feat(bug): report builder, breadbug CLI and design doc #23

Merged

Breadway merged 8 commits from feature/breadbug-report into main 2026-10-14 10:45:04 +08:00

Conversation 2 Commits 8 Files changed 15 +1881

Breadway commented 2026-10-09 09:40:50 +08:00

Owner

Copy link

Closes BREAD-19, ECO-66

Stacked on #22 (store), which is stacked on #21 (scrubber). Retarget to main as they merge. Part of ECO-EP1.

What

• bread-bug: versioned report schema (v1), builder, system facts (OS, kernel, GPU drivers with PCI ids, compositor, bakery track, versions), journalctl --user tail, breadd IPC client, runtime summary, installed-app picker (installed apps only, recent crash/freeze first; store apps as fallback without bakery state).
• The report is built once, run through a fresh scrubber (build-ids exempt), serialized and hashed. Preview, --save and the future upload use the same bytes; Prepared::verify() guards the hash. Payload capped at 1 MiB (journal trimmed first, then oldest events and logs).
• New breadbug binary: interactive picker, report type (defaults from the last marker), notes, preview with per-section counts, scrubber counts and SHA-256, view/file/send/cancel. Flags: --app --type --notes --dry-run --save --send, list, config upload on|off. Works with breadd stopped. EOF at any prompt cancels cleanly.
• Sending is refused while upload is off (default). The upload client is BREAD-21; this PR only wires the guard.
• docs/breadbug.md is the ECO-66 deliverable: flow, store layout, scrubbing, schema table, consent copy, endpoint threat model. README gains a short section.

Tests

• 18 new bread-bug tests (no seeded PII in the payload, bytes/hash/save identical, deterministic builds, notes truncation, payload trim, invalid app, picker ordering and installed filtering, system parsing, runcmd timeout, IPC client).
• 11 CLI tests driving the interactive flow with scripted input.
• clippy -D warnings clean, xtask check-docs passes.

Not here

• Shipping the breadbug binary in bakery/CI release lists is part of BOS-86 packaging; release pipelines are kept out of this PR.
• GUI (BREAD-20), upload client (BREAD-21).

Closes BREAD-19, ECO-66 Stacked on #22 (store), which is stacked on #21 (scrubber). Retarget to main as they merge. Part of ECO-EP1. ## What - `bread-bug`: versioned report schema (v1), builder, system facts (OS, kernel, GPU drivers with PCI ids, compositor, bakery track, versions), `journalctl --user` tail, breadd IPC client, runtime summary, installed-app picker (installed apps only, recent crash/freeze first; store apps as fallback without bakery state). - The report is built once, run through a fresh scrubber (build-ids exempt), serialized and hashed. Preview, `--save` and the future upload use the same bytes; `Prepared::verify()` guards the hash. Payload capped at 1 MiB (journal trimmed first, then oldest events and logs). - New `breadbug` binary: interactive picker, report type (defaults from the last marker), notes, preview with per-section counts, scrubber counts and SHA-256, view/file/send/cancel. Flags: `--app --type --notes --dry-run --save --send`, `list`, `config upload on|off`. Works with breadd stopped. EOF at any prompt cancels cleanly. - Sending is refused while upload is off (default). The upload client is BREAD-21; this PR only wires the guard. - `docs/breadbug.md` is the ECO-66 deliverable: flow, store layout, scrubbing, schema table, consent copy, endpoint threat model. README gains a short section. ## Tests - 18 new bread-bug tests (no seeded PII in the payload, bytes/hash/save identical, deterministic builds, notes truncation, payload trim, invalid app, picker ordering and installed filtering, system parsing, runcmd timeout, IPC client). - 11 CLI tests driving the interactive flow with scripted input. - clippy `-D warnings` clean, `xtask check-docs` passes. ## Not here - Shipping the `breadbug` binary in bakery/CI release lists is part of BOS-86 packaging; release pipelines are kept out of this PR. - GUI (BREAD-20), upload client (BREAD-21).

Breadway added 1 commit 2026-10-09 09:40:50 +08:00

feat(bug): report builder and breadbug CLI ... 89c1e5da7f

bread-bug gains the versioned report schema, builder, system facts,
journal tail, breadd IPC client and the installed-app picker. The report
is built once, scrubbed again with a fresh scrubber, serialized and hashed;
the same bytes are previewed and saved. The payload is capped at 1 MiB.

