[Kernel][G01] Integrate the proved harness lifecycle through the existing Runtime boundary #53
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Creatidy/creatidy-kernel#53
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
Owner: Kernel. Implement the adapter/session composition chosen by the bounded #47 evidence and accepted lifecycle/security decision, using an existing harness rather than building an agent. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.
Why
A reusable control proof is not yet a supported user path. Known product work must be registered even when concrete interface choice depends on prior proof; this issue is conditional on that result, not approval of ACP/Kilo/Claude or a new API.
Current Evidence
At
eb4f4a2956, Runtime in ports/execution.py has five useful methods; codex_runtime.py provides native-only behavior and concrete restore. codex_stdio.py bounds RPC/notification queues; no general permission/event/resume/IDE ownership integration is exposed. #8/PR #26 is a bounded Codex baseline, not an adapter capability matrix. #48 separately repairs current task lifetime defects.Scope
Reuse the proved native/standard interface, capability-negotiating actual events/permission/candidate/cancel/recovery behavior. Map each existing Runtime method to the chosen exact version; add public contract changes only where proof and ADR require them. Identify file/terminal executor and enforce scope. Provide explicitly Kernel-owned session/workspace and supported optional IDE attach, with truthful lifetime and UI-close behavior. Reuse useful native delegation/review while keeping Kernel acceptance authority.
Acceptance Criteria
Reuse
Implementation must follow #47 ADOPT -> VENDOR/COPY -> PORT -> ADAPT -> BUILD evidence with exact upstream revision/files, license/attribution, separate service/subscription terms, negative guarantees, security, dependencies and maintenance owner. Preserve local Runtime/effect/state/identity mechanisms unless replacement has a measured semantic advantage; no whole framework adoption from similar names.
Constraints
No own harness/plugin/protocol/supervisor by convenience, provider routing policy or automatic acceptance. No assumed ACP choice. Gateway identity/backend integration is a separate consumer issue. Retain A0/inward dependencies, unknown-before-retry, trusted-development distinction and no private product dependency.
Dependencies And Priority
Core execution integration after #47 feasibility and explicit process/security decisions; incorporate #48 lifetime repair and #50 enforced isolation where selected. It is not blocked on a completed Console. Gateway compatibility and review use this adapter, but each must have its own acceptance evidence.
Permissions
Synthetic conformance first. Live session/IDE/UI-close/cancel/recovery proof requires separately authorized inference, service/tool/workspace scopes; supervision/handoff outside accepted ADR requires owner decision. Registration provides none.
Links
Non-Goals
No product routing, Console, new agent or unverified future command examples.
kilo referenced this issue2026-10-04 22:29:51 +00:00
STOP_AND_ASK: AC4 Acceptance / Executor-Authority Decision
Same sole-primary invocation
kernel-loop-20261005T102040Z. Following verified owner-scoped #50 reception, full canonical queue/exclusions/comments/ordering selected #53 after confirmed #51 semantic-contract and #52 translation gates. Fresh #53 open/unexcluded/body unchanged. Empty ordinary branchissue-53-runtime-conformancefrom develop1deb32900d; no substantive edits, commits, push, PR or review. Normal checkout safely returned to clean current develop; empty branch/history preserved. No reset/stash/issue registration.Concrete Source Boundary
Public exact Codex 3fd5160cd6c78f2051bb54359d53f09207171733, Apache2/NOTICE, independently inspected:
core/src/tools/sandboxing.rs:195-230:NeverproducesSkip { bypass_sandbox:false }, not per-operation client permission mediation.core/src/exec_policy.rs:440-460: when every parsed segment has an explicitAllow, returnsSkip { bypass_sandbox:true }.core/src/tools/orchestrator.rs:168-199,265-285: non-strict Skip avoids client approval; bypass can choose SandboxTypeNone. Executor-managed enforcement is a separate qualification, so None is NOT universally an unsandboxed verdict.core/src/tools/sandboxing.rs:239-295: active denied-read restrictions correctly prevent that bypass. The Kernel's legacy workspace-write policy has no such denied-read field.app-server fs_processor.rs:53-93/ local_file_system.rs:95-125`: direct fs RPCs lack thread sandbox and dispatch unsandboxed without context; do not forward them. Refusal of these RPCs does not mediate native tool paths.Local codex_runtime.py143-242 currently accepts ONLY TRUSTED_DEVELOPMENT/workspace-write/never and checks durable authority before thread/turn, not every tool operation. Decline/cancel and empty additional-permission native responses are real supported paths, but denying a received request cannot constrain an operation that never requests one, revoke baseline rights or prove global file/terminal enforcement. These are permitted SOURCE paths, NOT an assertion that an installed instance is exploitable or that a model has arbitrary client RPC access. No installed/native/model/session/IDE probe or private config read occurred.
Configuration-Only Engineering Paths Checked
Second independent bounded inspection explicitly looked for a maintained remedy rather than inventing a question:
No current supported configuration-only path is proved sufficient for full AC4 with unchanged accepted baseline. Existing useful allowlists, correlation, denial responses, dispatch expiry, interrupt/cancel and uncertainty recovery remain in-scope engineering work; none establishes the missing executor guarantee. No weaker callback/prompt policy is promoted as enforcement.
Exact Owner-Controlled Decision
AC4 requires reception criteria to distinguish:
This is a genuine newly concrete acceptance/authority/security distinction after bounded source evidence, not a model, test-mechanics, sandbox-install or routine tooling choice. #47/old trusted-development control proof is received; own #53 feature absence is not a gate, and no merely-open upstream issue was substituted for evidence. No autonomous safe code path can assert full AC4 under the ambiguous stronger criterion without changing accepted meaning or a security commitment. No new numeric calibration, host profile, credential or private dependency is required to state this boundary.
Preserved Evidence And Terminal State
Source-only implementation preflight
ses_ee7ab58c5ffeDf1Sa5VCTEBOHistopped BEFORE edits; additional config inspectionses_ee799e359ffecq4UqgKfX8RxP1likewise read-only. Parent opened actual pin code/local source; one reader timeout resolved with another exact reader, not treated as missing evidence. Closed-env focused old runtime/stdio/discovery64PASS and full baseline check/package/audit1250PASS+53nativeSKIPS+57subtests are historical-regression evidence, NOT #53 permission or worker-isolation reception. No skipped denial was claimed.STOP_AND_ASK terminates the whole current invocation at #53, issue stays OPEN, review counter0, no partial feature/PR/merge/closure. Goal execution has no question tool, so reports blocked with this exact decision and the two distinct choices instead of asking an artificial tooling question. No skip to #61 or another issue, no new cycle/controller or automatic restart. #48/#49/#50 owner-scoped completions and every review history preserved. No live inference/Router operation/private state/credentials/IDE takeover/main/release/deploy/security expansion.
Owner Decision: Universal Executor Enforcement, AC4 Preserved
Actual owner directive 2026-10-08T00:07:13Z resolves comment15592's interpretation decision in the SAME invocation
kernel-loop-20261005T102040Z:This is authoritative current owner scope, not a weaker denial-only reception or a product GO/live/account grant. The option question is RESOLVED and must not be asked again. #50's role receipt remains verification/test children only; no broader status inference.
#53 remains OPEN and gated until the required executor boundary is proved. Fresh source/checkout facts: normal clean develop
1deb32900d10dab6a3baad0c454ef9aa19c58733matches canonical remote; local emptyissue-53-runtime-conformanceretained, no implementation/commit/push/PR/review (counter0), no history reset. All #48/#49/#50 review/completion records preserved.Because this required pre-integration receipt is now an explicit known owner prerequisite, untouched #53 integration follows current NONTERMINAL eligibility return to fresh full SELECT; it is not a blanket BLOCKED condition for unrelated eligible Kernel work. Required read-only mechanism comparison and separately bounded synthetic conformance inspection can evaluate what would establish the gate, but must not produce speculative adapter/grant APIs or claim integration before proof. No new issue queue, bypass, unmediated effect fallback, role promotion, services/profile adoption or live inference follows merely from registration.
No private/credential/runtime access, Router operation/model selection, main/release/deploy, UI takeover or new numerical policy authorized. Future scope/proof updates must record actual native/effect-channel coverage and residual uncertainty; source-path findings alone do not prove an installed worker boundary.
Separate Worker/Executor Reuse Evaluation: Gate Still Unreceived
Owner's universal AC4 decision in comment15606 remains binding. Read-only bounded research
ses_ee71fe807ffegStC5HoG5iRUtocompared exact public source/licensing, not an installed worker profile or permission-request-only proof:No source copied, dependency/profile adopted, image/tool installed, worker/container/native session/inference/code executed, refs/repo/Forge changed or private artifact/credential inspected. 75 bounded public read/search calls including changed-reader failures; pins/licence facts independent of entitlement/binary/distribution and actual conformance.
