daytime proved first.

The wrapped-OpenSSH engine + SYSUAF-auth→LOGINOUT→DCL was already proven in-process by vms-9cc/vms-0cd (sshd -D over BGn:, unmodified OpenSSH 10.0p1, all OVMX behavior via linker --wrap). This rung proves it on a booted distro over the aux-launch path.

Mechanism

Overlay TCPIP$SERVICE.DAT enables one service:

SSH 22 SYS$SYSTEM:VMSSSHD.EXE -i -f /ovmxsshsrv/etc/sshd_config

TCPIP$INETD binds :22 over the executive BGn: seam, accepts, ACP-stages SYS$SYSTEM:VMSSSHD.EXE off the ODS-2 disk (rms_stage_over_acp→execve, the proven vms-21b path), and execs sshd -i on the accepted fd (dup2'd to stdin/stdout). The wrapped sshd authenticates the password against the binary SYSUAF (Purdy) and drops into LOGINOUT → DCL, all bytes over the executive socket.

Privsep residue (conductor ruling)

OpenSSH re-execs its privsep siblings sshd-session/sshd-auth at the configure-baked --libexecdir (/ovmxsshsrv/libexec) + needs the privsep dir /ovmxsshsrv/empty; those + a fresh host key + the sshd_config are placed on the initramfs (the booted Linux VFS) at their baked paths — SSH-specific residue beside the ACP-stage mechanism. VMSSSHD.EXE (the parent) rides the SYS$SYSTEM: ACP-stage path, proving the rung.

Posture (Baron-reserved, held OFF — layered-product model, enforced by a committed guard)

On real OpenVMS, TCP/IP Services is a layered product — the shipped base OS ships no SSH. All SSH staging + auto-start is gated behind --build-arg OVMX_TEST_ENABLE_SSH=1 (the proof overlay). The posture guard gains an explicit SSH-off assertion: it reds if the shipped SERVICE.DAT ever enables SSH. SSH-enable-by-default (network login authority + shipped host key) stays an operator decision.

Reap gate (green-by-SHA)

  1. ssh-boot-e2e green-by-SHA — a test-overlay cold boot: INETD launches SYS$SYSTEM:VMSSSHD.EXE via the ACP-stage path, an inbound ssh SYSTEM@ password login lands DCL (marker OVMX_DCL_LANDED_843a), and a wrong password does NOT reach DCL (INV-6, auth is real). CI job, vms-f834 hole-free trigger; a 77 SKIP is a hard error (must genuinely boot + ssh, never skip).
  2. byte-reproducible stays green (shipped build sets OVMX_TEST_ENABLE_SSH=0 → skips all SSH staging → initramfs/disk unchanged).
  3. cross-arch parity stays green (image_parity.py excludes the OVMX_TEST_ENABLE_SSH overlay block; 20/20 self-tests).
  4. posture-guard (extended: shipped SSH-off).

Local: parity OK, posture PASS (incl. SSH-off), parity self-tests 20/20, ci.yml parses. The booted SSH→DCL proof is CI's authoritative venue (heavy full-distro build+boot). Closes the SSH rung on the proven aux-launch path (rd vms-843a).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WUoqjXxYWfFSECRzvAPiXH

@baron-3dl baron-3dl mentioned this pull request Sep 14, 2026
Merged
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
c9c4457 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
a5b6f0d 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
360119c 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
10b4d98 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
69497e6 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
b433360 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
3c69ba4 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
60e0245 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
4072092 
…ecutive netlogin-trust conveyance

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl added a commit that referenced this pull request Sep 14, 2026
@baron-3dl @claude
vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + ex…
30742bb 
…ecutive netlogin-trust conveyance (#1229)

Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).

vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
  - VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
    network daemon vouches the authed user onto the RTAn: it minted.
  - VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
    bound to that terminal reads the note back for ITS OWN terminal; empty
    is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
  netlogin_user field on struct vms_device (both substrate copies); handlers
  in the shared kernel-core; wired through all registration sites (Linux +
  NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
  note is a NAME, never a credential -- LOGINOUT still builds the persona
  from the binary SYSUAF record and grants nothing beyond it.

vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).

vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.

Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).

The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.

CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
  resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
  wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
  precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
  raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
  cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
  proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
  the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
  lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
  OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.

- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
  vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
  LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
  test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
  the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
  that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
  LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.


Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@baron-3dl @claude
vms-843a: SSH cold-boot transport (ssh-boot-e2e) rebased onto the lan…
11534da 
…ded handoff engineering (#1229)

The 11 transport files for the booted-distro `ssh SYSTEM@ -> DCL $` proof,
rebased onto post-#1229 main. The vms-29b/65b handoff engineering is now landed
on main, so this carries ONLY the transport -- no engineering, no cherry-pick:

- distro/Dockerfile.bootable: OVMX_TEST_ENABLE_SSH overlay build (wrapped OpenSSH
  sshd + privsep + hostkey/config), SSH-off by default (layered-product posture).
- distro/rootfs-test-ssh/ + TCPIP$SSH_STARTUP.COM: SSH-enabled overlay that
  RUN/DETACHEDs the wrapped sshd (-D; __wrap_main injects -D -e -f).
- tests/qemu/{run_,}ssh_boot_e2e.sh + ci.yml ssh-boot-e2e job: boot the distro,
  ssh SYSTEM@ (pw MANAGER), assert OVMX_DCL_LANDED_843a; wrong-pw negative.
- third-party/openssh/ovmx/ovmx_ssh_wrap.c: __wrap_main -D injection.
- tools/parity/image_parity.py + tests/integration/test_tcpip_posture_guard.sh:
  overlay-arg parity + shipped-SSH-off posture guard.

Carry-forwards verified against post-#1229 main:
(1) pw_shell resolves via ovmx_sshd_loginout_path -> ovmx_boot_stage_exec_path ->
    /run/ovmx-boot/LOGINOUT.EXE, which PID 1 stages (ovmx_init.c mandatory boot
    set, uppercase-matched by ovmx_boot_stage_exec_path) -> OpenSSH's shell-
    existence stat passes on the booted distro (unlike the bare-KE env);
(2) the e2e asserts on the ssh CLIENT stdout marker (whole-file grep -qF), not a
    truncatable sshd-log head read -- no analog of the KE log-scan fix needed.

The live ssh->DCL cold-boot e2e (vms-237) is the "verified" bracket.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
@baron-3dl
baron-3dl force-pushed the work/vms-843a-ssh-launch branch from 22d64c7 to 11534da Compare September 14, 2026 20:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@baron-3dl