UNI Universal Natural Intelligence

Wiki · Evidence & Verdicts

UNI HUD native rewrite — ultracode review + fix receipt

Evidence & Verdicts · docs/receipts/hud_native_ultracode_review_2026-07-14.md @ 44baf03d5041 (gen2-runtime) — opens the published snapshot ac338733bbba

How to read this page

Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.

Eighty-seven dated pages: receipts, pre-registrations, handoffs, validation records and review verdicts. A receipt is written at the moment a piece of work was checked. It names what was claimed, the commit and the seed, what was actually run, and the outcome in one of a small set of controlled words. Then it names what the work did not achieve. That last part is what makes it a receipt rather than an announcement. A pre-registration is the same discipline run in advance: the conditions that would count as a pass and the conditions that would falsify the claim are written down before the run, so neither can be adjusted once the numbers arrive.

That is why so many small dated stubs are an audit trail rather than noise. No one of them is meant to be a good read. The value is in the sequence and in the dates, because you can watch a prediction be registered, then the run happen, then the verdict land — sometimes against the prediction. Pages here record a falsified result, a rejected fix, a retracted overclaim, and a green receipt that turned out not to be reproducible from the commit that carried it. A record that carried only successes would be worth a good deal less than this one.

A gentle way in is to read a pre-registration first, so the shape becomes familiar, then a result page, then one of the corrections. This section sits off the main navigation on purpose: it is the record you check the rest of the site against, not the place to begin.

What it is not: documentation, and not a summary. Nothing here has been tidied in hindsight. Every entry reads as of its date, a later entry may overturn an earlier one, and the presence of a page is not a claim that its result stood.

Your browser cannot switch reading levels, so the document itself is shown.

Precise — the source document

This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.

name: hud-native-ultracode-review date: 2026-07-14 subject: Light ultracode pass over the native UNI HUD rebuild (post-.NET-rewrite) workflow_run_id: wf_678bf1ac-594 agents: 69 tokens: 5741326

UNI HUD native rewrite — ultracode review + fix receipt

Context

The HUD was rewritten same-day from a Node.js/NSSM/HTML design (ADR-PROD-015) to a native .NET ServiceBase service + WPF widget (ADR-PROD-016), per the operator's explicit rejection of the browser-page design. Immediately after the native service was first installed via SCM, the operator requested a "light ultracode pass" covering security, durability/warranty, DDD/TDD doc-and-gate resonance, and cross-surface (Door/Gaia/HUD) coherence.

Review shape

5 parallel reviewer agents (security, durability, ddd-drift, tdd-coverage, resonance), each returning structured findings, followed by a single adversarial-verification pass per finding (try to refute; default to refuted if unconfirmable). 64 raw findings, 58 confirmed, 6 correctly refuted (checked — no wrongly-dismissed findings on spot review).

Findings and disposition

Fixed this session (code)

Finding Severity File Fix
Wildcard Access-Control-Allow-Origin: * on a loopback-only service bad HttpApiHost.cs:58 Header removed entirely — no browser client exists; the only real client is the native widget.
Audience.Accept(dynamic input) over a JsonElement — has no dynamic members, throws on every call bad (correctness) HudState.cs:81-116 Rewritten to explicit TryGetProperty calls. This means POST /api/hud/audience/publish had never actually worked since first shipped — every call silently rejected with a generic {code:"shape"} error. Live-verified fixed: curl -X POST ... → {"ok":true,"size":N}.
HttpListener bind-failure silently swallowed — service stays "Running" per SCM with a permanently-dead listener warn (durability) HttpApiHost.cs:27-45 Rethrow after logging so the Generic Host actually stops the process, letting SCM's own restart/5000 recovery action fire.
SnapshotBuilder.cs hardcoded bind="0.0.0.0" when HttpApiHost only ever binds loopback info SnapshotBuilder.cs:92 Corrected to "127.0.0.1", comment added warning against future drift.
No global unhandled-exception handler in the WPF widget — one throw anywhere kills the process with zero trail bad (durability) App.xaml.cs Added DispatcherUnhandledException, AppDomain.UnhandledException, TaskScheduler.UnobservedTaskException handlers, all logging to %LOCALAPPDATA%\UNI-HUD\widget-crash.log before falling through to default behavior (deliberately not swallowing — unknown exceptions mean unknown state).
HttpListener.GetContextAsync() not tied to the service's stoppingToken — graceful stop hangs indefinitely bad (durability, found while executing the redeploy, not by the review itself) HttpApiHost.cs:46 Registered stoppingToken.Register(() => _listener.Stop()) so cancellation unblocks the pending accept-loop promptly. Directly explained a live StopPending hang observed during redeploy.