Required separate evidence specification: identify the entire harness/executor/resource/transport closure; every native tool, process/subprocess, delegated/review tool, direct fs/process/RPC/handle, MCP/extension/hook/browser channel is either routed through trusted current-authority enforcement or unavailable. Trace exact scope/spec/Attempt/revision/recipe/operation/fence. Test enqueue-before-revoke/execute-after-revoke, retained-handle new reads/writes, interactive input/process start, expiry during preparation, stale/replayed delegation/approval, reconnect/restart without renewed authority and no alternate FD/socket/network/controller path. Already dispatched external operations remain uncertain, not rolled back. Bounded termination/settlement and unrelated-session protection are separate from prevention of new unauthorized effects.
A source-supported offline falsification probe, not conformance receipt, could reuse the native LocalFileSystem::with_runtime_paths test fixture with only owned synthetic files: authorize open then revoke, keep executor alive, attempt retained-handle readBlock/fresh read/write/process start/interactive write and continuing-child fresh write. Existing source predicts the unmodified interfaces alone fail universal semantics. Before such execution, actual helper/tool/artifact closure and distinct worker setup must be inspected and bounded; this research has not run it or selected a profile. No inferred custom engine/new permanent service necessity—demonstrate absence of an existing exclusive ephemeral composition first.
Therefore #53 remains OPEN/GATED until real separate worker/executor conformance cells pass; source/version/approval denials/static isolation/#50's55native tests do not satisfy it. The interpretation decision is resolved, not another STOP_AND_ASK. No #53 branch edits/commit/push/PR/review (counter0), normal develop clean1deb329. Same invocation preserves all delivery histories and resumes full SELECT for unrelated eligible work while the known pre-integration gate remains. No custom harness/protocol/sandbox/service, weaker compatibility-ready label, Router ownership change, private/live/main/release/deploy permission follows from this plan.
Bounded #53 continuation plan (research only — implementation gated)
Status basis: #78/PR #81 (FEASIBLE, bounded synthetic whole-worker proof, 2/10 APPROVE) is not yet integrated into canonical develop, so per the owner's continuation directive this stage records a plan only. No implementation branch, PR or speculative adapter/grant API is created here; nothing in this comment authorizes execution.
Slice definition (first reviewable conformance increment)
One PR, from post-integration
develop, reusing the #78 toolroot/profile/harness: launch a real, version-pinned Codex CLI inside the exact #78 rootless OCI boundary (nosrc/port changes in the first slice; a synthetic model backend via the documented native protocol — no paid inference), drive it through actual native file/terminal tool operations against synthetic fixtures, and record per-path evidence. The Kernel controller, its state and credentials stay outside the boundary; model access only via a controlled local synthetic endpoint; external effects only via the #78 relay seam.The five mandatory findings, plan per finding
masked_eqdeny rules onclone(single-bit masks per namespace flag: NEWUSER/NEWNS/NEWNET/NEWPID/NEWIPC/NEWUTS/NEWCGROUP) are expressible and enforced through the supported OCI seccomp profile path, or whether libseccomp-grade filters (as in ADR 0008) are required. Native demonstration: worker attemptsclone()with each flag; assert EPERM with observed errnos. If the profile format cannot express it, AC4's namespace-creation refusal stays UNPROVEN with the exact missing mechanism named (options: runtime-side filter support, seccomp-notify agent, or a stronger executor — each a separate owner decision).cgroup.procsof the Attempt's systemd scope, read host-side) plus PID-namespace identity recorded at launch;podman wait/events for terminality; markers demoted to secondary evidence. Settlement = observed empty membership after terminality; anything else (including vanished-before-read) stays UNKNOWN and blocks workspace cleanup, per ADR 0008 semantics.newuidmapinstallation — a separate owner-authorized host change. Record the sufficiency argument against the threat model in the slice's evidence; do not install anything autonomously.Evidence to record in the slice
Exact Codex binary/version/provenance and method inventory; OCI runtime/image provenance; per-tool-path observed enforcement; resource and permission denials; process lifetime/cancel/settlement observations; dynamic-authority behavior; missing/unsupported paths; and the explicit residual list needed for full AC4 — including anything that requires paid inference or a host-wide change, returned as a bounded owner decision rather than invented receipts.
Prerequisites before any of this executes: PR #81 integrated into develop by authorized merge; then a fresh branch from that develop, distinct from #80; ≤10 fresh whole-PR reviews for the new delivery; all repository gates plus the native targets.
Bounded #53 continuation receipt: real-Codex whole-worker native proof delivered (PR #84)
Owner-directed bounded continuation executed 2026-10-09 per this issue's continuation plan. #53 remains OPEN and gated; this is a bounded slice receipt, not closure, not integration, not product GO. No merge, release, deploy, live inference, paid inference, privileged host change, or
src/product change occurred.Delivered
One ordinary branch
issue-53-codex-oci-worker-prooffrom verified canonical develop73e3af45c911aa9ae8c26b97bf0ec9f452063f10; PR #84 at final HEAD7e2a02135b540c047e60cd4a4ceebab3b25dc90e(4 commits; standalone work, unmerged). The stale empty placeholder branchissue-53-runtime-conformanceis preserved untouched.Native proof (real harness, observed — no synthetic worker substitute)
Real codex-cli 0.159.3 (standalone musl release, hash-pinned, mounted read-only, fresh synthetic
CODEX_HOME, owner Codex state never read) executed inside the exact #78 rootless OCI boundary; driven through the productionCodexStdiotransport and its native app-server protocol with a controller-authored synthetic Responses backend in-boundary (offline, container-internal loopback, no paid inference). Receipt:make codex-oci-proof→ 10 passed, 0 failed, 0 native skips (multiple runs). All eight required proof points exercised and asserted: native lifecycle; workspace-only native tool ops; two native terminal channels with detached-descendant settlement + bystander preservation; forbidden host FS/network denial withapprovalPolicy: never+sandbox: danger-full-accessrecorded verbatim (enforcement independent of approval callbacks); controller interrupt/expiry/termination/settlement; post-expiry/revocation refusal at both relay and controller; monitor-loss fail-closed + reconciliation + lost-reply uncertainty; immutable collection with independent digest verification; plus the in-flight-writes (no-rollback, bounded-by-termination) cell.Evidence-backed dispositions (carried #78 limitations)
clone3now returns ENOSYS (upstream OCI default-profile practice) instead of EPERM; identical deny set, syscall still denied; per-flagclonerestriction remains a named owner decision. Independently confirmed as a compatibility correction by review.podman container existsgate) corroborated by attempt-unique argv markers the real harness runs without cooperation. (The plan sketch named cgroup.procs/scope reads; the delivered equivalent-or-stronger gate is recorded in the decision record — exact-mechanism preference remains an owner decision at integration time.)newuidmapinstalled — nothing privileged done).Gates and review
make check(1414 passed / 84 skipped / 81 subtests; secrets clean;git diff --checkclean),make package-check,make audit(no known vulnerabilities),make oci-worker-proof(#78 regression, 26 passed),make codex-oci-proof(10 passed) — all at the delivered HEAD. Fresh independent whole-PR reviews at frozen exact HEAD/base, append-only budget: 4/10 consumed — ordinals 1–3 COMMENT (8 non-blocking P3s total, each remediated in a normal commit: 359c632→b1bca99→e52904c→7e2a021), ordinal 4 (7e2a021/73e3af4): APPROVE, findings[] empty, with the sanitized gates reproduced exactly and the clone3 judgment independently verified against the pinned upstream default profile.Recommendation recorded for the owner
The deliverable record (docs/architecture/codex-oci-native-proof.md) carries the bounded GO for progressing #53 integration planning on this boundary (the executor prerequisite of comments 15606/15612 is now natively proved for the exercised real-harness closure), with named residuals for full AC4 reception: complete per-channel closure enumeration (MCP, fs/* RPCs, extensions, delegated tools), Kernel-side adapter integration with durable authority, supported-version migration evidence, the #15612 falsification rerun, multi-UID deployment prerequisite, and live-inference behavior (unauthorized, untested). A bounded proof is accepted while #53 remains open; closure requires the integration delivery with its own evidence.
#53 bounded continuation: owner-directed collection trust-boundary correction delivered — PR #84 READY_TO_MERGE
The owner-directed security correction against PR #84 is complete. #53 remains OPEN and gated; standalone work does not merge; no live inference, no architecture expansion, no unrelated changes.
