fatih-developer/fermata

Review signals: 1 connection review.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 3 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• fermata job <id> shows one job with its objective and recent events: Real input produced the expected result: Objective Add a hello function

  Source: fermata job <id> [--json]

  Input: hello-job (Claude job started through the fake Claude CLI)

  Expected: the job's objective is printed

  Command: fermata job hello-job

  Observed: Objective Add a hello function ────────────────────────────────────── 10-24 03:25 created Created. 10-24 03:25 started Started Claude session 8d48c1d6.

• fermata jobs lists supervised jobs: Real input produced the expected result: hello-job

  Source: fermata jobs [--json] [--all]

  Input: hello-job created with fermata run

  Expected: the job appears in the list

  Command: fermata jobs

  Observed: hello-job claude running Add a hello function

Examples

• Repository test suite runs offline and passes: command completed successfully

  Source: README.md / Building and testing (dotnet test)

  Input: dotnet test Fermata.slnx

  Expected: all test projects pass

  Command: dotnet test Fermata.slnx

  Observed: ailed: 0, Passed: 49, Skipped: 0, Total: 49, Duration: 4 s - Fermata.Desktop.Tests.dll (net10.0) Fermata.Core.Tests -> <guest-path> Test run for <guest-path> (.NETCoreApp,Version=v10.0) VSTest version 18.0.2 (x64) Starting test execution, please wait... A total of 1 test files matched the specified pattern. Passed! - Failed: 0, Passed: 244, Skipped: 0, Total: 244, Duration: 4 s - Fermata.Core.Tests.dll (net10.0)

Cycles

• The scheduler runs a tick on start and then every 30 s while the daemon is up: Triggered one cycle by hand (run-once wrapper: timeout --preserve-status 15 fermata daemon (stops after the first tick; no source edits, no fake clock); normal trigger: fermata daemon loop, TickInterval 30 s): fermata daemon: mode confirm, poll 30s, notifications none (notify-send not installed) 2026-10-24 03:29:03 CODEX_UNAVAILABLE: codex executable not found on PATH. fermata daemon: stopped

  Source: src/Fermata.Platform/Jobs/JobScheduler.cs

  Input: config in FERMATA_HOME; Claude job hello-job with the fake Claude CLI

  Expected: daemon starts, runs one tick (logs CODEX_UNAVAILABLE since no Codex on PATH) and stops cleanly

  Command: timeout --preserve-status 15 fermata daemon

  Observed: fermata daemon: mode confirm, poll 30s, notifications none (notify-send not installed) 2026-10-24 03:29:03 CODEX_UNAVAILABLE: codex executable not found on PATH. fermata daemon: stopped

Local or hosted: hosted

Build fermata from source with the README's packaging script, then create and read back a supervised job with `fermata run` / `fermata job` / `fermata jobs`, and run the documented test suite.