New breadbug binary: interactive app picker, report type, notes, preview
with scrubber counts and SHA-256, save to file or cancel, plus --app,
--type, --notes, --dry-run, --save, --send and 'config upload on|off'.
Sending is refused while upload is off (the default); the upload client
itself lands separately.

docs/breadbug.md is the design doc: flow, store layout, scrubbing, schema,
consent copy and the endpoint threat model.

Refs BREAD-19, ECO-66

Breadway referenced this pull request 2026-10-09 09:40:51 +08:00

feat(bug): freeze watchdog and consented live stack capture #24

Breadway referenced this pull request 2026-10-12 22:40:57 +08:00

feat(scrub): bread-scrub, allowlist-first PII scrubber for breadbug #21

Breadway added 2 commits 2026-10-13 12:05:34 +08:00

Merge branch 'feature/breadbug-store' into feature/breadbug-report fd5dde943b

test(breadbug): verify restart and report privacy across passes b445144b58

Breadway added 1 commit 2026-10-13 12:07:00 +08:00

Merge branch 'feature/breadbug-store' into feature/breadbug-report 911735587c

Breadway referenced this pull request 2026-10-13 20:59:56 +08:00

feat(scrub): bread-scrub, allowlist-first PII scrubber for breadbug #21

Breadway added 2 commits 2026-10-14 08:51:39 +08:00

Merge pull request 'feat(bug): breadd on-disk log/event store and bug.* IPC methods' (#22) from feature/breadbug-store into main ... aea9879d61

feat(bug): breadd on-disk log/event store and bug.* IPC methods

Merge remote-tracking branch 'origin/main' into feature/breadbug-report bba90c3785

Breadway changed target branch from feature/breadbug-store to main 2026-10-14 08:52:13 +08:00

Breadway commented 2026-10-14 10:32:31 +08:00

Author

Owner

Copy link

Independent review PASS at exact head bba90c3785 (base aea9879d61). Merge of origin/main into feature/breadbug-report; the only delta from main is the report work (15 files, +1881). Store, shared apps, breadd bugstore and ci/bread-ecosystem.rev changes versus the pre-merge feature parent are the already-merged main side, not new report code.

BREAD-19 criteria:

• Installed-app picker, recent crash/freeze first, store fallback: bread-bug/src/report.rs app_entries; report/tests.rs picker_orders_problem_apps_first_and_limits_to_installed; breadbug list test.
• Versioned schema v1 and contents (frames, versions, kernel, GPU/driver, compositor, bakery track, installed apps, runtime, events, journal): report.rs Report plus system.rs gather/parse_installed. Journal and compositor are best-effort helpers (runcmd timeout); tests pin parsing, not live hardware.
• Built once, hashed, preview/save/send use those bytes: Prepared::from_report/verify/save; bytes_hash_verify_and_save_match; CLI save vs dry-run (created_unix stripped) and interactive view-then-save.
• Notes scrubbed, warning shown, 8 KiB cap: ask_notes; scrub_report; long_notes test; reopened_store_markers_and_report_notes_remain_distinct.
• Report types crash/freeze/behavior with marker default: ReportType and default_type_for; interactive test.
• Send / save / cancel, never send without an action: review_loop and noninteractive_without_action_sends_nothing. Upload client is BREAD-21; --send refuses while upload is off (default) and still refuses when on ("not available in this build").
• Flags --app, --save, --dry-run, plus --type/--notes/--send, list, config upload: breadbug/src/lib.rs. Dry-run prints prepared.bytes.
• TTY fallback and breadd-down: stdin/stdout terminal gate; build reads Reader on disk and treats a missing socket as daemon_running false. Tests use a missing socket.
• Screenshots absent.

Two-pass (kept open on BREAD-15 and BREAD-37, not closed by this merge): ingest scrub is Store::append_log/append_event/record_marker (already on main via PR22, including reserve_retained_markers). Report-time scrub is scrub_report: a fresh Scrubber, keep_build_id, scrub_value over the whole report including notes. On this branch the composition holds: reopened_store_markers_and_report_notes_remain_distinct stores 203.0.113.42, reopens, stores 198.51.100.8, then a report note 192.0.2.9 plus a credential URL, and the payload is IP:1, IP:2, IP:3 and with none of the seeds left. That is branch evidence, not yet integrated-main verification. BREAD-15 and BREAD-37 stay in review.