The finding and its resolution
An independent source inspection identified that the original post-settlement collector traversed the worker-controlled workspace with symlink-following primitives (
Path.rglob/is_file/stat/read), so a worker-created symlink to a host path (invisible inside OCI, readable to the trusted controller) could cause an unauthorized host-side read during collection. Reproduced safely before remediation with synthetic files only: a workspace symlink to a synthetic host-only file was collected with the target's digest.Fail-closed remediation (commit
dcf321d, hardened through7aad45e):tools/codex_oci_proof/collect.py: descriptor-pinned single-component traversal; symbolic links refused in every component (lstatclassification +O_NOFOLLOW/O_DIRECTORYopens — a mid-traversal swap fails closed with ELOOP);fstatvalidation on the exact descriptor that is read (no path-validation/open race);O_NONBLOCKso a swapped-in FIFO cannot block the controller; bounded reads (8 MiB/file, enforced against both declared size and actual bytes), entry budget (4096, directories included), depth cap (32); refusals recorded with reasons as failures, never silently skipped.candidate/root, with exact bytes durably preserved and digest-bound under the controller-ownedcollected/tree — a collected artifact snapshot, not a bare digest manifest. Private Codex runtime state (codex-homeincl. sessions/rollouts, mock backend records, attempt spec, launcher observations) is inventoried separately under controller authority and never published.worker_observationsrouted through the same safe bounded reader (absence vs tampering distinguished); collection refuses to run before observed container settlement.TestCollectionSafetysuite (7 cells) gates the same collector in everymake checkwithout the toolroot.Verification
7e2a021; ordinals 5–8 COMMENT on each security HEAD — the trust-boundary finding independently confirmed genuinely resolved at every one — with 5 further non-blocking hardening/accuracy P3s (O_NONBLOCK, tamper-visibility, test-plumbing reads, bound accuracy, traversal depth/budget, sink-pinned rollout reads, preserved-copy digest) each remediated (3c2a2e9,03d6238,ba078f9,7aad45e); ordinal 9 (7aad45e/73e3af4): APPROVE, findings[] empty.7aad45e8d75ddc2bbf4275fa439aed469fc802a0:make check1421 passed / 85 skipped / 81 subtests (secrets clean,git diff --checkclean),make package-check,make auditclean,make oci-worker-proof26 passed (#78 regression intact),make codex-oci-proof18 passed / 0 failed / 0 native skips (11 native cells incl. the symlink-regression cell + 7 host-side safety cells).7aad45e(2407–2410 success on the intermediate security commits).Status
PR #84 (HEAD
7aad45e8d75ddc2bbf4275fa439aed469fc802a0, base73e3af45c911aa9ae8c26b97bf0ec9f452063f10): READY_TO_MERGE — owner-approved merge remains a separate explicit decision; this work does not merge. Decision record updated at docs/architecture/codex-oci-native-proof.md (collection trust boundary section; fail-closed proof-8 receipt).#53 bounded continuation: final security correction delivered — review budget exhausted, STOP_REVISE in force (PR #84 NOT merged)
The owner-directed fail-closed lifecycle correction against PR #84 is delivered and verified. Per the delivery's rules, ordinal 10/10 returned REQUEST_CHANGES (two non-blocking P3 residuals; no blocking finding), so READY_TO_MERGE is NOT reported, the STOP_REVISE limit is honored — no counter reset, no replacement PR, no unreviewed remediation commits — and #53 remains OPEN and gated. No merge, no live inference, no architecture expansion, no complete-AC4 claim.
The finding and its resolution (commit
a494e23, CI #2412 SUCCESS on exact HEAD)The shared observer
tools/oci_worker_poc/harness.py::container_state()mapped every nonzeropodman container existsexit to"absent"— conflating confirmed absence (exit 1) with podman 125-style engine/storage/access errors, timeouts and lost observations — soCodexAttempt.collect()could authorize artifact collection while container state was actually unknown, anddispose()could skip owned-container termination after a failed query.Delivered fail-closed semantics:
exists(exit 0) /absent(exit 1, confirmed) /unknown(any other code,TimeoutExpired, or lost/unavailableOSError) — unknown never collapses into a confirmed state.CodexAttempt.collect()raises a typed refusal naming the observed state; anunknownobservation can never authorize collection or count as settlement.dispose()treats every non-absent observation (exists or unknown) as requiring bounded termination of the owned container; only confirmed absence justifies skipping.AttemptRunner.dispose_allstops on exists-or-unknown; the monitor-death cell acceptsunknownas an inconclusive pre-stop observation while still requiring confirmed absence after reconciliation) and the #53 recovery cell follow the same rule.TimeoutExpiredandOSErrormap correctly, and a probe attempt proves code 125 (andexists) cannot authorize collection whileunknownforces bounded termination in dispose. The no-symlink-following collector, preserved artifact copies and all prior native evidence are unchanged.Verification
a494e2328b52250b3cbd33cefd386c48b73b45c2:make check1425 passed / 85 skipped / 81 subtests (secrets clean,git diff --checkclean),make package-check,make auditclean,make oci-worker-proof26 passed (#78 regression green with reconciled callers),make codex-oci-proof22 passed / 0 failed / 0 native skips (11 native + 7 collection-safety + 4 lifecycle-observation cells).a494e23.Ordinal 10/10 verdict and residuals
The final fresh independent whole-PR review (frozen HEAD
a494e23/ base73e3af4) returned REQUEST_CHANGES: both owner-directed trust-boundary findings were independently confirmed genuinely resolved, with two non-blocking P3 residuals — (1) the decision-record receipt inventory was stale (18 vs the delivered 22 items; lifecycle cells not enumerated) and (2) the pre-existing #78worker_status()still reads its workspace path with symlink-following primitives (latent same-class gap; never called by the #53 delivery, which uses only fail-closed paths). Budget exhausted (10/10), so these stand as named residuals requiring an explicit owner decision: accept them as recorded residuals of the bounded proof, or authorize a fresh review budget for one remediation commit (docs count refresh +worker_statusfail-closed routing) followed by a re-review.Decision record updated at docs/architecture/codex-oci-native-proof.md (fail-closed lifecycle observation paragraph).
Owner decision recorded — one-time review-budget exception for PR #84 (10 → 12 maximum)
The owner explicitly authorizes a one-time increase of this delivery's whole-PR review budget from 10 to a maximum of 12 invocations, applicable only to PR #84 (
issue-53-codex-oci-worker-proof).tools/oci_worker_poc/harness.py::worker_status()with a bounded fail-closed regular-file reader, extracting the smallest shared primitive into the #78 package so the shared-tool dependency direction is preserved (the #78 harness must not depend on the #53 package); (2) refresh the stale 18-vs-22 native receipt in the #53 decision record using actual executed results; (3) add a focused synthetic regression proving a worker-created symlink cannot causeworker_status()to read a host-only file, preserving truthful absence, malformed-content and tampering semantics.#53 bounded continuation TERMINAL: all owner-directed security corrections delivered — PR #84 READY_TO_MERGE (review 11/12 APPROVE, findings[] empty)
Under the owner's one-time review-budget exception (10 → 12 maximum, PR #84 only), the two ordinal-10 residuals are resolved and the final review approved the delivery. #53 remains OPEN and gated; this work does not merge; no live inference; no architecture expansion; no complete-AC4 conformance claim. The bounded proof verdict and every remaining AC4 limitation stand.
Ordinal-10 findings resolved (commit
9466187, CI #2414 SUCCESS on exact HEAD)worker_status()fail-closed reader: the bounded-regular reader was extracted into the #78 package (tools/oci_worker_poc/saferead.py— stdlib-only, dependency direction preserved: the #78 harness imports only its own package; the #53 collector re-exports the same primitives).worker_status()now refuses a planted symlink before any open, raises on non-regular replacements and oversized files, keeps absence truthful ({"observed": False}) and malformed JSON raising — never masked. Host-side regression cells prove a worker-created symlink cannot causeworker_status()to read a host-only JSON file (target bytes unchanged), plus absence/malformed/valid/oversize cells.make codex-oci-proof22 items passed, 0 failed, 0 native skips (11 native + 7 collection-safety + 4 lifecycle-observation cells), with the 3 worker-status cells running undermake oci-worker-proof(29 passed there, #78 regression included).Final verification at HEAD
9466187eede35ea906f2073f8c28182bbbff344d(base73e3af45c911aa9ae8c26b97bf0ec9f452063f10)make check1428/85,package-checkPASS), verified the dependency direction (no reverse import from #78 into #53), and verified canonical CI #2414 SUCCESS on the exact reviewed HEAD via Forgejo MCP.make check1428/85,package-check,auditclean,oci-worker-proof29,codex-oci-proof22.Status
PR #84: READY_TO_MERGE — owner-approved merge remains a separate explicit decision; this work does not merge. Review budget closed at 11/12 (one unused); shared repository budget rules unchanged; all prior ordinals, commits and the STOP_REVISE history preserved. Pre-existing symlink-following reads in #78's native-only synthetic cells (whose in-boundary worker is the repository's own deterministic script) are recorded in the PR as an owner-decision residual outside this delivery's authorized scope. Decision record: docs/architecture/codex-oci-native-proof.md.
