Creatidy/creatidy-kernel
5
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

[Kernel][G09] Prove workspace isolation and trusted verification preconditions #50

New issue
Closed
opened 2026-10-04 22:22:46 +00:00 by kilo · 4 comments
kilo commented 2026-10-04 22:22:46 +00:00
Member
Copy link

Goal

Owner: Kernel. Establish and implement an evidence-backed execution/security profile for workers, untrusted tests and reviewers using an existing sandbox, with trusted verification preconditions that prevent rejected scope/gate changes from being executed as trusted checks. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.

Why

A closed environment, workspace-write setting and diff allowlist are not sandboxing. Tests/review execute candidate code, and the same host user may reach controller state/credentials. Honest trusted-development limitations must coexist with a proved stronger profile, not be renamed away.

Current Evidence

At eb4f4a2956, codex_runtime.py accepts TRUSTED_DEVELOPMENT only; task execution uses a disposable clone and closed values, no hostile boundary. core/verification.py verify_candidate:257-260 eagerly runs all producer checks. task_execution.py TaskChecks:917-951 rejects changed paths but still runs candidate verification commands; _install_candidate installs candidate before checks. Source ordering is verified; exploit/live behavior was not run. #6 expressly excluded real hostile-code OS sandbox.

Scope

Threat-model actual file/terminal/tool executor, worker/test/reviewer/controller identities, mounts, network/credentials and descendant processes. Evaluate maintained native/container/OS sandboxes before adaptation. Establish trusted gate source and safe ordering/preconditions, avoiding candidate-modified verification tooling as authority. Preserve explicitly selectable trusted-development, with truthful denial/unsupported diagnostics. Contract exact grants to selected harness and verify real refusals.

Acceptance Criteria

  1. Deterministic negative scenario with forbidden changed verification/tooling path is rejected before that code runs; marker proof demonstrates no unauthorized command effect, not merely final rejection.
  2. Selected sandbox profile proves denial of controller DB/artifacts, owner/provider/Forge credentials, host parents, symlink/mount/path escapes, unauthorized network and container socket; tests and cold reviewer receive equally appropriate restrictions.
  3. Workspace write/tool/file/terminal executor has explicit ownership and permission mediation; stale/revoked/expired grants and prompt injection cannot expand scope.
  4. Cancel/timeout cleans owned descendants or preserves unknown liveness and refuses unsafe cleanup; same-UID trusted-development remains labelled not isolated.
  5. Record exact versions/images/OS configuration and security evidence, limits and residual threats; unsupported platform/profile refuses rather than falls back to weaker enforcement.
  6. Existing trusted-development fixtures and immutable authority/evidence/identity semantics remain intact; migration of config never silently promotes trust level. Repository gates plus independent security-critical review.

Reuse

Compare existing Workspace/Runtime enforcement seams, pinned native harness controls, maintained container/OS sandbox options and HAR/OpenHands workspace candidates. Exact revision/files/license/service terms, dependencies/maintenance and adversarial denial tests are required before selection; no custom sandbox framework or credential store. Adopt proven mechanism, not marketing claims.

Constraints

No fake isolation, weakening functional guards, private source/runtime dependency, broad owner credential in worker or automatic trust upgrade. Architecture security-level choice and unsupported guarantees require owner decision after the bounded evidence result; implementation must stay within an accepted ADR/profile.

Dependencies And Priority

Immediate safety prerequisite before untrusted worker/test/reviewer execution. Can prove verifier-precondition defect independently of gateway/intake. Harness feasibility supplies actual executor/lifetime; concurrency consumes safe cleanup rules. Budget integration later bounds all tools.

Diagnostics And Permissions

Report denied capability and safe remediation, no secrets/untrusted free-text output. Synthetic hostile fixtures only initially. OS/container access, live harness/inference and external effects require separately scoped approval; registering this work authorizes none.

Links

  • Parent: #46
  • Honest synthetic baseline: #6
  • Local authority: docs/architecture/threat-model.md, SECURITY.md, ADR 0005

Non-Goals

No own sandbox/harness, security claim from path instructions or green synthetic tests, production execution or rollout.