cd <guest-path> && ls -la && id -u && python3 --version && git --version 2>&1; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n '200,400p' README.md; ls .coldpass scripts; cat Directory.Build.props; cat nuget.config
cd <guest-path> && which dotnet; dotnet --version 2>&1 | head -2; ls -d .git 2>&1; cat /etc/os-release | head -3; sudo -n true && echo SUDO_OK; ls .coldpass; cat .gitignore
cd <guest-path> && git init -q && git remote add origin https://github.com/fatih-developer/fermata && timeout 180 git fetch --depth 1 origin a801a1892a07c75fa6e6516e9a8bdfc5aaa0d76d 2>&1 | tail -5; echo rc=$?; git reset --mixed FETCH_HEAD 2>&1; git log --oneline -1 2>&1; git status --short | head
cd /tmp && (sudo apt-get update -qq 2>&1 | tail -2); apt-cache policy dotnet-sdk-10.0 2>&1 | head -3
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq dotnet-sdk-10.0 2>&1 | tail -3; dotnet --version
cd <guest-path> && export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1 && timeout 900 dotnet test Fermata.slnx 2>&1 | tail -25; echo rc=${PIPESTATUS[0]}
cd <guest-path> && cat scripts/package.sh | head -60; export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1; timeout 900 scripts/package.sh linux-x64 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}; ls -la artifacts/package 2>&1
mkdir -p <guest-path> && tar -xzf <guest-path> -C <guest-path> && ls -la <guest-path> | head -30; export FERMATA_HOME=<guest-path>; mkdir -p $FERMATA_HOME; F=$(find <guest-path> -name fermata -type f | head -1); echo "BIN=$F"; $F --version; $F --help 2>&1 | head -60
export FERMATA_HOME=<guest-path> F=<guest-path>; export DOTNET_CLI_TELEMETRY_OPTOUT=1; $F config --init; echo rc=$?; $F config; echo rc=$?; ls -la $FERMATA_HOME; which claude codex; echo; $F doctor 2>&1 | head -30
cd <guest-path> && ls -la && head -60 * 2>/dev/null | head -150
which node npm; node --version 2>&1; cat <guest-path>; cat <guest-path> | grep -n -A4 'jobs.claude'
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs 2>&1 | tail -2; node --version; npm --version 2>&1 | head -1
set -e; export FERMATA_HOME=<guest-path> F=<guest-path> DOTNET_CLI_TELEMETRY_OPTOUT=1
mkdir -p <guest-path> && cd <guest-path> && git init -q && git config user.email <email> && git config user.name t && echo hi > README.txt && git add . && git commit -qm init && cd /tmp
sed -i 's|^executable = ""                # empty = search PATH|executable = "<guest-path>"|' $FERMATA_HOME/config.toml
grep -n 'executable' $FERMATA_HOME/config.toml
export FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path>
timeout 120 $F run --provider claude --objective "Add a hello function" --cwd <guest-path> --name demo-job 2>&1; echo rc=$?
timeout 60 $F jobs 2>&1; echo rc=$?
export FERMATA_HOME=<guest-path> F=<guest-path> DOTNET_CLI_TELEMETRY_OPTOUT=1; sed -i '46s|.*|executable = ""                # empty = PATH|' $FERMATA_HOME/config.toml; sed -n '44,47p' $FERMATA_HOME/config.toml; export FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path>; $F job demo-job 2>&1; echo rc=$?; cd <guest-path> && grep -rn "Timer\|while (\|PeriodicTimer\|Task.Delay" src/Fermata.Platform/*.cs | head -20; ls src/Fermata.Platform | head -50
cd <guest-path> && ls; grep -n "class JobScheduler" -A3 *.cs | head; grep -n "Tick\|Timer\|Delay\|interval\|RunOnce\|--once\|Now" JobScheduler.cs | head -40
export FERMATA_HOME=<guest-path> F=<guest-path> FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path>; timeout 20 $F daemon > <guest-path> 2>&1; echo rc=$?; cat <guest-path> | head -20; $F job demo-job 2>&1 | tail -4; pgrep -fa "fermata/fermata daemon" || echo "no daemon left"
export FERMATA_HOME=<guest-path> F=<guest-path>; timeout --preserve-status 15 $F daemon; echo rc=$?; ps -eo pid,args | grep -v grep | grep "bin/fermata/fermata daemon" || echo "no fermata daemon running"
cd <guest-path> && ls -la fake-claude-state.json 2>&1; git status --short | head; export FERMATA_HOME=<guest-path> F=<guest-path> FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path>; timeout --preserve-status 15 $F daemon; echo rc=$?; $F job demo-job | tail -3
ls -la <guest-path>; cat <guest-path> 2>&1 | head -30; echo ---; cat <guest-path> 2>&1 | tail -10
sudo ln -sf <guest-path> /usr/local/bin/fermata && cd <guest-path> && export FERMATA_HOME=<guest-path> FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path> && fermata --version && fermata job demo-job | head -3 && fermata jobs
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["fermata","job","demo-job"],"cwd":"<guest-path>","env":{"FERMATA_HOME":"<guest-path>","FAKE_CLAUDE_STATE":"<guest-path>","FAKE_CLAUDE_LOG":"<guest-path>"},"expected_text":"Objective  Add a hello function"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