New owner-authorized
/loopinvocationkernel-loop-20261010T014813Zselected the remaining #53 integration after fresh full-queue and producer revalidation. PR #84's integrated bounded proof and complete 11/12 review history remain intact; its historical STOP_REVISE was not treated as a current repository-wide blocker.First independent integration checkpoint is committed and pushed on
issue-53-runtime-integration:25ca319a9af703de89ce7ab3a1de814f4a529b17, based on canonical developfa157fb3890f29cc36e48677c45a588d3b29b4d0.This implements the existing local AuthorityBroker interface in the same exclusive single-controller SQLite journal: current Program-owner and immutable Attempt binding; durable issuance/revocation; atomic single-use binding to the exact original Operation request/outbox; replay/expiry/cancellation/scope negatives; additive schema 3 migration preserving historical requests; backup/retired-workspace history and post-retirement owner revocation. Trusted composition must supply the exact original-request interpreter; worker input is not authentication or an interpreter. Grant management does not become an outbox effect.
Validation at this checkpoint:
make checkPASS (1437 passed, 85 optional-native skipped, 81 subtests);make package-checkPASS;make auditPASS, all in a closed synthetic environment without owner credentials or model inference. The skipped native cases are not evidence of universal closure.This is an integration increment, NOT complete #53/AC4 reception, an adopted product security profile, new isolated Runtime support, ordinary task admission or product GO. Remaining Runtime admission/recovery composition, native-channel closure and acceptance/migration evidence are still work; #53 stays open. No PR/review/merge or issue closure has been performed for this new integration branch yet, and no historical review counter was reset.
Remaining integration checkpoint published on
issue-53-runtime-integration:c67f3f8(basefa157fb3890f29cc36e48677c45a588d3b29b4d0). Prior checkpoints add journal-bound native dispatch/owned recovery, installed shared descriptor-safe collection and fixed OCI composition, and a bounded LP64 x86-64 legacy-clone namespace-denial receipt. Current checkpoint addsOwnedOCI: immutable full Operation/Attempt/workspace/capability/identity/profile/environment binding, durable exact-ID capture after matching inspect evidence, full-ID-only stop, and fail-closed present/absent/unknown observations. Names alone, errors/timeouts, missing receipts and stop acknowledgements cannot establish absence or settlement.Current validation:
make checkPASS (1507 passed,87 optional-native skipped,81 subtests),make package-checkPASS (including isolated installed adapter import),make auditPASS, in a closed synthetic environment. Lifecycle's 20 synthetic cases cover reopen, conflicting/foreign identities, request changes, timeouts/errors, malformed/oversized observations and immutable receipts. No native execution was performed for this lifecycle increment. Separately, the preceding clone checkpoint ranmake oci-worker-proof(31 passed) andmake codex-oci-proof(22 passed) with zero native skips; i386/x32 clone reception remains explicitly unproved.These are engineering checkpoints, not full #53/AC4 acceptance, adopted product isolation or launch permission. Container absence does not prove descendant/cgroup settlement, safe collection/cleanup or universal effect enforcement. Current CodexRuntime still refuses ISOLATED. Next work composes the existing native transport with explicit worker commands while preserving pre-constructor admission/resource gates, followed by full Runtime/Workspace/channel/migration reception. No new integration PR, independent whole-PR review, merge or issue closure yet; new delivery reviews remain 0 and PR84's historical 11/12 history is unchanged. No live/paid inference, owner-state access, privileged host change, release/deploy or product GO.
Next integration checkpoint published:
d2161d7bb3f30861756692e67a08433cfe8a26b7on the sameissue-53-runtime-integrationbranch/base.CodexStdionow separates the pinned Codex version probe from an explicit worker argv and closed worker environment; both environments are mandatory on that path, arguments remain literal, and default direct-Codex behavior/schema/RPC bounds/retry refusal remain unchanged. The native OCI proof consumes this installed seam and shared attached-argv serializer instead of its generated wrapper; synthetic drivers and profile/resource policy remain proof-only.Validation at this code:
make codex-oci-proof22 passed, zero native skips (127.85s, pinned toolroot/Codex and fresh synthetic backend only);make check1528 passed,87 optional-native skipped,81 subtests;make package-checkandmake auditPASS. No live/paid inference or owner Codex state participated. Historical PR84 wrapper receipts and 11/12 review history remain unchanged.This is not launch admission, isolated Runtime support or full AC4. Next actual composition must verify resource pins/mount ownership/overlap/image identity and bind exact launch argv, with a fresh authority/resource check after the version probe immediately before worker send. Version probing can consume lease time; earlier RPC-only admission is insufficient. Exact container absence, heuristic cgroup paths and marker scans still do not grant workspace cleanup. Full Runtime/Workspace/channel/migration/IDE reception remains work. No new PR/independent review/merge/closure yet; current delivery review count remains0.
Consumed launch-gate checkpoint published:
0ad10939f86c47fe7b45ed3f8dfaa1a1695c673b, same integration branch/base.OwnedOCI.connectnow checks controller-fixed native/config/seccomp pins, trusted read-only digests and identities, protected/private paths, exact mount membership/overlap, and immutable image identity before composing actual stdio startup. The project is the sole writable bind; explicit existing read/write/execute grant rights are mandatory. Opaque historical WorkspaceSpec identifiers are not reinterpreted as hashes. Unsupported sockets/channels remain refused.The real composition consumes
CodexStdio.before_workerafter its finite version probe. SQLite rechecks original request/current grant/fence/lease/same-controller claim, reserves a distinct immutable worker-send stage before Popen and checks again afterward. Resource/identity drift, revocation or expiry during the probe prevents worker send. Uncertain Popen/capture, expiry after reservation, controller reopen or an already journaled native thread cannot authorize another worker generation. Missing capture closes only owned transport, retaining unknown container/workspace state.Final current-code validation:
make checkPASS (1564 passed,87 optional-native skips,81 subtests,253.09s);make package-checkandmake auditPASS; existingmake codex-oci-proof22 passed,zero native skips (121.79s). Focused launch/authority/stdio/lifecycle suite 103 passed. The new factory is consumed by real stdio code with synthetic native peers; the native22 run is existing transport/proof regression, NOT claimed native factory conformance. No live/paid inference or owner state.Next remains settlement-aware Runtime/Workspace composition, continuous effect revocation/controller-death handling, native resource/channel/version/IDE/migration reception and universal AC4. Stop/container absence alone still does not permit cleanup; current factory is trusted-development, not isolated Runtime or product-profile adoption. Full issue scope is not narrowed. No PR/independent whole-PR review/merge/closure yet; current delivery review count0, PR84 historical11/12 preserved.
Verified lifecycle/candidate checkpoint published:
f65db8b7c0a677f8880d5f967f6a0149aa46f68fon the same integration branch/base. Optional immutable PID-1 bootstrap holds the harness behind a fresh durableworker-entergate. A private inherited seqpacket endpoint uses actual Linux kernel sender pidfd attachment, avoiding stale-inspect/numeric-PID acquisition and cold inode/tick guesses. Controller EOF/original deadline retires init; kernel lifetime exit plus owned full-ID absence is required for durable namespace settlement. Candidate code does not inherit the lifecycle endpoint. Unsupported/unknown observations retain data.Actual candidate collection consumes that settlement witness and the subtree fixed before launch: descriptor-pins private ancestry/workspace identity, rejects collection refusals, persists exact bytes and then an immutable Candidate proposal, not task acceptance/publication. Default private runtime roots are excluded by separate candidate layout. No general Git materialization or workspace deletion is claimed.