## Goal Owner: Kernel. Establish and implement an evidence-backed execution/security profile for workers, untrusted tests and reviewers using an existing sandbox, with trusted verification preconditions that prevent rejected scope/gate changes from being executed as trusted checks. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief. ## Why A closed environment, workspace-write setting and diff allowlist are not sandboxing. Tests/review execute candidate code, and the same host user may reach controller state/credentials. Honest trusted-development limitations must coexist with a proved stronger profile, not be renamed away. ## Current Evidence At eb4f4a2956712bfaf39a3271e1523e7f77a91e26, codex_runtime.py accepts TRUSTED_DEVELOPMENT only; task execution uses a disposable clone and closed values, no hostile boundary. core/verification.py verify_candidate:257-260 eagerly runs all producer checks. task_execution.py TaskChecks:917-951 rejects changed paths but still runs candidate verification commands; _install_candidate installs candidate before checks. Source ordering is verified; exploit/live behavior was not run. #6 expressly excluded real hostile-code OS sandbox. ## Scope Threat-model actual file/terminal/tool executor, worker/test/reviewer/controller identities, mounts, network/credentials and descendant processes. Evaluate maintained native/container/OS sandboxes before adaptation. Establish trusted gate source and safe ordering/preconditions, avoiding candidate-modified verification tooling as authority. Preserve explicitly selectable trusted-development, with truthful denial/unsupported diagnostics. Contract exact grants to selected harness and verify real refusals. ## Acceptance Criteria 1. Deterministic negative scenario with forbidden changed verification/tooling path is rejected before that code runs; marker proof demonstrates no unauthorized command effect, not merely final rejection. 2. Selected sandbox profile proves denial of controller DB/artifacts, owner/provider/Forge credentials, host parents, symlink/mount/path escapes, unauthorized network and container socket; tests and cold reviewer receive equally appropriate restrictions. 3. Workspace write/tool/file/terminal executor has explicit ownership and permission mediation; stale/revoked/expired grants and prompt injection cannot expand scope. 4. Cancel/timeout cleans owned descendants or preserves unknown liveness and refuses unsafe cleanup; same-UID trusted-development remains labelled not isolated. 5. Record exact versions/images/OS configuration and security evidence, limits and residual threats; unsupported platform/profile refuses rather than falls back to weaker enforcement. 6. Existing trusted-development fixtures and immutable authority/evidence/identity semantics remain intact; migration of config never silently promotes trust level. Repository gates plus independent security-critical review. ## Reuse Compare existing Workspace/Runtime enforcement seams, pinned native harness controls, maintained container/OS sandbox options and HAR/OpenHands workspace candidates. Exact revision/files/license/service terms, dependencies/maintenance and adversarial denial tests are required before selection; no custom sandbox framework or credential store. Adopt proven mechanism, not marketing claims. ## Constraints No fake isolation, weakening functional guards, private source/runtime dependency, broad owner credential in worker or automatic trust upgrade. Architecture security-level choice and unsupported guarantees require owner decision after the bounded evidence result; implementation must stay within an accepted ADR/profile. ## Dependencies And Priority Immediate safety prerequisite before untrusted worker/test/reviewer execution. Can prove verifier-precondition defect independently of gateway/intake. Harness feasibility supplies actual executor/lifetime; concurrency consumes safe cleanup rules. Budget integration later bounds all tools. ## Diagnostics And Permissions Report denied capability and safe remediation, no secrets/untrusted free-text output. Synthetic hostile fixtures only initially. OS/container access, live harness/inference and external effects require separately scoped approval; registering this work authorizes none. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Honest synthetic baseline: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/6 - Local authority: docs/architecture/threat-model.md, SECURITY.md, ADR 0005 ## Non-Goals No own sandbox/harness, security claim from path instructions or green synthetic tests, production execution or rollout.
kilo commented 2026-10-06 22:36:54 +00:00
Author
Member
Copy link

STOP_AND_ASK: Security Profile Decision After Bounded Evidence

Same sole-primary invocation kernel-loop-20261005T102040Z. After COMPLETE #48/#49 and fresh ALL-open canonical SELECT (18 issues, page2empty, exactwontfix15/30/37/44 excluded first), #50 selected as earliest remaining safety work. Current accepted Goal/all6AC/body unchanged, comments0/deps[]. No branch, implementation commit, PR or whole-PR review started for #50.

Actual Negative Evidence

Research ses_eecabf874ffeXiY12XwUbxUdBC used only a self-owned synthetic fixture under /tmp/kilo/kernel50-research-20261006, no repository modification/realharness/inference/credentials/OSsandbox/container activation. Parent inspected actual script, marker, source and checksum.

Closed environment Python3.12.3 command used PATH=/usr/bin:/bin, syntheticHOME, LANGC.UTF8, PYTHONDONTWRITEBYTECODE1 and publicsrcPYTHONPATH. Script probe.py SHA256 4233d26393c0d61b86f7a96887db29a02ddb9347cc91ecc77636c5ed7e602c6f invokes actual _install_candidate, TaskChecks, _run_command, verify_candidate; only evidence persistence is an in-memory hash sink. The fixed controller recipe /usr/bin/python3 -I -B tools/verify.py originally passed with marker absent. Candidate changes ONLY forbidden tools/verify.py, outside allowed {tests/approved.py}, to write its fixed harmless marker.

Observed: changed-paths=False → candidate verification command exit0 / evidenceTrue → structuralTrue → final RejectedResult, BUT marker present, containing candidate tooling executed. Marker was absent after installation and before verification. This demonstrates actual unauthorized candidate-tooling execution, not just final rejection. Synthetic Git base7587b0a0c99884a1466e26666547e3e7836853ad/head a92c035fb5a07e43c542968f0edca5ce52c6083e; fixture afterward clean. One initial fixture lacked mandatory Program criteria and stopped before exec; corrected contract + fresh fixture produced the result, no blind retry.

Current source at a9a65006cc: core/verification.py259-297 eagerly executes every check before rejecting; task_execution.py930-981 records scope rejection then candidate commands. CodexRuntime150-167 accepts TRUSTED_DEVELOPMENT/workspace-write only and explicitly refuses isolated/network/mount claims. FakeWorkspace/FakeAuthorityBroker are synthetic. ADR5/7, threat-model and SECURITY provide no accepted hostile worker/test/reviewer profile; ADR7:113-122 requires bounded stronger-profile proof and owner decision.

Maintained Mechanisms Compared, Not Adopted

  • Native Codex exact3fd5160cd6c78f2051bb54359d53f09207171733 Apache2/NOTICE: restricted-read/bwrap substrate exists, but fullhost read-only binding/legacyLandlock do not deny credentials; Kernel settings do not use a verified restricted-read profile or cover controller-launched tests/reviewer/tool grants.
  • Bubblewrap v0.11.0 exact9ca3b05ec787acfb4b17bed37db5719fa777834f LGPL2-or-later: daemon-free empty mount/namespace/capability/seccomp/egress controls, not a complete policy; support and unsafe binds/FDs/sockets/-try fallback must be proved/refused.
  • Moby28.5.1 exactf8215cc266744ef195a50a70d427c345da2acdbb and DockerDocs6cf1b1c167f032e8a6629da211602300b623b20e Apache2/NOTICE: rootless OCI boundary possible, but requires daemon/runtime/image/UID-map/lifecycle acceptance. Unsupported seccomp/cgroups/recursive-read-only may weaken defaults; no worker daemon socket, no host/privileged namespaces.
  • HARa4f3044025875464b5e57569823539987677941c Apache2 worktree isolation is not hostile denial. OpenHands4726601bb6987ddac497e0edb983e332282ba1f9 MIT wrapper defaults/net/mount/env/stop behavior do not prove required isolation/settlement.