 {"kind":"claim","claim":"FERMATA_HOME overrides the data directory, so config is read from it","source":"`FERMATA_HOME` overrides the location.","input":"FERMATA_HOME=<guest-path> fermata config","expected":"config file path is inside FERMATA_HOME","probe_kind":"cli","argv":["fermata","config"],"env":{"FERMATA_HOME":"<guest-path>"},"expected_text":"Config file   <guest-path>","cwd":"<guest-path>"},
 {"kind":"claim","claim":"fermata jobs lists supervised jobs","source":"fermata jobs [--json] [--all]","input":"one Claude job created with fermata run (fake Claude CLI)","expected":"the job appears in the list","probe_kind":"cli","argv":["fermata","jobs"],"env":{"FERMATA_HOME":"<guest-path>","FAKE_CLAUDE_STATE":"<guest-path>","FAKE_CLAUDE_LOG":"<guest-path>"},"expected_text":"demo-job","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
 {"kind":"example","claim":"Repository test suite runs offline and passes","source":"README.md / Building and testing (dotnet test)","input":"dotnet test Fermata.slnx","expected":"all test projects pass","argv":["dotnet","test","Fermata.slnx"],"cwd":"<guest-path>","env":{"DOTNET_CLI_TELEMETRY_OPTOUT":"1","DOTNET_NOLOGO":"1"},"expected_text":"Total:   244"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"The scheduler runs a tick on start and then every 30 s while the daemon is up","source":"src/Fermata.Platform/Jobs/JobScheduler.cs","quote":"if (now >= nextTick || _store.HasRequests())","schedule":"fermata daemon loop, TickInterval 30 s","method":"run-once wrapper: timeout --preserve-status 15 fermata daemon (stops after the first tick; no source edits, no fake clock)","input":"config in FERMATA_HOME; one Claude job 'demo-job' with fake Claude CLI","expected":"daemon starts, runs one tick (logs CODEX_UNAVAILABLE since no Codex on PATH) and stops cleanly","kind":"cli","argv":["timeout","--preserve-status","15","fermata","daemon"],"cwd":"<guest-path>","env":{"FERMATA_HOME":"<guest-path>","FAKE_CLAUDE_STATE":"<guest-path>","FAKE_CLAUDE_LOG":"<guest-path>"},"expected_text":"CODEX_UNAVAILABLE"}]}
EOF
for f in .coldpass/*.json; do python3 -m json.tool $f >/dev/null && echo "ok $f"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && export FERMATA_HOME=<guest-path> FAKE_CLAUDE_STATE=<guest-path> FAKE_CLAUDE_LOG=<guest-path> && fermata cancel demo-job; echo rc=$?; fermata run --provider claude --objective "Add a hello function" --cwd <guest-path> --name hello-job 2>&1 | tail -4; echo rc=$?; fermata jobs; fermata job hello-job
cd <guest-path> && E='"env":{"FERMATA_HOME":"<guest-path>","FAKE_CLAUDE_STATE":"<guest-path>","FAKE_CLAUDE_LOG":"<guest-path>"}'
cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["fermata","job","hello-job"],"cwd":"<guest-path>",$E,"expected_text":"Objective  Add a hello function"}
EOF
cat > .coldpass/claims.json <<EOF
[
 {"kind":"claim","claim":"fermata job <id> shows one job with its objective and recent events","source":"fermata job <id> [--json]","input":"hello-job (Claude job started through the fake Claude CLI)","expected":"the job's objective is printed","probe_kind":"cli","argv":["fermata","job","hello-job"],$E,"expected_text":"Objective  Add a hello function","cwd":"<guest-path>"},
 {"kind":"claim","claim":"fermata jobs lists supervised jobs","source":"fermata jobs [--json] [--all]","input":"hello-job created with fermata run","expected":"the job appears in the list","probe_kind":"cli","argv":["fermata","jobs"],$E,"expected_text":"hello-job","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/cycles.json <<EOF
{"detected":true,"checks":[{"claim":"The scheduler runs a tick on start and then every 30 s while the daemon is up","source":"src/Fermata.Platform/Jobs/JobScheduler.cs","quote":"if (now >= nextTick || _store.HasRequests())","schedule":"fermata daemon loop, TickInterval 30 s","method":"run-once wrapper: timeout --preserve-status 15 fermata daemon (stops after the first tick; no source edits, no fake clock)","input":"config in FERMATA_HOME; Claude job hello-job with the fake Claude CLI","expected":"daemon starts, runs one tick (logs CODEX_UNAVAILABLE since no Codex on PATH) and stops cleanly","kind":"cli","argv":["timeout","--preserve-status","15","fermata","daemon"],"cwd":"<guest-path>",$E,"expected_text":"CODEX_UNAVAILABLE"}]}
EOF
for f in .coldpass/*.json; do python3 -m json.tool $f >/dev/null && echo "ok $f"; done