Final code validation pipeline received:
make check1581 passed,88 optional-native skipped,81 subtests;make package-check/make auditPASS;make oci-worker-proof32 passed,zero native skips (includes new real kernel lifecycle cell);make codex-oci-proof22 passed,zero native skips. New native cell held execution before GO, used the installed bootstrap, observed init/kernel descendant teardown and container absence after controller EOF, and preserved an unrelated bystander. It is lifecycle reception, NOT full resource/admission factory conformance, universal channel closure or adopted product isolation. All native work used pinned public tools and synthetic code/backend/state, no live/paid inference or owner data.Next remains actual Runtime composition with verified host-to-native cwd binding and owned cancel/observe handling, source-backed Workspace lifecycle, continuous revocation, native version/IDE/migration/universal AC4 reception. ISOLATED/default product activation remains refused. Whole integration branch33files4975insertions471deletions is eventual full-review scope; no partial PR/review/merge/closure yet. Current delivery reviews0; PR84 historical11/12 preserved, no resets or reuse.
Published owned Runtime composition checkpoint
12d8d3df48fb95dd784ef8e67cb80e9d9be358d9onissue-53-runtime-integration, based onfa157fb3890f29cc36e48677c45a588d3b29b4d0.OwnedOCI.runtimenow consumes its lifetime-gated connection through the existing Codex Runtime. Host workspace authority remains separate from native/workspaceconfiguration. An exact admitted-worker read-check preserves the original lease and current grant after receipt acceptance, without reserving another send. Cancellation, uncertain startup, failed/completed native turns and observation-time authority/resource refusal retire only the owned boundary. Terminal reporting and Candidate collection require retained namespace exit plus owned container absence; the Candidate now binds the canonical Attempt digest. Missing/error kernel handles cannot count as live.Validation in closed synthetic environments: focused lifecycle/Runtime suite 169 passed;
make check1,598 passed, 88 optional-native skips and 81 subtests;make package-checkpassed;make auditreported no known vulnerabilities. Explicit native regressions: worker proof 32 passed and Codex-OCI proof 22 passed, both with zero native skips. The new Runtime composition uses synthetic kernel/engine fixtures; those native regressions are not full new-factory conformance.Issue remains open. Source-backed Workspace materialization/reconciliation/safe retirement, continuous in-flight authority mediation, full factory/version/IDE/UI-close/migration/channel reception and universal AC4 remain unfinished. No ISOLATED/profile adoption, live/paid inference, owner-state access or full acceptance claim. Current integration delivery: zero independent whole-PR reviews and no PR/merge/closure; PR84's historical 11/12 remains preserved. Continuation retains the same invocation and selected issue.
Continuation remains active. Published
d72926a59358e722e9901b9036a52a4c4d99fafe(source-backed Workspace generations) anda3ec7c9adab31ec833d93cdc6dc1e6b8b500e034(real native factory reception), preserving basefa157fb3890f29cc36e48677c45a588d3b29b4d0and prior history.Real factory cells now receive source generation/current journal admission, kernel-attached init custody, final-only Codex completion/collection, cancel/observed revocation/transport EOF with a detached backend, lost thread/turn replies after actual native sends without replay, and cold-handle refusal until an exact original retirement witness exists. Native preflight found and fixed independent raw-pin/RO-closure validation and the insufficient arbitrary 256MiB executable bound; the finite bound is 320MiB for the actual 287,086,056-byte pinned Codex binary.
Unmet native source-edit gate: actual Codex 0.159.3
workspace-write/neverrequires bubblewrap namespace creation. Supplying the exact existing public ADR-pinned bwrap/libcap closure resolves its missing-helper error, but the unchanged outer OCI namespace policy still denies execution. Production and diagnostic errno receipts attribute that refusal without allowing namespaces or selecting danger-full-access. Those negative tests passing do NOT mean native editing or universal AC4 conforms. Resolving this permission/boundary choice is owner-controlled; no silent profile adoption/relaxation or host privilege change was made. Independently executable predecessors remain, so delivery continues rather than stopping at this gate.Exact latest gates:
make check1,619 passed, 97 optional-native skips and 81 subtests; package/reproducible installed smoke and dependency audit passed; explicit native worker suite 32 passed/zero skips; Codex plus factory suite 31 passed/zero skips (22 historical cells, 7 positive lifecycle cells and 2 explicit negative source-edit gate cells).Next: isolated installed-wheel native reception, further generation/ownership/observer/recovery and bounded retirement evidence. Continuous per-effect authority, compatibility/adoption, live/private IDE scopes and other unreceived criteria remain explicit; no full acceptance, PR, independent whole-PR review, merge or closure. Current delivery review count remains 0; historical PR84 11/12 is unchanged.
Scoped Delivery And Blocked Disposition
PR #85 remains open and unmerged: #85
Base/develop/merge base:
fa157fb3890f29cc36e48677c45a588d3b29b4d0.Published clean HEAD:
0c31ffafcb96e1d5493422dba488996820325a92.Normal owner-authored remediation commits preserve the branch history:
f6ce84edcommon collection authority/required native receipts;16d0324ecompleted-retirement recovery;3a36aac6final durable admission retirement;b8adf5a6initial resolver/input refusal retirement with original error/unrelated-request ownership;0c31ffafraised active-journal failure retirement and exact collector traversal-cost source bounds. All actionable independent findings were reproduced and fixed without weakening permission, collection or settlement gates. Workspaces/protected source/journal evidence remain retained.Current complete local gates:
make check1670 passed, 102 optional-native skips, 81 subtests;make package-checkpassed;make auditno known vulnerabilities; required OCI worker32, Codex/factory36, rebuilt installed-wheel14 passed with zero skips. Locked tools, types, inward import boundaries, secret scan, whitespace, reproducibility and installed import-origin checks passed in closed synthetic environments.Nine of ten current-delivery whole-PR review invocations consumed, not exhausted; historic closed PR84 exception11/12 remains separate. Fresh independent whole-branch reviews8/9 inspected all45 changed paths at this exact HEAD and reported COMMENT with no concrete additional defect. Review9 independently reran standard/package and all required32/36/14 native suites, verified exact public producer/license pins and final clean canonical refs. No approval was obtained; COMMENT/empty findings is not acceptance. Supplemental reviews are not substituted for the separate native-agent requirement.
Remaining Owner Boundary
Native source editing is still UNMET: the existing public helper closure resolves missing-binary setup, but unchanged outer namespace denial conflicts with Codex0.159.3 workspace-write/never. Independently received EPERM/diagnostic EDOM cells prove refusal, not successful editing. Proceeding requires an explicitly selected compatible executor/security-boundary design and its proof/acceptance scope, or retaining the present policy and holding full acceptance. No danger-full-access fallback, namespace allowance, new supervisor/harness, profile adoption or product GO was authorized or used.
Continuous per-effect authority over writable binds, universal executor/channel/ABI closure, binary/source correspondence and other explicitly unreceived full-acceptance scopes remain UNMET/UNPROVED. Admission/collection/observed retirement are not continuous enforcement. Missing full criteria are not silently narrowed, declared complete, or automatically classified as external; a broader enforcement/trust-boundary decision cannot be invented during this bounded continuation.
External Capability Blockers
No scheduled wait can resolve an already-terminal CI result, missing authorized inspection capability or an owner-controlled boundary decision. Independently executable scoped remediation and current native verification are completed, but full #53 is not accepted. Keep #53 and PR85 open/unmerged; no main, release, deployment or cross-repository mutation.
Owner-Authorized OCI Editing Delivered
The owner's explicit 2026-10-11T13:09:41Z decision resumes this existing delivery and resolves the bounded Codex sandbox choice. PR85 remains the only PR: #85
Published clean HEAD:
7e8d82bc0ba806e480db4470de1e216c47a9fb97.Canonical develop/base/merge base:
fa157fb3890f29cc36e48677c45a588d3b29b4d0.Normal owner-authored commit:
security: scope owner-authorized Codex editing to owned OCI (#53); six files407insertions/39deletions, existing branch/history preserved.Effective configuration: verified owned rootless OCI Runtime only, pinned Codex0.159.3, native thread
sandbox: danger-full-access,approvalPolicy: never. App-server startup remains workspace-write; the positive receipt proves the per-thread exception alone works. Host/standalone Runtime still rejects danger-full-access, including a native cwd. The exception cannot retarget its bound connection/cwd; unsupported native version retires/refuses. Append-onlyoci-runtime-permissionsrecords owner decision, exact full container and original launch reference; it is configuration intent, not authority or task acceptance.The external OCI namespace-denial/seccomp/mount/network/capability/cgroup/UID/filesystem/lifetime policy is unchanged. No nested namespace allowance, unrestricted host fallback, new executor/protocol, real credentials, live/paid inference, privileged provisioning or product-profile activation. Documentation records the precise delta, consequences and scoped evidence matrix.