Public pinned sources/licenses were inspected read-only. No tools installed/images pulled/sandbox launched/source copied/product dependency adopted, and no binary/platform denial receipt claimed.

Exact Owner Decision

Choose the first supported hostile-execution security profile and assurance target: enforcing boundary, supported platform, trusted launcher/runtime components, credential/egress separation and fail-closed limitations. This is the architecture/security/product-dependency/OS-access commitment explicitly reserved to the owner AFTER bounded evidence, not a test-mechanics or infrastructure question.

Smallest distinct researched directions are daemon-free Linux bubblewrap versus managed rootless OCI; native controls may be part of the first, not a proved standalone full path. Neither selected. Each requires accepted profile/ADR and separately scoped OS/container denial proof before implementation can honestly receive AC2–AC5.

Autonomous paths considered: ordering/trusted gate repair can address AC1 but cannot by itself prove controller/artifact/credential/host-parent/symlink/mount/network/socket denial, all-executor mediation, cleanup or supported-platform assurance. Closed env/allowlist/workspace-write remain trusted-development; refusing every untrusted request is honest but not selected-sandbox proof. Earlier development CI containers do not authorize product runtime/profile adoption. No single existing accepted mechanism fulfills all6AC, so choosing one implicitly would change owner commitments or weaken acceptance/security.

Therefore the whole invocation stops at STOP_AND_ASK, preserving #50 open and clean developa9a6500. Goal execution has no question tool; it will report blocked with this exact decision rather than invent an owner tooling question. No skip to another issue, code/branch/PR/review cycle, release/deploy/main/live inference/Router operation/privateaccess or security expansion. #48/#49 COMPLETE and immutable review histories remain intact.

## STOP_AND_ASK: Security Profile Decision After Bounded Evidence Same sole-primary invocation `kernel-loop-20261005T102040Z`. After COMPLETE #48/#49 and fresh ALL-open canonical SELECT (18 issues, page2empty, exactwontfix15/30/37/44 excluded first), #50 selected as earliest remaining safety work. Current accepted Goal/all6AC/body unchanged, comments0/deps[]. No branch, implementation commit, PR or whole-PR review started for #50. ### Actual Negative Evidence Research `ses_eecabf874ffeXiY12XwUbxUdBC` used only a self-owned synthetic fixture under `/tmp/kilo/kernel50-research-20261006`, no repository modification/realharness/inference/credentials/OSsandbox/container activation. Parent inspected actual script, marker, source and checksum. Closed environment Python3.12.3 command used PATH=/usr/bin:/bin, syntheticHOME, LANGC.UTF8, PYTHONDONTWRITEBYTECODE1 and publicsrcPYTHONPATH. Script `probe.py` SHA256 **4233d26393c0d61b86f7a96887db29a02ddb9347cc91ecc77636c5ed7e602c6f** invokes actual `_install_candidate`, `TaskChecks`, `_run_command`, `verify_candidate`; only evidence persistence is an in-memory hash sink. The fixed controller recipe `/usr/bin/python3 -I -B tools/verify.py` originally passed with marker absent. Candidate changes ONLY forbidden `tools/verify.py`, outside allowed `{tests/approved.py}`, to write its fixed harmless marker. Observed: `changed-paths=False` → candidate verification command exit0 / evidenceTrue → structuralTrue → final **RejectedResult**, BUT marker **present**, containing `candidate tooling executed`. Marker was absent after installation and before verification. This demonstrates actual unauthorized candidate-tooling execution, not just final rejection. Synthetic Git base7587b0a0c99884a1466e26666547e3e7836853ad/head a92c035fb5a07e43c542968f0edca5ce52c6083e; fixture afterward clean. One initial fixture lacked mandatory Program criteria and stopped before exec; corrected contract + fresh fixture produced the result, no blind retry. Current source at **a9a65006cc8cc5b5e4468746a18ff51daf742e6b**: core/verification.py259-297 eagerly executes every check before rejecting; task_execution.py930-981 records scope rejection then candidate commands. CodexRuntime150-167 accepts TRUSTED_DEVELOPMENT/workspace-write only and explicitly refuses isolated/network/mount claims. FakeWorkspace/FakeAuthorityBroker are synthetic. ADR5/7, threat-model and SECURITY provide no accepted hostile worker/test/reviewer profile; ADR7:113-122 requires bounded stronger-profile proof and owner decision. ### Maintained Mechanisms Compared, Not Adopted - Native Codex exact3fd5160cd6c78f2051bb54359d53f09207171733 Apache2/NOTICE: restricted-read/bwrap substrate exists, but fullhost read-only binding/legacyLandlock do not deny credentials; Kernel settings do not use a verified restricted-read profile or cover controller-launched tests/reviewer/tool grants. - Bubblewrap v0.11.0 exact9ca3b05ec787acfb4b17bed37db5719fa777834f LGPL2-or-later: daemon-free empty mount/namespace/capability/seccomp/egress controls, not a complete policy; support and unsafe binds/FDs/sockets/`-try` fallback must be proved/refused. - Moby28.5.1 exactf8215cc266744ef195a50a70d427c345da2acdbb and DockerDocs6cf1b1c167f032e8a6629da211602300b623b20e Apache2/NOTICE: rootless OCI boundary possible, but requires daemon/runtime/image/UID-map/lifecycle acceptance. Unsupported seccomp/cgroups/recursive-read-only may weaken defaults; no worker daemon socket, no host/privileged namespaces. - HARa4f3044025875464b5e57569823539987677941c Apache2 worktree isolation is not hostile denial. OpenHands4726601bb6987ddac497e0edb983e332282ba1f9 MIT wrapper defaults/net/mount/env/stop behavior do not prove required isolation/settlement. Public pinned sources/licenses were inspected read-only. No tools installed/images pulled/sandbox launched/source copied/product dependency adopted, and no binary/platform denial receipt claimed. ### Exact Owner Decision Choose the first supported hostile-execution **security profile and assurance target**: enforcing boundary, supported platform, trusted launcher/runtime components, credential/egress separation and fail-closed limitations. This is the architecture/security/product-dependency/OS-access commitment explicitly reserved to the owner AFTER bounded evidence, not a test-mechanics or infrastructure question. Smallest distinct researched directions are **daemon-free Linux bubblewrap** versus **managed rootless OCI**; native controls may be part of the first, not a proved standalone full path. Neither selected. Each requires accepted profile/ADR and separately scoped OS/container denial proof before implementation can honestly receive AC2–AC5. Autonomous paths considered: ordering/trusted gate repair can address AC1 but cannot by itself prove controller/artifact/credential/host-parent/symlink/mount/network/socket denial, all-executor mediation, cleanup or supported-platform assurance. Closed env/allowlist/workspace-write remain trusted-development; refusing every untrusted request is honest but not selected-sandbox proof. Earlier development CI containers do not authorize product runtime/profile adoption. No single existing accepted mechanism fulfills all6AC, so choosing one implicitly would change owner commitments or weaken acceptance/security. Therefore the **whole invocation stops at STOP_AND_ASK**, preserving #50 open and clean developa9a6500. Goal execution has no question tool; it will report blocked with this exact decision rather than invent an owner tooling question. No skip to another issue, code/branch/PR/review cycle, release/deploy/main/live inference/Router operation/privateaccess or security expansion. #48/#49 COMPLETE and immutable review histories remain intact.
kilo commented 2026-10-07 05:35:19 +00:00
Author
Member
Copy link