Attempted, rolled back same session, then fixed for real same day (2026-07-14, later pass)

Finding Disposition
UNI-HUD service installs as LocalSystem with no functional justification (only reads repo files, binds loopback) First attempt: obj=NT AUTHORITY\NetworkService in the combined sign+reinstall script. Live result: [SC] StartService FAILED 5: Access is denied — HttpListener cannot bind under NetworkService without a pre-provisioned URL ACL reservation. The installer detected this and rolled back to LocalSystem, documented honestly rather than silently accepted. Follow-up in the same session closed this properly: viewer/hud/native/_urlacl_and_networkservice_elevated.ps1 reserves http://127.0.0.1:8100/ and http://localhost:8100/ for NT AUTHORITY\NetworkService via netsh http add urlacl, grants that account ReadAndExecute on the repo root, and reinstalls under it. Live-verified, no rollback this time: Get-CimInstance Win32_Service → StartName: NT AUTHORITY\NetworkService, State: Running; curl 127.0.0.1:8100/api/hud/health → 200 {ok:true}. ADR-PROD-016 and docs/HUD.md updated to reflect the least-privilege account as shipped, not deferred. Gate hud-least-privilege-account = PASS, hud-service-registered superseded to reflect NetworkService.

Fixed (docs, scripts, tests)

  • 28 DDD-drift findings across CLAUDE.md, docs/HUD.md, production/docs/adr/ADR-PROD-015-*.md — all rewritten. ADR-015 amended with a SUPERSEDED-IN-PART banner (not silently rewritten — its historical decision record is preserved); ADR-PROD-016-uni-hud-native-dotnet-rewrite.md written as the current source of truth. docs/STUDIO_SYSTEMS.md's HUD section also rewritten (this doc was updated in the prior work session, inheriting the same drift).
  • viewer/hud/hud_service_install.ps1 (old NSSM installer) — now refuses to run without an explicit -IUnderstandThisIsRetiredAndWillDestroyTheWorkingService override flag. Live-verified: runs, prints the retirement warning, exits 1, live service untouched.
  • viewer/hud/hud_watchdog.ps1 — dormant fallback path (Start-Hud) rewritten from spawning node.exe hud_server.cjs directly to sc.exe start UNI-HUD (the currently-registered service, whatever binary it points at); Hud-Running changed from a process-name check to a binary-agnostic port check.
  • viewer/hud/native/hud_native_boot_proof.ps1 — new 5-clause AND proof script for the native architecture (the old hud_boot_proof.ps1 checks watchdog-era artifacts that native install never produces and can never PASS for it). Live-verified: 4/5 clauses PASS immediately, the 5th (real reboot since config) honestly reports NOT YET — no false-pass.
  • viewer/hud/native/UNI.Hud.Service.Tests (new xUnit project) — RingTests.cs (monotonic-timestamp guard under simulated clock reversal, wrap-at-cap, sparkline windowing) + AudienceTests.cs (the full validation contract, specifically regression-covering the dynamic-binding bug above). 18/18 pass. Closes the highest-risk 20% of the zero-coverage gap the tdd-coverage reviewer identified; remaining gaps (Gates.cs, Enlightened.cs, SnapshotBuilder.cs, HttpApiHost.cs integration tests, PollWorker.cs mapping functions) documented as open, not silently ignored — see docs/HUD.md §8.

Investigated, initially flagged as a follow-up, then fixed for real same day (2026-07-14, later pass)

  • Gaia (viewer/gaia/gaia_server.cjs) was non-responsive on every /api/gaia/* endpoint — confirmed via 3 independent timeouts (10s, 15s, 60s, all zero bytes returned). Initially flagged as unrelated to the HUD native rewrite and spun off as a follow-up task rather than fixed inline. Root-caused and fixed for real in a later pass the same session, live evidence attached: the running gaia_server (pid 3096, up since 16:56) had accumulated 30+ CLOSE_WAIT sockets that never got a response — the actual bug was viewer/infra.cjs's cached() helper storing a pending promise with NO ceiling on how long "pending" could last; one transient hang inside a single cached source (SSH/DNS) poisoned that cache entry permanently, and since snapshot() awaits every source via Promise.all, one poisoned source wedged the entire snapshot forever. Fixed in four layers: infra.cjs cached() now races each source against a fixed 10s hang-ceiling (decoupled from cache-freshness TTL) and deletes the entry on timeout so the next poll retries fresh; gaia.cjs's gaia() was rewritten from one fully-sequential await-chain to two parallel Promise.all phases with a per-collector 20s ceiling that degrades to "no signals this seat" instead of propagating a hang; gaia_server.cjs adds a 45s transport-level ceiling plus single-flight request coalescing (closes a compounding-latency case found live once the HUD's own 12s poll of /api/gaia/drift was seen overlapping with manual test traffic); three internally-sequential per-item probe loops (dnsDrift()'s 17-name DNS walk, studioProbeSignals(), colonyProbeSignals()) were parallelized. Live-verified: after restart, 3 sequential GET /api/gaia calls returned 200 in 3.2s/2.9s/4.4s; 5 CONCURRENT calls all resolved together within ~3.1s (proving the single-flight fix); full 129-signal envelope across all 9 seats both times; node viewer/gaia/verify_gaia.cjs re-run post-fix — still 11 PASS / 0 FAIL / 0 SKIP, no regression. Gate gaia-no-permanent-hang = PASS. The spawned follow-up task (task_5ed99b3a) was superseded by this direct fix.