Executed Proof
make check: 1676 passed, 103 optional-native skips,81subtests; locked/Ruff/strict types/import boundaries/secrets/whitespace passed.make package-check: reproducible sdist/wheel, isolated install, import/CLI/intake/source smokes passed.make audit: no known vulnerabilities.make oci-worker-proof: 32 passed, zero skips.make codex-oci-proof: 37 passed, zero skips,22historical+15factory cells./tmp/kilo/creatidy-kernel-package-p6l38330.Factory15 comprises13positive lifecycle/currentness cells including successful native source editing, plus2historical workspace-write productionEPERM/diagnosticEDOM denial cells. Denials are not reinterpreted as editing success.
Positive editing receives actual native command exit0, changed original source/result bytes, original Attempt-bound immutable collection, in-boundary codex0.159.3 and detached-session subprocess namespaces. It denies synthetic host/controller/credential canaries, protected original objects/control DB, Podman socket, outside network, immutable-root/tool writes and PID1 descriptor reopen in read/write/read-write modes. CapEff0/NoNewPrivs1/Seccomp2, one-UID mapping, pids256/memory1GiB and loopback-only network are received unchanged. Controller canaries remain untouched. Cancel/revoke/EOF now receive settlement during actual native execution with a detached subprocess, not just delayed model text; no Candidate, workspace retained. Unknown starts/current collection/generation/reopen gates remain fail closed.
Review Budget And Exact Current Gates
Owner's PR85-only extension10->13 preserves all9consumed ordinals, SHAs, verdicts, findings and limitations; 9/13 consumed, four remain, next10/13 unreserved. Historical closed PR84 exception11/12 unchanged. No new review was consumed on an unchanged known authentication failure; no supplemental review is substituted for required native execution. Prior COMMENT reviews at0c are stale for this changed HEAD and are not approval.
Current exact-HEAD CI2524 failed, 14:31:48–14:34:21/2m33s: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/171 . This supersedes old2492 for current merge eligibility; local passes do not override remote failure. A scheduled wait received the terminal result; no blind rerun.
Read-only technical diagnosis materially advanced without review ordinals:
External Actions Needed
Canonical Forgejo/proxy operator must provide the required contract-compliant anonymous Git read path under authorized infrastructure policy. Then a fresh native whole-PR review can use ordinal10/13. CI operator must provide current2524 failing step, exit code and sanitized log excerpt via their existing UI, or compatible authorized read-only API capability; no agent credentials are requested. Ordinary scoped remediation can proceed from actual failure evidence.
This continuation ends BLOCKED by verified external capabilities, not a new sandbox decision, exhausted review budget or time wait. No READY_TO_MERGE/APPROVE claim; PR85 remains unmerged.
Keep #53 OPEN: universalAC4, continuous atomic per-effect authority, full file/terminal/subprocess/delegation and ABI closure, complete binary/source attestation and real IDE/UI/handoff/cold-continuity scopes remain UNMET/UNVERIFIED and Kernel#53-owned. Safe destructive cleanup is unsupported and not authorized. Product-profile adoption/ISOLATED/productionGO remains owner-reserved. No criteria narrowed, new issue/worktree, cross-repository mutation, main promotion, release or deployment.
PR #85 delivery update — 2026-10-12
Canonical MCP revalidation confirms issue #53 and PR #85 remain open/unmerged. PR #85 is still on
83a4c0f8061e3ec604200948f1b6c11721dae80c; canonicaldevelopand the PR base remainfa7fd5da97f47834e1c071f8fa1057b10430e4a4. PR #87 is merged at8c49f61bb6ea4bfbb0f38a0868339647feba6396; its MCP reviewer admission correction removes the prior anonymous-Git prerequisite while preserving fresh independent whole-PR review and exact ref checks.Exact-current-HEAD local standard gates passed in a closed environment:
make check1,688 passed, 103 optional-native skips, 106 subtests;make package-checkpassed;make auditreported no known vulnerabilities. These results do not replace required native reception or remote CI.Current exact-head Forgejo run is MCP lookup ID 2572, linked in the UI at
/actions/runs/180; it failed after 2m33s with contextci / check (pull_request). The deployed Forgejo 15.0.8 API/Swagger does not expose run-scoped job/log/attempt routes, and the unauthenticated UI redirects to sign-in. Thus job IDs, attempts, failing step, exit code and sanitized log remain unavailable; no product-versus-runner cause is asserted. Historical run #2524 is for older head7e8d82band is not current-head evidence.Required
make oci-worker-proof codex-oci-proofwere not run on this synchronized head. The temporary pinned OCI toolroot and its build scripts/provenance are absent. The repository's pinned bubblewrap 0.13.0 source and matching libcap packages were independently checksum-verified and rebuilt, but the new binary SHAcc6fd6b9d52ce71f94b4468f1f52e959b67722b6a8ecc311390ea15b13cd0dfediffers from the required receipt pin7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237; it was not used and the test pin was not weakened. No native counts or zero-skip result are claimed.The preserved review ledger remains 9/13 consumed; ordinal 10 unreserved. No review, code change, commit, push, workflow rerun, merge or closure occurred. #53 remains open for its wider universal authority/AC4 and remaining acceptance criteria. The PR description records the current refs, evidence and exact unresolved dependencies.
CI log evidence needed for run #2572
Fresh MCP recheck found exactly one workflow run for current PR HEAD
83a4c0f8061e3ec604200948f1b6c11721dae80c: internal workflow-run lookup ID 2572, PR #85, eventpull_request, status failure, duration 2m33s, UI route https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/180. Commit status isci / check (pull_request)with target/Creatidy/creatidy-kernel/actions/runs/180/jobs/0. The UI job index is 0; the numeric job API ID and attempt number are not exposed by current supported reads.Forgejo 15.0.8 does not publish the run-scoped job/log/attempt APIs used by the available MCP job tools; valid run lookup 2572 and a successful-run control returned route 404. The unauthenticated UI redirects to sign-in. To diagnose without exposing private data, an authorized operator need provide only: run ID 2572 and attempt number; numeric job ID if shown (otherwise confirm UI job index 0 / job context above); failed step name/index; command/target and exit/final status; and about 20-40 sanitized log lines around the first causal error through the job's terminal result. If failure occurred during runner/bootstrap rather than a project step, include runner OS/image and relevant tool versions/startup error. Redact tokens, secret values, credentials, full environment dumps, private HOME/runtime paths and unrelated log output. No cause is inferred and no CI rerun or workflow change was made.
Native recovery update — 2026-10-12
Canonical PR #85/#53 refs remain unchanged (
83a4c0f8061e3ec604200948f1b6c11721dae80cagainstfa7fd5da97f47834e1c071f8fa1057b10430e4a4); both stay open/unmerged. The checkout is clean. No source, test pin, CI, or review state changed.The partial
/tmp/kilo/kernel78-tooling/binnow holds verified conmon 2.2.1 SHAa3baaea8…, crun 1.30.1 SHA86d1e6a0…with official signature verification, netavark 1.4.0 SHAb4344a1e…, and busybox-static SHAdbac288c…. Conmon was built from the exact pinned clean source withUSE_JOURNALD=1andUSE_SECCOMP=1; the official conmon release asset did not match and was not used.Podman source commit/tree
85b994955e0b4e30fbce9c8351cab85676140ede/d02cfd66899114f2e50023697ef4410365b30470builds as 6.1.3, but the latest fully described source candidate SHA5e68f332026e5049631a17013a97e59ecbbf2f6012b69ddd8a7f6e6a5f1f3c4bstill differs from the test-pinned72b04715918065668d3025ba67fb87ad678d1a0fe099ebd8878f33443b281c31. Other controlled tag/trimpath/sysroot variants are preserved separately in the temp downloads; none was installed inbin/podman. The old provisioning scripts and exact original provenance/package recipe are not present in retained paths. The toolroot has noprovenance.jsonor pinned config set, so neithermake oci-worker-proofnormake codex-oci-proofhas run and no worker-native receipt/zero-skip claim is made.Bubblewrap 0.13.0 was rebuilt from exact commit
719a4fd474d44b26906bcf2b1b0fb6eddd8d56d0and archive SHAe55bdb06f051664ecd3297d449a8b679b7cd1c73adb292b73a81d9b03c5fc462, using GCC 13.3.0, Meson 1.12.1, Ninja 1.13.2, and the recovered libcap prefix. The actual digest isec5ffd1a2bc560f2868bc6e7e06a9ed9f4379a9b2cf4dab0fc0f408158ad6143;make native-proofon it passed 67, zero failures, zero skips in 29.49s. It is not the factory’s hardcoded7c0da12…and has not passed the Codex factory suite. Full receipt:/tmp/kilo/kernel80-bwrap/bwrap-build-provenance-historical-sysroot.json.ADR 0008 / canonical #80 records two other native-tested 0.13.0 digests,
7c0da12…b237and77a506…a827, whiletests/test_oci_runtime_conformance.py:218accepts only7c. Proposed bounded change for owner authorization, not applied: replace that one-hash equality with membership in an immutable allowlist of exactly7c0da12…b237,77a506…a827, and the newec5ffd1…6143receipt. Security consequence: the factory test would admit only three exact binaries of the same pinned source/version, each with standalone zero-skip native boundary evidence; it would not change runtime sandbox/authority policy or accept arbitrary 0.13.0 binaries. The new ec5 binary still requires the full Codex factory suite, and the explicit allowlist expansion requires owner approval before editing.Current exact-HEAD standard gates remain passed (1,688 check tests; package-check and audit passed). Current CI run 2572 remains failed. The minimal sanitized operator evidence request is in comment #16786. Review count remains 9/13, ordinal 10 unreserved; no review, rerun, commit, merge or issue closure occurred.