Owner Decision Received: Verification/Test-Only Bubblewrap

The owner explicitly resumed SAME invocation kernel-loop-20261005T102040Z on 2026-10-07T05:28:42Z:

Daemon-free Linux bubblewrap. Use it as the fail-closed enforcement boundary for the first Linux hostile-verification profile. Scope this decision to verification/test execution only; do not claim full hostile harness/worker isolation. Default-deny filesystem and network access, expose only explicitly required workspace/toolchain resources, and prove the boundary with negative tests. Defer managed rootless OCI until reproducible image/toolchain or whole-worker isolation requirements justify its additional lifecycle and operator surface.

This resolves the security-profile choice recorded in comment15513. Same #50, no new invocation or reset; #48/#49 COMPLETE and review histories preserved. Fresh canonical50 open/unexcluded, normal clean develop/base a9a65006cc8cc5b5e4468746a18ff51daf742e6b; no #50 branch/PR/review yet.

Binding receiver scope: first Linux verification/test executor, including untrusted test execution used by verification/review. It is NOT whole model/harness/worker isolation, a new approval/authentication service, ordinary live execution or full G09 completion. Broader original worker/harness obligations remain explicitly deferred/unproved, not silently relabeled delivered. Existing trusted-development remains selectable and labelled non-isolated; unsupported bubblewrap/platform fails closed rather than fallback. Rootless OCI/product daemon/image lifecycle deferred by owner.

Next scoped work: accepted ADR/role/resource/denial contract; verifier-precondition marker no-effect repair; explicit minimal sandbox mounts/toolchain, closed environment, no networking or host credential/controller/socket exposure; bounded owned-process cleanup and synthetic grant/expiry/revocation negatives; actual native negative tests, exact versions/configuration and unsupported refusals; independent security-critical whole-PR review and required gates. No new sandbox framework or scope beyond owner's mandate. Actual running denial evidence and scoped acceptance will be distinguished from source facts before any completion claim.

## Owner Decision Received: Verification/Test-Only Bubblewrap The owner explicitly resumed SAME invocation `kernel-loop-20261005T102040Z` on 2026-10-07T05:28:42Z: > Daemon-free Linux bubblewrap. Use it as the fail-closed enforcement boundary for the first Linux hostile-verification profile. Scope this decision to verification/test execution only; do not claim full hostile harness/worker isolation. Default-deny filesystem and network access, expose only explicitly required workspace/toolchain resources, and prove the boundary with negative tests. Defer managed rootless OCI until reproducible image/toolchain or whole-worker isolation requirements justify its additional lifecycle and operator surface. This resolves the security-profile choice recorded in comment15513. Same #50, no new invocation or reset; #48/#49 COMPLETE and review histories preserved. Fresh canonical50 open/unexcluded, normal clean develop/base `a9a65006cc8cc5b5e4468746a18ff51daf742e6b`; no #50 branch/PR/review yet. **Binding receiver scope:** first Linux verification/test executor, including untrusted test execution used by verification/review. It is NOT whole model/harness/worker isolation, a new approval/authentication service, ordinary live execution or full G09 completion. Broader original worker/harness obligations remain explicitly deferred/unproved, not silently relabeled delivered. Existing trusted-development remains selectable and labelled non-isolated; unsupported bubblewrap/platform fails closed rather than fallback. Rootless OCI/product daemon/image lifecycle deferred by owner. Next scoped work: accepted ADR/role/resource/denial contract; verifier-precondition marker no-effect repair; explicit minimal sandbox mounts/toolchain, closed environment, no networking or host credential/controller/socket exposure; bounded owned-process cleanup and synthetic grant/expiry/revocation negatives; actual native negative tests, exact versions/configuration and unsupported refusals; independent security-critical whole-PR review and required gates. No new sandbox framework or scope beyond owner's mandate. Actual running denial evidence and scoped acceptance will be distinguished from source facts before any completion claim.
kilo commented 2026-10-07 07:55:36 +00:00
Author
Member
Copy link