Checks: required feature-branch workflow is check.yml (push to feature/** and fix/**). Exact head status check / check (push) success, updated 2026-10-14T09:02:18+08:00, run 143 task 2416, job check success in 10m40s. Steps all success: Set up job, checkout 4s, clippy 4m39s, build --workspace 2m29s, test 3m27s, Complete job. Commit link is bba90c3785. No branch protection contexts. Reviews API empty. dev-release.yml runs only on main, so it is not a required check for this head.

Independent tests in an isolated worktree (CARGO_TARGET_DIR under /tmp/opencode, primary checkout untouched): cargo test -p bread-bug -p breadbug --locked --lib: 47 + 11 passed. cargo clippy -p bread-bug -p breadbug --all-targets --locked -D warnings: clean. cargo run -p xtask --locked -- check-docs: OK.

Not full-card done: coordinator still verifies the two-pass behavior on integrated main. feature/breadbug-report is not deleted (PR 24 is stacked on it).

Independent review PASS at exact head bba90c3785dc95385e4e0bd71181b3d418b64172 (base aea9879d61deaf55000ec7b5a377e79299170232). Merge of origin/main into feature/breadbug-report; the only delta from main is the report work (15 files, +1881). Store, shared apps, breadd bugstore and ci/bread-ecosystem.rev changes versus the pre-merge feature parent are the already-merged main side, not new report code. BREAD-19 criteria: - Installed-app picker, recent crash/freeze first, store fallback: bread-bug/src/report.rs app_entries; report/tests.rs picker_orders_problem_apps_first_and_limits_to_installed; breadbug list test. - Versioned schema v1 and contents (frames, versions, kernel, GPU/driver, compositor, bakery track, installed apps, runtime, events, journal): report.rs Report plus system.rs gather/parse_installed. Journal and compositor are best-effort helpers (runcmd timeout); tests pin parsing, not live hardware. - Built once, hashed, preview/save/send use those bytes: Prepared::from_report/verify/save; bytes_hash_verify_and_save_match; CLI save vs dry-run (created_unix stripped) and interactive view-then-save. - Notes scrubbed, warning shown, 8 KiB cap: ask_notes; scrub_report; long_notes test; reopened_store_markers_and_report_notes_remain_distinct. - Report types crash/freeze/behavior with marker default: ReportType and default_type_for; interactive test. - Send / save / cancel, never send without an action: review_loop and noninteractive_without_action_sends_nothing. Upload client is BREAD-21; --send refuses while upload is off (default) and still refuses when on ("not available in this build"). - Flags --app, --save, --dry-run, plus --type/--notes/--send, list, config upload: breadbug/src/lib.rs. Dry-run prints prepared.bytes. - TTY fallback and breadd-down: stdin/stdout terminal gate; build reads Reader on disk and treats a missing socket as daemon_running false. Tests use a missing socket. - Screenshots absent. Two-pass (kept open on BREAD-15 and BREAD-37, not closed by this merge): ingest scrub is Store::append_log/append_event/record_marker (already on main via PR22, including reserve_retained_markers). Report-time scrub is scrub_report: a fresh Scrubber, keep_build_id, scrub_value over the whole report including notes. On this branch the composition holds: reopened_store_markers_and_report_notes_remain_distinct stores 203.0.113.42, reopens, stores 198.51.100.8, then a report note 192.0.2.9 plus a credential URL, and the payload is <IP:1>, <IP:2>, <IP:3> and <CRED> with none of the seeds left. That is branch evidence, not yet integrated-main verification. BREAD-15 and BREAD-37 stay in review. Checks: required feature-branch workflow is check.yml (push to feature/** and fix/**). Exact head status check / check (push) success, updated 2026-10-14T09:02:18+08:00, run 143 task 2416, job check success in 10m40s. Steps all success: Set up job, checkout 4s, clippy 4m39s, build --workspace 2m29s, test 3m27s, Complete job. Commit link is bba90c3785dc95385e4e0bd71181b3d418b64172. No branch protection contexts. Reviews API empty. dev-release.yml runs only on main, so it is not a required check for this head. Independent tests in an isolated worktree (CARGO_TARGET_DIR under /tmp/opencode, primary checkout untouched): cargo test -p bread-bug -p breadbug --locked --lib: 47 + 11 passed. cargo clippy -p bread-bug -p breadbug --all-targets --locked -D warnings: clean. cargo run -p xtask --locked -- check-docs: OK. Not full-card done: coordinator still verifies the two-pass behavior on integrated main. feature/breadbug-report is not deleted (PR 24 is stacked on it).