Exact-head CI update — run #2634
The owner-authorized test-only allowlist change is now on PR #85 head
873ddf889b83de6675032a9097b93af7988accc6; canonical base remainsfa7fd5da97f47834e1c071f8fa1057b10430e4a4. Exact-content local checks passed:make check1,688 passed / 103 optional-native skips / 106 subtests,make package-checkpassed, and a freshmake auditfound no known vulnerabilities. These do not substitute for required native worker reception.Fresh MCP status identifies current run lookup ID 2634, UI URL https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/181, exact head
873ddf889b83de6675032a9097b93af7988accc6, PR #85, eventpull_request; it failed after 2m34s. Context isci / check (pull_request), UI job index0 at/actions/runs/181/jobs/0. The numeric API job ID and attempt remain unavailable. On deployed Forgejo 15, supported run-job/log routes are absent; the anonymous UI requires sign-in. The earlier run2572/UI180 is stale for this head.If an authorized operator must retrieve the failure, the minimal sanitized excerpt is: run ID2634; attempt number; numeric job ID if shown (otherwise confirm UI index0/context above); failed step name/index; command/target and exit/final status; and about 20-40 sanitized lines from the first causal error through the job's terminal result. If failure occurred during runner/bootstrap, include runner OS/image and relevant tool versions/startup error. Redact tokens, secret values, credentials, full environment dumps, private HOME/runtime paths, and unrelated output. No cause is inferred and no rerun or workflow change was made.
Review history remains 9/13, ordinal10 unreserved. No review, merge or issue closure.
Current exact-head CI and native reception — 2026-10-12
Canonical PR #85 remains open at head
4abff6156bae0a8351d799cb997442863766b9d9against base/merge-basefa7fd5da97f47834e1c071f8fa1057b10430e4a4; issue #53 remains open. Local exact-headmake check,make package-check, andmake auditpassed (check: 1,688 passed, 103 optional-native skips, 106 subtests; audit: no known vulnerabilities). Required native receptions now passed with zero skips:make oci-worker-proof32/0 in 256.37s;make codex-oci-proof40/0 in 397.93s; installed-wheel native factory 15/0 in 284.72s; standalone bwrapmake native-proof67/0 in 29.49s. Full toolroot and receipts are recorded in/tmp/kilo/kernel78-tooling/provenance.json; bwrap source/build receipt is/tmp/kilo/kernel80-bwrap/bwrap-build-provenance-historical-sysroot.json.Fresh canonical run for this head is MCP workflow-run ID 2640, UI route https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/182, PR #85, event
pull_request, status failure after 2m29s. Contextci / check (pull_request)targets/Creatidy/creatidy-kernel/actions/runs/182/jobs/0. Forgejo 15.0.8 has no supported run-scoped job/log/attempt API; the anonymous UI redirects to sign-in. Job API ID and attempt are unknown. No failure cause is inferred.If operator access is required, provide only: run ID2640 and exact head above; attempt number; numeric job ID if shown, otherwise confirm UI job index0 and context; failed step name/index; command/target and exit/final status; and ~20-40 sanitized lines from the first causal error through job termination. For a runner/bootstrap failure, include runner OS/image and relevant tool versions/startup error. Redact tokens, secret values, credentials, full environment dumps, private HOME/runtime paths and unrelated output. Do not send the full log. Earlier run #2572/UI180 and comment #16786 are historical for the previous head.
The two owner-authorized test-only digest allowlists are on the current branch: bubblewrap accepts the two ADR receipts plus the independently native-tested ec5 digest; Podman accepts historical 72b plus the exact source-built 5e68 candidate. No product/runtime/CI workflow changes. Review remains 9/13; ordinal10 is unreserved. No review, rerun, merge or issue closure occurred.
Run2640 storage-topology fix delivered
The owner-supplied run2640 log showed nine
tests/test_oci_launch.pysetup errors becausesource_bound_launchused pytest's default/tmpoverlay. Productionvalidate_local_storage()correctly rejects that filesystem. Commita1d16a7d4331d58f3545b7d05ac751bebb17f9a8changes the synthetic Git source fixture to allocate a sibling undersqlite_tmp_path.parent, the same verified native storage root used by the associated Prepared SQLite database. The test asserts the shared parent/device and cleans up the unique source directory. No filesystem check was mocked or weakened.Validation on the committed content: the nine affected cases passed;
make check1,688 passed, 103 optional-native skips, 106 subtests;make package-checkandmake auditpassed. Exact-head native reception also passed with zero skips: OCI worker32, Codex factory40, installed-wheel factory15, and standalone bwrap67. Canonical CI run #2651 (UI #183) for exact heada1d16a7completed success in 2m43s.PR #85 remains open at the exact head, issue #53 remains open for wider acceptance, review history is still9/13, and no merge or closure occurred. The next eligible action is fresh whole-PR review10/13; the remaining issue-wide acceptance criteria still preclude merge/closure.
PR #85 review-remediation and validation update — 2026-10-12
Canonical PR #85 is open/unmerged at head
f672aa940743cf1ec48bb3c10964fc1fe5d917d4, base/merge-basefa7fd5da97f47834e1c071f8fa1057b10430e4a4; issue #53 remains open. Review11 findings were fixed in this commit without changing product/runtime architecture or relaxing acceptance:CREATIDY_TEST_CODEX_BINand resolved Codex 0.159.3 from PATH.Exact-head local validation passed: focused review regressions8 passed;
make check1,696 passed,103 optional-native skips,106 subtests;make package-checkandmake auditpassed. Native receptions on f672 passed with zero skips: OCI worker32, Codex factory40, installed-wheel factory15, standalone bwrap67. Provenance is retained at/tmp/kilo/kernel78-tooling/provenance.json.Canonical CI run #2672 (UI
/actions/runs/184) for this exact SHA completed success in2m42s. Review budget is 11/13 consumed: review10 was incomplete due local progress-state exposure; fresh review11 returned REQUEST_CHANGES and its three findings are fixed in f672. Review12 is next; no review, merge or issue closure has occurred since those fixes. The issue remains open for wider acceptance criteria.PR #85 update for
8a98a6d66ce4fa00dc64d98213b3b01333731ddd(base/merge-basefa7fd5da97f47834e1c071f8fa1057b10430e4a4): added theCLONE_NEWTIME(0x00000080) clone seccomp predicate, expanded arithmetic coverage to all 256 subsets, added individual/combined native diagnostic and production cases, and updated the denial-count documentation. No other OCI capability or policy changed.Validation on this committed tree:
make checkpassed (1,696 passed, 103 optional-native skips, 106 subtests);make package-checkpassed;make auditreported no known vulnerabilities;make oci-worker-proofpassed 32/0 skipped; Codex OCI source tests passed 40/0; installed-wheel native reception passed 15/0; standalonemake native-proofpassed 67/0. The combinedmake codex-oci-proofexceeded the 600-second shell cap after its 40/0 source phase, so the installed-wheel phase was run separately and passed. Exact-head Forgejo run #2689 completed success in 2m44s.Final review ordinal 13/13 (fresh independent task
ses_ecd45d12effeoxwWH77bcxDG31) returned COMMENT, not approval. It identified P1 atsrc/creatidy_kernel/adapters/oci_lifecycle.py:789-794: active native effects may continue after grant revocation until a later Runtime observation or worker deadline; AC4's continuous effect mediation remains unproved. The reviewer also could not establish local clean-checkout status or execute safe gates because its permitted Git commands were denied by policy. Primary post-review verification confirms the exact refs and clean checkout, but does not convert the review result into approval. The revocation gap was already documented as unmet; no scope expansion or further changes were attempted because the final review slot is consumed.PR #85 and issue #53 remain open/unmerged. Delivery disposition is STOP_REVISE at the 13/13 review-budget bound; no merge, issue closure, release, or deployment.