Scoped Verification/Test Implementation Published

SAME invocation kernel-loop-20261005T102040Z, owner's 2026-10-07 bubblewrap choice received. Normal branch issue-50-verification-bwrap from exact developa9a65006cc8cc5b5e4468746a18ff51daf742e6b; ordinary owner-authored commit a72154e675, tree2b0eabc3505776ae38394962b9a4147aeac9cf64, full20-file delta, clean normal checkout/no rewrite. One PR #74: #74 . Issue remains OPEN, no scoped/broad completion claim.

Trust/role scope is verification/test CHILDREN only, including those executed for review. It does NOT isolate model/Codex/wholeworker, hostcontroller or coldreviewer's model/harness context; original broader G09 obligations remain deferred, not silently relabeled delivered. RootlessOCI deferred, trusted-development nonisolated retained/neverautoupgraded. No ordinaryliveexecution or authority from documentation.

Actualmarker defect repaired: sequential trusted-evidence validation stops before later executing producers; directTaskChecks requiresexactsubjects/pinnedHEAD/allowedpaths/currentauthority/structuralproof. Original143/166 policy/digest/recovery encodings untouched; missing/unrun evidence notfabricated. ChangedMakefile/pyproject/tooling/AGENTS anddirectstructuralbypass no-effecttests passed.

New opt-in BubblewrapVerifier invokes maintained0.11.0atpublic9ca3b05...; explicitrequirednamespaceflags (NOT unshare-all/try), caps/NNP/newsession/dieparent/reaper/usernsassert, lazy fixed libseccompnetwork/escape/ABI restrictions. Emptyroot, exactread-onlyPythonclosure, controlledsnapshotbytes(no.git/untracked/privatefiles), synthetictmp/HOME/dev/proc, no wholehost/usr/etc/home/socket/cache mounts. Currentauthorizer outsidecandidate data binds subject/recipe/resource/snapshot/expiry/revocation. ClosedFds/stdinDEVNULL/pipes/consumedanonymousbootstrap execgate; reaper/proc1 FD exposure was actually found thenmasked. Boundedoutput; ownedPID-onlycancel, namespacecontainssetsidchild, settlementrequireslifetimeEOF+PID1pidfdexit, unknownretainscratch. No wholehostcensus/VM/DoS/globalatomicsafetyclaim.

Parent independently inspected executor667lines+ports/build/allnative746tests/precondition/source/operator/licenseclaims and reran make native-proof check package-check audit in closedenv with explicit managedbin; native48PASS ZEROskips, full 1295tests+57subtests PASS, package/import/installedlegacy+ordinary/audit/diffPASS. Nativecasecomposition:1positive,24actualhostile/lifecycle,22refusal/validation,1SYNTHETICobserverloss distinguished. Actualfilesystem/symlink/proc/FD/network/UNIXlisteners/ABI/cap/NS/read-only/tmp/timeout/flood/revoke/expiry/setsid-lock/bystander/parentcrash effects useonlyself-ownedsyntheticcanaries, no realsecrets/privateprofiles/liveharness.

ActualplatformUbuntu24.04.5/WSL2Linux6.18.33.2/x86_64/Python3.12.3, nativebwrap0.11.0SHAa75623409c0755c93ff5bba87ec4c407bf3dcb01d7b0d3c9802ee9a02a272e6f, installedlibseccomp2.5.5. Ownedunprivilegedbuild only(pinnedarchive552cec9c...,matchinglibcapheader/runtime packagesEXTRACTEDnotinstalled, Meson/NinjainintentionaloptionalUVgroup, all-groupsaudit). No code/binary bundled/sourcecopied/newframework/daemon/rootsecuritychange. Repositorysetup separatelybuilds8f928cda...andran48nativepassed, notsource-signatureattestation. Licences/rights/limits inADR0008/reusecatalogue.

Ordinarypytest withoutmanagednativebin is explicitlyskipped/UNPROVED; native-proofmissingbinfails. CanonicalbaselineCI withoutsetup doesnotattestnativepolicy. IndependentsecuritywholePRreview mustverifyexactpins andrunallgates+realnativeproofwithoutskips. Currentreviewcounter0/10; reservebeforeeachdispatch, samefinitebudget/public-source independence/frozenexactHEAD/base. No finalAPPROVE/merge/closure claim, sourceversion/mocks/finalRejectedalone neverdenialproof. Existing48/49histories preserved.