Breadway merged commit 6699643099 into main 2026-10-14 10:45:04 +08:00

Breadway referenced this pull request from a commit 2026-10-14 10:45:05 +08:00

Merge pull request 'feat(bug): report builder, breadbug CLI and design doc' (#23) from feature/breadbug-report into main

Breadway referenced this pull request 2026-10-14 10:45:38 +08:00

breadbug: CLI and report builder (app picker, preview, notes, save to file) #18

Breadway commented 2026-10-14 12:38:00 +08:00

Author

Owner

Copy link

Independent ECO-66 design deliverable review

Reviewed immutable PR head bba90c3785dc95385e4e0bd71181b3d418b64172 and integrated at merge commit 6699643099a82023ab1334b2e1bd0304b8e9d862. Verdict: changes requested for ECO-66 design-only acceptance. PR is merged; this comment does not request reopening or alter the merge.

• Versioned schema: present (schema: 1), but schema includes live_stack frames despite the hard requirement that crash data contain frames only and no process memory; docs must explicitly constrain this to a user-consented, metadata-only stack capture, or remove it from v1 schema. docs/breadbug.md, schema table and preceding scrub rules.
• Privacy/scrub allowlist: structured event field examples and free-text best-effort redactions are documented, but other schema fields (notably system, installed_apps, runtime, markers, logs and journal) lack precise field-by-field allowlist constraints. State the allowed keys/types/lengths and explicit exclusions for sensitive apps and sensitive values; broad claims of scrub coverage are not adequate. docs/breadbug.md, Scrubbing and Report schema.
• Consent copy: present and clearly says nothing is sent without Send, with save path. It omits the upload toggle being off by default and exact reporting target/retention/deletion implications. Add plain-language copy covering destination, anonymous identifier/rate limiting, retention and delete-by-receipt, or explicitly mark unknown rollout policy.
• Public endpoint threat model: present with hostile-input threats, validation, size/rate caps, isolation, escaping and retention. Add concrete trust boundaries and mitigations for public endpoint exposure behind Aegis, anonymous install-id rotation/abuse, and symbolication/debug-symbol store access.

CI evidence: exact head status check / check (push) success. PR metadata confirms merged=true and merge SHA above. Design completion is separate from ECO-66 release-pipeline rollout; no claim is made that rollout requirements are implemented. Please update the design doc and obtain a fresh review.

## Independent ECO-66 design deliverable review Reviewed immutable PR head `bba90c3785dc95385e4e0bd71181b3d418b64172` and integrated at merge commit `6699643099a82023ab1334b2e1bd0304b8e9d862`. Verdict: **changes requested** for ECO-66 design-only acceptance. PR is merged; this comment does not request reopening or alter the merge. - Versioned schema: present (`schema: 1`), but schema includes `live_stack` frames despite the hard requirement that crash data contain frames only and no process memory; docs must explicitly constrain this to a user-consented, metadata-only stack capture, or remove it from v1 schema. `docs/breadbug.md`, schema table and preceding scrub rules. - Privacy/scrub allowlist: structured event field examples and free-text best-effort redactions are documented, but other schema fields (notably system, installed_apps, runtime, markers, logs and journal) lack precise field-by-field allowlist constraints. State the allowed keys/types/lengths and explicit exclusions for sensitive apps and sensitive values; broad claims of scrub coverage are not adequate. `docs/breadbug.md`, Scrubbing and Report schema. - Consent copy: present and clearly says nothing is sent without Send, with save path. It omits the upload toggle being off by default and exact reporting target/retention/deletion implications. Add plain-language copy covering destination, anonymous identifier/rate limiting, retention and delete-by-receipt, or explicitly mark unknown rollout policy. - Public endpoint threat model: present with hostile-input threats, validation, size/rate caps, isolation, escaping and retention. Add concrete trust boundaries and mitigations for public endpoint exposure behind Aegis, anonymous install-id rotation/abuse, and symbolication/debug-symbol store access. CI evidence: exact head status `check / check (push)` success. PR metadata confirms merged=true and merge SHA above. Design completion is separate from ECO-66 release-pipeline rollout; no claim is made that rollout requirements are implemented. Please update the design doc and obtain a fresh review.

Breadway referenced this pull request 2026-10-14 12:43:54 +08:00

docs: clarify breadbug privacy contract #43

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

breadbug

  

bug

  

phase-1

  

phase-2

  

privacy

No labels

breadbug

bug

phase-1

phase-2

privacy

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Breadway/bread!23

No description provided.