Verdict trajectory

Gate rows in evidence/gates.ndjson (search hud-) have been superseded with corrected pass/falsifies text describing the native mechanism. Verdicts reflect what was actually live-verified in this session:

  • hud-service-registered → PASS (live: Get-Service, Get-CimInstance, Get-AuthenticodeSignature all confirmed against the running native service)
  • hud-audience-sanitizer-honest → PASS (live: unvouched POST → 400 code:sanitized_by; vouched POST → 202; plus 12 xUnit test cases)
  • hud-no-ip-literal → PASS (manual scan of viewer/hud/native/**; one false-positive on a version string, zero real literals; no automated scanner exists yet for the native tree — noted as a follow-up, not silently claimed as tooled)
  • hud-crash-restart, hud-service-restart, hud-boot-persistent, hud-glance-honest, hud-integration-stage-0 → remain PENDING, honestly, pending a live drill / a real reboot / a formal visual-review receipt / the (separate, not-yet-done) command_center.cjs wiring change respectively.

Full raw + verified finding data: workflow run wf_678bf1ac-594, journal.jsonl in that run's transcript directory.

sha256 58598554b8b60405 — of the original file, so what was ingested stays checkable.

Plain — written for this website, not the source document

Written for this website — not the document. This is a plain-language retelling, written to help you meet the document. It is not the source, and it is not evidence. It has not yet been checked by a person. (or choose Precise in the reading-level control above)

A record of a review over a freshly rewritten display system, and of the fixes it produced. Two findings stand out. One endpoint had never worked at all since it first shipped, because it was written to use a kind of dynamic access the data does not support, so every call was silently rejected. And the service could fail to bind and still report itself as running, because the failure was swallowed. Several gates are left pending rather than rounded up, each with the reason it is waiting written beside it.

Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 58598554b8b60405

Clear — written for this website, not the source document

Written for this website — not the document. This is a clearer retelling, written to help you meet the document. It is not the source, and it is not evidence. It has not yet been checked by a person. (or choose Precise in the reading-level control above)

A review receipt, the file recording what was run, following a same-day rewrite of a display system into a native service and a desktop widget. The operator had asked for a light pass over security, durability, documentation drift and cross-surface coherence.

The shape of the review is stated up front: several reviewers working in parallel, then a pass that tries to refute each finding and defaults to refuted when it cannot be confirmed, with counts for how many survived.

The fixes come in a table. A wildcard cross-origin header removed from a service that has no browser client. An endpoint rewritten because it used dynamic member access on a type that has none. It had never worked since it first shipped, with every call silently rejected. The page says so plainly, and then shows the working call. A swallowed bind failure now rethrown, so the process actually stops and the system's own restart policy can fire, instead of the service reporting healthy with a dead listener. A hard-coded address corrected to match reality, with a comment warning against the drift returning. A global crash handler added to the widget that logs before falling through, deliberately not swallowing, because an unknown exception means an unknown state. And a shutdown hang fixed, found while doing the redeploy rather than by the review itself, which explains a stall that had been observed.

One item is unusually honest about failing first. An attempt to run the service under a lower-privileged account failed live because it could not bind without a reservation, and the installer rolled back rather than leaving a broken state. A later pass the same session did it properly by making the reservation and granting read access, and this time it held, with the running state quoted and the documents updated to describe what shipped rather than what was intended.

The documentation fixes are many, and one decision is worth noting: an older decision record was given a partly-superseded banner rather than being rewritten, so its history survives, while a new record became the current source of truth. A retired installer now refuses to run without an explicit acknowledgement flag. A fallback path was rewritten to start whatever service is registered rather than one named binary, and its liveness check was made independent of the binary too.

A new test project closes the highest-risk part of a zero-coverage gap, including a regression test for the endpoint that had never worked, and the remaining gaps are listed as open rather than quietly ignored.

One investigation deserves its own paragraph. A related service was unresponsive on every endpoint, initially spun off as unrelated, then root-caused the same day. A cache stored a pending promise with no ceiling on how long pending could last, so one transient hang poisoned that entry permanently, and because the snapshot awaited every source together, a single poisoned source wedged the whole thing forever. The fix is in four layers, each described, and the verification includes concurrent calls resolving together, which is what shows one of those layers working.

The closing section gives the verdict trajectory gate by gate. Several stay pending, each with what it is waiting for: a live drill, a real restart, a formal visual review, and a wiring change that has not been done.

Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 58598554b8b60405