## Scoped Verification/Test Implementation Published SAME invocation `kernel-loop-20261005T102040Z`, owner's 2026-10-07 bubblewrap choice received. Normal branch `issue-50-verification-bwrap` from exact developa9a65006cc8cc5b5e4468746a18ff51daf742e6b; ordinary owner-authored commit **a72154e675adb513c6074dde6d0e0d91fa084d18**, tree2b0eabc3505776ae38394962b9a4147aeac9cf64, full20-file delta, clean normal checkout/no rewrite. One PR **#74**: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/74 . Issue remains OPEN, no scoped/broad completion claim. Trust/role scope is verification/test CHILDREN only, including those executed for review. It does NOT isolate model/Codex/wholeworker, hostcontroller or coldreviewer's model/harness context; original broader G09 obligations remain deferred, not silently relabeled delivered. RootlessOCI deferred, trusted-development nonisolated retained/neverautoupgraded. No ordinaryliveexecution or authority from documentation. Actualmarker defect repaired: sequential trusted-evidence validation stops before later executing producers; directTaskChecks requiresexactsubjects/pinnedHEAD/allowedpaths/currentauthority/structuralproof. Original143/166 policy/digest/recovery encodings untouched; missing/unrun evidence notfabricated. ChangedMakefile/pyproject/tooling/AGENTS anddirectstructuralbypass no-effecttests passed. New opt-in BubblewrapVerifier invokes maintained0.11.0atpublic9ca3b05...; explicitrequirednamespaceflags (NOT unshare-all/try), caps/NNP/newsession/dieparent/reaper/usernsassert, lazy fixed libseccompnetwork/escape/ABI restrictions. Emptyroot, exactread-onlyPythonclosure, controlledsnapshotbytes(no.git/untracked/privatefiles), synthetictmp/HOME/dev/proc, no wholehost/usr/etc/home/socket/cache mounts. Currentauthorizer outsidecandidate data binds subject/recipe/resource/snapshot/expiry/revocation. ClosedFds/stdinDEVNULL/pipes/consumedanonymousbootstrap execgate; reaper/proc1 FD exposure was actually found thenmasked. Boundedoutput; ownedPID-onlycancel, namespacecontainssetsidchild, settlementrequireslifetimeEOF+PID1pidfdexit, unknownretainscratch. No wholehostcensus/VM/DoS/globalatomicsafetyclaim. Parent independently inspected executor667lines+ports/build/allnative746tests/precondition/source/operator/licenseclaims and reran `make native-proof check package-check audit` in closedenv with explicit managedbin; **native48PASS ZEROskips**, full **1295tests+57subtests PASS**, package/import/installedlegacy+ordinary/audit/diffPASS. Nativecasecomposition:1positive,24actualhostile/lifecycle,22refusal/validation,1SYNTHETICobserverloss distinguished. Actualfilesystem/symlink/proc/FD/network/UNIXlisteners/ABI/cap/NS/read-only/tmp/timeout/flood/revoke/expiry/setsid-lock/bystander/parentcrash effects useonlyself-ownedsyntheticcanaries, no realsecrets/privateprofiles/liveharness. ActualplatformUbuntu24.04.5/WSL2Linux6.18.33.2/x86_64/Python3.12.3, nativebwrap0.11.0SHAa75623409c0755c93ff5bba87ec4c407bf3dcb01d7b0d3c9802ee9a02a272e6f, installedlibseccomp2.5.5. Ownedunprivilegedbuild only(pinnedarchive552cec9c...,matchinglibcapheader/runtime packagesEXTRACTEDnotinstalled, Meson/NinjainintentionaloptionalUVgroup, all-groupsaudit). No code/binary bundled/sourcecopied/newframework/daemon/rootsecuritychange. Repositorysetup separatelybuilds8f928cda...andran48nativepassed, notsource-signatureattestation. Licences/rights/limits inADR0008/reusecatalogue. Ordinarypytest withoutmanagednativebin is explicitlyskipped/UNPROVED; native-proofmissingbinfails. CanonicalbaselineCI withoutsetup doesnotattestnativepolicy. IndependentsecuritywholePRreview mustverifyexactpins andrunallgates+realnativeproofwithoutskips. Currentreviewcounter0/10; reservebeforeeachdispatch, samefinitebudget/public-source independence/frozenexactHEAD/base. No finalAPPROVE/merge/closure claim, sourceversion/mocks/finalRejectedalone neverdenialproof. Existing48/49histories preserved.
kilo commented 2026-10-07 20:44:41 +00:00
Author
Member
Copy link

Owner-Scoped Reception Complete: Verification/Test-Child Profile Only

The owner's explicit 2026-10-07 decision in comment15516 scoped this delivery to the first Linux hostile verification/test-child boundary. Reception and issue completion below refer only to that selected profile, not full hostile model/harness/worker isolation or all G09. The original broader role requirements remain unreceived/deferred architecture obligations; future execution must verify actual role-specific receipts, never infer them from this issue's status. Rootless OCI remains deferred. No live inference/rollout or new authentication is authorized.

Same invocation kernel-loop-20261005T102040Z, PR #74 supported non-force/non-auto stylemerge verified as 1deb32900d, parents approved base a9a65006cc + approved HEAD 30c7204144. Tree 84ddc4dc91 exactly equals reviewed HEAD; ancestry/full difference check and merged metadata passed. Normal checkout clean on matching current develop.

Preserved Independent Security Reception

#50 used 3/10 reviews: ordinal1 REQUEST_CHANGES (parent-death readiness + duplicate evidence), ordinal2 infrastructure connection reset/no verdict (consumed, never resumed as reviewer), ordinal3 APPROVE, findings[] fresh native ses_eea492a73ffegIOmtx07Xwbu2G, exact HEAD/base. Changed bounded sequential-read transport strategy preflighted after reset; complete 20-file accumulated review criteria were not reduced. Public exact archive was independently fetched and entire build-source content compared; licence, native process/filter semantics, binary/library and all six applicable scoped AC verified. Initial/final Git+MCP currentness and clean frozen objects matched. #48/#49 histories intact.

Both defects first reproduced: old duplicate ID allowed later marker producer, now original DomainError occurs immediately before later call. Maintained self-owned FIFO lock forced native reaper before parent-death arming while bootstrap ready; old gate actually released marker and held descendant lock. The new gate requires exact owned PID-1 one added installed filter relative to unchanged monitor plus namespace/parent/pidfd/liveness checks; exact pinned source applies that filter after parent-death setup. Missing/malformed observations refuse, no timing/PPid/bootstrap-only inference. Forced pre-arm cancellation/controller-loss and post-arm execution/settlement/lockrelease/bystander tests pass; pre-arm unknown liveness retains scratch honestly.