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import sys,json;d=json.loads(sys.stdin.read());print(json.dumps({"valid":d.get("valid"),"problems":d.get("problems"),"replay_status":d["replay"]["status"],"claims":[(c["claim"],c.get("verdict"),c.get("outcome")) for c in d["replay"]["details"]["claims"]],"cycles":[(c.get("verdict")) for c in d["replay"]["details"]["cycle_checks"]],"examples":[(c.get("verdict")) for c in d["replay"]["details"]["example_checks"]],"strength":d["replay"]["details"].get("evidence_strength"),"probe_working":d["replay"]["details"].get("working")},indent=1))' ; echo
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; head -c 3000 <guest-path>; echo; echo ---; ls -la .coldpass; head -c 600 .coldpass/observed.json
mkdir -p <guest-path> && cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
 "outcome": "working",
 "fault_owner": null,
 "operation": "Build fermata from source with the README's packaging script, then create and read back a supervised job with `fermata run` / `fermata job` / `fermata jobs`, and run the documented test suite.",
 "operation_scope": "Linux x64 (Ubuntu 24.04, non-root with passwordless sudo). Codex CLI and Claude Code are NOT installed or logged in, so Claude jobs were exercised through the README-documented fake Claude CLI (scripts/fake-claude). Reset credits, Codex monitor and real agent sessions were not exercised.",
 "steps": [
  "git init; git remote add origin https://github.com/fatih-developer/fermata; git fetch --depth 1 origin a801a1892a07c75fa6e6516e9a8bdfc5aaa0d76d; git reset --mixed FETCH_HEAD",
  "sudo apt-get install -y dotnet-sdk-10.0 (provides dotnet 10.0.113, required by Directory.Build.props net10.0)",
  "DOTNET_CLI_TELEMETRY_OPTOUT=1 dotnet test Fermata.slnx  (README: Building and testing) -> 244 Core + 49 Codex + 49 Desktop tests passed",
  "scripts/package.sh linux-x64  (README: Building and testing) -> artifacts/package/fermata-linux-x64.tar.gz, unpacked to <guest-path>",
  "FERMATA_HOME=<guest-path> fermata config --init ; fermata config (README: Configuration)",
  "fermata doctor (setup check only: Codex not found, Claude Code not found, as expected)",
  "sed-free config edit of [jobs.claude] executable = scripts/fake-claude/claude (README: End-to-end runs, fake claude)",
  "fermata run --provider claude --objective \"Add a hello function\" --cwd <guest-path> --name hello-job",
  "fermata job hello-job ; fermata jobs (read back the job)",
  "timeout --preserve-status 15 fermata daemon (one scheduler tick, then clean stop)"
 ],
 "deviations": [
  "Codex CLI and Claude Code were not installed and cannot be logged in on this guest, so Claude jobs ran against scripts/fake-claude (documented by the README for this purpose), not a real Claude session. Codex jobs were not run.",
  "Release download from GitHub Releases (README Quick start) was replaced by the README's own build script scripts/package.sh linux-x64, to avoid downloading and trusting a release binary.",
  "No README curl|sh installer exists for fermata; none was run.",
  "Node.js was installed from apt (v18.19.1) only to run the fake claude script; npm was not installed (not needed).",
  "A first daemon/job run was made without FAKE_CLAUDE_STATE set, so the job recorded a 'No conversation found' retry event. That job (demo-job) was cancelled with `fermata cancel demo-job` and the working job is hello-job.",
  "The artifacts/ build output and the .git metadata were created inside the workspace by the build and the pinned fetch (both gitignored or required). A symlink /usr/local/bin/fermata was created for the probe's argv.",
  "`fermata doctor` reports warnings/failures for missing Codex and Claude Code and for data directory permissions; these are expected in this guest and are not product faults."
 ],
 "stuck_step": null,
 "main_blocker": null,
 "plain_failure": null,
 "suggested_fix": "None needed for this operation. To exercise the real agents, install Codex CLI and Claude Code, log in, and rerun the Codex and Claude job steps; the fake-Claude path only covers the Claude job plumbing."
}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report ok; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | head -c 400; echo; ps -eo pid,args | grep -v grep | grep -E "fermata daemon|fake-claude" || echo "no servers/background processes left"
cd <guest-path> && python3 -I -c '
import json
p=".coldpass/report.json"; d=json.load(open(p))
d["steps"]=[s.replace("sed-free config edit of [jobs.claude] executable","edited the scratch config (FERMATA_HOME/config.toml) so [jobs.claude] executable points at scripts/fake-claude/claude") for s in d["steps"]]
json.dump(d,open(p,"w"),indent=1,ensure_ascii=False)' && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import sys,json;d=json.loads(sys.stdin.read());print("valid",d["valid"],"problems",d["problems"],"replay",d["replay"]["status"])'