Integrated Scoped Criteria

  1. Forbidden candidate tooling/gate edits and invalid/missing/stale/worker/false/duplicate prerequisite evidence prevent command/later-producer effects. Direct TaskChecks cannot bypass exact source/recipe/subject/policy/path/structural/current-authority gates; skipped checks receive findings, not fabricated evidence.
  2. Selected verifier/test child actually denies synthetic controller/artifact/owner/provider/Forge/host-parent, symlink/proc/mount/FD read/write, network/IP/Unix/container-socket/alternate-ABI access. Only declared narrow read-only Python closure, explicit snapshot and private scratch are exposed. Trusted parent/caller/admin/toolchain assumptions are explicit, not full worker denial.
  3. Controller-only immutable recipe/resources/snapshot and exact subject bind current authorization, expiry/revocation; untrusted data cannot choose extra mounts/policies/authorizer/binary. Anonymous exec gate waits for actual post-arming owned process readiness and fresh authorization. No broker/signature/authentication guarantee invented from a label.
  4. Owned monitor/namespace-init/pidfds/lifetime receipts prevent shared signaling, including setsid child; actual lockrelease/bystander/timeout/flood/parent loss cases pass. Unproven settlement remains unknown and preserves scratch; no general host census. Trusted-development remains explicitly non-isolated.
  5. Exact source9ca3b05ec787acfb4b17bed37db5719fa777834f/0.11.0, kernel/ABI/closure/filter and receipts recorded in ADR0008. Unsupported resources/features/platform/version/proof refuse, never try/unsandboxed/weak fallback. No VM/global atomicity or comprehensive DoS claim.
  6. Old143/166 identities/policy/grants/envelopes/recovery fixtures unchanged, no automatic configuration upgrade. Imports/core stay self-contained; optional native tool does not introduce runtime Python dependency or private service. Operator/security/migration docs and independent security reception describe the actual narrow role.

Integrated Validation And Setup Recovery

Initial integrated native test setup found the old ephemeral /tmp/kilo binary had been removed; 2PASS/53setupERROR was not enforcement proof, and later checks did not run. No skip/drop/fallback used. Public exact archive re-fetchedSHA552cec9c79bb85c8ecd25ae3e55efca9af03390c17d829885ee45722dedada4f; matching signed-index libcap2.66 development/runtime packages extracted into OWN scratch only (no host install/settings/daemon), hashes match original and installed library. Current repository locked setup tool reconstructed unmodified upstream with Meson1.12.1/Ninja1.13.2/GCC13.3/ld2.42.

Current rebuilt binary /tmp/kilo/kernel50-integrated-proof-20261007/native/build/bwrap SHA b86be326c70893bce3226de259455da28a7eb3496188205cde7a4048d355f698; different build-path/hash is NOT a reproducible-native-build/signature claim. Same pinned source, libcap/libseccomp and supported Linux6.18.33.2-WSL2 x86_64/Ubuntu24.04.5/Python3.12.3 child closure. Actual integrated proof against this reconstructed instance: 55 native tests PASS, ZERO skips, all 1303 tests + 57 subtests PASS, format/lint/type/import/secret/diff checks, reproducible wheel/sdist/installed legacy/intake/API import and all-groups audit PASS. Observer-fault/SYNTHETIC refusal cases distinguished from actual denial/lifecycle proof.

Canonical exact PR CI #2366 SUCCESS, merged develop push #2367 SUCCESS: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/129 . Canonical baseline without native setup is NOT native attestation; independent and integrated zero-skip native proof supplies that scoped evidence. No copied/bundled bwrap source/binary, LGPL external-utility rights documented; no new sandbox framework or credential store.

Closure receives the owner's verification/test-only first profile and precondition repair, not original full-worker G09 obligations. No new review cycle, next issue implementation, full worker/harness isolation, rootless OCI, private/runtime/credential access, live inference/Router operation, main/release/deploy or security expansion is implied.

## Owner-Scoped Reception Complete: Verification/Test-Child Profile Only The owner's explicit 2026-10-07 decision in comment15516 scoped this delivery to the first Linux hostile verification/test-child boundary. **Reception and issue completion below refer only to that selected profile, not full hostile model/harness/worker isolation or all G09.** The original broader role requirements remain unreceived/deferred architecture obligations; future execution must verify actual role-specific receipts, never infer them from this issue's status. Rootless OCI remains deferred. No live inference/rollout or new authentication is authorized. Same invocation `kernel-loop-20261005T102040Z`, PR #74 supported non-force/non-auto stylemerge verified as **1deb32900d10dab6a3baad0c454ef9aa19c58733**, parents approved base **a9a65006cc8cc5b5e4468746a18ff51daf742e6b** + approved HEAD **30c72041445c571fc84d4a1786996123a2c941e7**. Tree **84ddc4dc912a000b8c0fe90047cc033a6eb840e2** exactly equals reviewed HEAD; ancestry/full difference check and merged metadata passed. Normal checkout clean on matching current develop. ### Preserved Independent Security Reception #50 used **3/10** reviews: ordinal1 REQUEST_CHANGES (parent-death readiness + duplicate evidence), ordinal2 infrastructure connection reset/no verdict (consumed, never resumed as reviewer), ordinal3 **APPROVE, findings[]** fresh native `ses_eea492a73ffegIOmtx07Xwbu2G`, exact HEAD/base. Changed bounded sequential-read transport strategy preflighted after reset; complete 20-file accumulated review criteria were not reduced. Public exact archive was independently fetched and entire build-source content compared; licence, native process/filter semantics, binary/library and all six applicable scoped AC verified. Initial/final Git+MCP currentness and clean frozen objects matched. #48/#49 histories intact. Both defects first reproduced: old duplicate ID allowed later marker producer, now original DomainError occurs immediately before later call. Maintained self-owned FIFO lock forced native reaper before parent-death arming while bootstrap ready; old gate actually released marker and held descendant lock. The new gate requires exact owned PID-1 one added installed filter relative to unchanged monitor plus namespace/parent/pidfd/liveness checks; exact pinned source applies that filter after parent-death setup. Missing/malformed observations refuse, no timing/PPid/bootstrap-only inference. Forced pre-arm cancellation/controller-loss and post-arm execution/settlement/lockrelease/bystander tests pass; pre-arm unknown liveness retains scratch honestly. ### Integrated Scoped Criteria 1. Forbidden candidate tooling/gate edits and invalid/missing/stale/worker/false/duplicate prerequisite evidence prevent command/later-producer effects. Direct TaskChecks cannot bypass exact source/recipe/subject/policy/path/structural/current-authority gates; skipped checks receive findings, not fabricated evidence. 2. Selected verifier/test child actually denies synthetic controller/artifact/owner/provider/Forge/host-parent, symlink/proc/mount/FD read/write, network/IP/Unix/container-socket/alternate-ABI access. Only declared narrow read-only Python closure, explicit snapshot and private scratch are exposed. Trusted parent/caller/admin/toolchain assumptions are explicit, not full worker denial. 3. Controller-only immutable recipe/resources/snapshot and exact subject bind current authorization, expiry/revocation; untrusted data cannot choose extra mounts/policies/authorizer/binary. Anonymous exec gate waits for actual post-arming owned process readiness and fresh authorization. No broker/signature/authentication guarantee invented from a label. 4. Owned monitor/namespace-init/pidfds/lifetime receipts prevent shared signaling, including setsid child; actual lockrelease/bystander/timeout/flood/parent loss cases pass. Unproven settlement remains unknown and preserves scratch; no general host census. Trusted-development remains explicitly non-isolated. 5. Exact source9ca3b05ec787acfb4b17bed37db5719fa777834f/0.11.0, kernel/ABI/closure/filter and receipts recorded in ADR0008. Unsupported resources/features/platform/version/proof refuse, never try/unsandboxed/weak fallback. No VM/global atomicity or comprehensive DoS claim. 6. Old143/166 identities/policy/grants/envelopes/recovery fixtures unchanged, no automatic configuration upgrade. Imports/core stay self-contained; optional native tool does not introduce runtime Python dependency or private service. Operator/security/migration docs and independent security reception describe the actual narrow role. ### Integrated Validation And Setup Recovery Initial integrated native test setup found the old ephemeral `/tmp/kilo` binary had been removed; **2PASS/53setupERROR was not enforcement proof**, and later checks did not run. No skip/drop/fallback used. Public exact archive re-fetchedSHA552cec9c79bb85c8ecd25ae3e55efca9af03390c17d829885ee45722dedada4f; matching signed-index libcap2.66 development/runtime packages extracted into OWN scratch only (no host install/settings/daemon), hashes match original and installed library. Current repository locked setup tool reconstructed unmodified upstream with Meson1.12.1/Ninja1.13.2/GCC13.3/ld2.42. Current rebuilt binary `/tmp/kilo/kernel50-integrated-proof-20261007/native/build/bwrap` SHA **b86be326c70893bce3226de259455da28a7eb3496188205cde7a4048d355f698**; different build-path/hash is NOT a reproducible-native-build/signature claim. Same pinned source, libcap/libseccomp and supported Linux6.18.33.2-WSL2 x86_64/Ubuntu24.04.5/Python3.12.3 child closure. Actual integrated proof against this reconstructed instance: **55 native tests PASS, ZERO skips**, all **1303 tests + 57 subtests PASS**, format/lint/type/import/secret/diff checks, reproducible wheel/sdist/installed legacy/intake/API import and all-groups audit PASS. Observer-fault/SYNTHETIC refusal cases distinguished from actual denial/lifecycle proof. Canonical exact PR CI **#2366 SUCCESS**, merged develop push **#2367 SUCCESS**: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/129 . Canonical baseline without native setup is NOT native attestation; independent and integrated zero-skip native proof supplies that scoped evidence. No copied/bundled bwrap source/binary, LGPL external-utility rights documented; no new sandbox framework or credential store. Closure receives the owner's verification/test-only first profile and precondition repair, not original full-worker G09 obligations. No new review cycle, next issue implementation, full worker/harness isolation, rootless OCI, private/runtime/credential access, live inference/Router operation, main/release/deploy or security expansion is implied.
kilo closed this issue 2026-10-07 20:45:03 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-62-installed-compatibility
issue-58-private-outcome-export
issue-57-recovery-preparation-alerts
issue-57-owner-served-state
issue-106-final-authority-dag
issue-106-forgejo-ordinary-execution
issue-105-independent-provider-drivers
issue-59-work-resource-ownership
issue-56-atomic-approval-recovery
issue-56-work-budget-enforcement
issue-103-publish-architecture-backlog
issue-62-platform-reception
issue-55-mi-utilized-reference
issue-52-kilo-offline-proof
docs/conversational-review-policy
issue-60-reception-fixture-plan
issue-62-compatibility-matrix-spec
issue-58-export-rights-spec
issue-57-owner-state-spec
issue-56-task-cost-shapes
issue-90-owned-cancellation
issue-54-product-review
issue-53-runtime-integration
No results found.
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#59 [Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation
Creatidy/creatidy-kernel
Reference
Creatidy/creatidy-kernel#50
No description provided.