Owner-authorized P1 continuation status (2026-10-14): PR #85 remains open/unmerged at
8a98a6d66ce4fa00dc64d98213b3b01333731ddd; no product code was changed and no review was dispatched.The only in-boundary strict-race candidate found is a two-phase whole-worker barrier: freeze the exact owned cgroup, require kernel
cgroup.events frozen=1, then commit the revocation row; post-commit, retire without unfreezing, and require retained pidfd exit plus exact-container absence before recording settlement. This would leave already completed/in-flight effects intact, and would prevent later workload syscalls only if the freezer covers the exact cgroup subtree. Podman 6.1.3/crun 1.30.1 issue the freeze request but do not wait for the kernel frozen acknowledgment; rootless access to the exact cgroup, no-thaw retirement, and crash recovery are not proven in this checkout. Event-only post-commit retirement is still insufficient for AC4.The pinned native toolroot was absent. Unprivileged source builds from the exact Podman commit produced only unapproved hashes
2528a398...and4b835dc7...; neither was run or copied into the toolroot. No cgroup probe, native reception, or new CI run occurred. Therefore strict effect admission is not established; implementation stopped before speculative changes. STOP_REVISE and all 13 prior review ordinals are preserved; the owner-authorized limit is 15, with review 14 still unconsumed. Keep the issue open.The reviewer Git instructions were locally clarified to use individually allowlisted commands (
status --short,rev-parse,merge-base,diff) without chaining or extra flags and without permission changes; this workflow-only edit is not committed or pushed. Detailed attempt provenance remains in the local excluded progress ledger.Diagnostic-only freeze-barrier preflight outcome: UNVERIFIED. No Podman candidate was executed and no container was started.
Read-only host evidence:
/proc/self/cgroupreports0::/non-systemd; cgroup v2 is mounted, but the current process is uid/gid 1000 under a root-ownednon-systemdcgroup./sys/fs/cgroup/non-systemdis owner0:0mode0755,cgroup.freezeis owner0:0mode0644,cgroup.eventsis read-only, and that cgroup'scgroup.subtree_controlis empty. The current user has no delegated writable cgroup subtree, so the exact-worker freeze acknowledgment/no-thaw kill/recovery protocol cannot be exercised safely here. This is a host configuration limitation, not proof the mechanism is architecturally impossible elsewhere.Candidate provenance was independently checked before any execution: SHA-256
2528a39892077aef1b7a5c7ea0b19a132f5945cf4b428a73f618140d7d94a9a4and4b835dc72279eae688ff77a5918a4e946e68c32ac1961f9a6c8eaa8df550a448; both source trees are clean at Podman 6.1.3 commit85b994955e0b4e30fbce9c8351cab85676140ede, with build inputs recorded under/tmp/kilo/kernel78-tooling. Neither digest is an accepted general-native tool pin; the experiment authorization did not permit production or acceptance use. No arbitrary hash substitution was attempted.No product code, tests, commits, pushes, CI runs or reviews were performed. PR #85 remains at
8a98a6d66ce4fa00dc64d98213b3b01333731ddd, open/unmerged; issue #53 remains open. STOP_REVISE and review history are unchanged (13/15 consumed; review14 unused).Bounded diagnostic-only rootless freeze result: PROVED for the tested host/Podman worker subtree; not AC4 acceptance. No product code was changed.
The transient systemd user scope (
Delegate=yes, collected afterward) ran rootless Podman 6.1.3 with diagnostic candidate SHA-2564b835dc72279eae688ff77a5918a4e946e68c32ac1961f9a6c8eaa8df550a448, source commit85b994955e0b4e30fbce9c8351cab85676140ede, treed02cfd66899114f2e50023697ef4410365b30470. Build provenance was independently checked; this candidate remains authorized only for diagnostics, not general native acceptance or an allowlist change.For container
941696a8ec7236c4c52f737b285982b72f918e7efa9c195a16848d9c13da00ff, Podman’sCgroupPathwas the parentlibpod-…scope; the actual worker tasks were in its/containerchild. The parent had no direct worker PIDs and remainedfrozen=0; the populated worker child reached kernelcgroup.events frozen=1afterpodman pause. The controller remained in a separate transient scope. The worker saw cgroup namespace path0::/and a read-only cgroup2 mount. The unrelated host bystander was outside the worker cgroup.A deliberately invalid freeze request returned errno 34, left the worker unfrozen, and did not commit revocation. The probe then observed the kernel freeze acknowledgement before committing a real synthetic
SQLiteProgramStore.revoke. Separate writer-process exits were injected after freeze/before commit and after commit/before retirement; the supervising probe reopened the store and recovered. Releasing the worker’s gate after commit caused no file or subprocess marker. Pre-revocation bytes remained.podman rm --forceremoved the exact paused container without an unpause; the retained init PIDFD exited, the container was absent, journal evidence remained, no candidate artifact was present, and the bystander survived.This proves the host can enforce the diagnostic worker-wide barrier; it does not implement or prove production autonomous notification. The Podman parent scope itself was not frozen, and no post-revocation
podman execattempt was made. The simulated writer crashes retained an outer diagnostic supervisor/PIDFD; full controller loss with cold PIDFD settlement remains unproved. Grant expiry and effects outside the frozen worker subtree also remain residual AC4 obligations. PR #85 and issue #53 remain open at8a98a6d; review history remains 13 consumed of 15, with review 14 unused.Bounded revocation continuation
Pushed commit
266900e0db8ef8c3a30b7754c808eca5fc3c3f9bto existing PR #85. The change adds a durable admission fence and owner-thread freeze/ack, commits revocation only after all active OwnedOCI generations are frozen, then records a cgroup-empty receipt before exact no-thaw removal. Cold recovery uses the persisted cgroup identity and no-live receipt; the accepted scope remains only the opt-in OwnedOCI path.Validation on this commit:
make checkpassed (1,700 passed, 105 optional-native skips, 106 subtests);make package-checkpassed. Exact-head Forgejo CI run #2761 is running. The bounded cgroupfs cold-recovery probe passed only with diagnostic Podman hash4b835dc…and syntheticUSER=nobody; that hash is not production/native acceptance. The accepted pinned native toolroot is unavailable here, so native regression coverage remains unverified. PR #85 and issue #53 remain open/STOP_REVISE; no review14 was dispatched, and no merge/closure was requested.Owner-authorized bounded continuation update: PR #85 now points to
dba0c4013b0f1236d1833c33823995163921553c(base/merge-basefa7fd5da97f47834e1c071f8fa1057b10430e4a4). The latest review's P1 is addressed: a non-OCIruntime-receiptalone no longer settles an active revocation; the durable fence remains pending without exact retirement evidence.On this exact HEAD, sanitized
make check package-checkpassed: 1,700 tests passed, 105 optional-native tests skipped, 106 subtests passed; lint, typing, import-boundary, secret, package reproducibility/install and smoke checks passed. Forgejo pull-request run #2762 for this exact SHA succeeded in 2m35s.Accepted pinned native OCI toolroot/reception remains unavailable. The diagnostic-only Podman hash was not promoted or used as acceptance; no claim of native conformance or universal AC4 is made. STOP_REVISE remains in force; issue #53 and PR #85 remain open/unmerged. No merge, release or deployment.
Bounded revocation correction update for PR #85: exact HEAD
2dd5f746c11e9860dfc79b5b6c479e55ed9164c4, basefa7fd5da97f47834e1c071f8fa1057b10430e4a4.OwnedOCI._pause_for_revocation()no longer treats an empty subtree as frozen; it requires the live identity, pause state and kernelfrozen=1acknowledgment before writing the freeze receipt. The new deterministicpopulated=0,frozen=0case confirmed the prior bug, then passed with a retained durable fence, no final revocation/artifact/candidate, and a still-existing container; the frozen-worker retirement case also passes. ADR 0009 now makes this ordering explicit. The real-Codex acceptance receipt now readspids.max,memory.maxand finitecpu.maxinside the worker; this native assertion has not run.Sanitized
make check package-check auditpassed on this commit: 1,701 passed, 105 optional-native skipped, 106 subtests; packaging and audit passed. Forgejo run #2763 for this exact SHA failed after 2m47s. The commit-status resource only identifies/actions/runs/188/jobs/0; the supported job-list call returned 404, and the unauthenticated run UI redirected to login. The failing step/exit cause is therefore unknown; no CI retry was made. Safe diagnosis requires the actual failed-step/exit result and a minimal sanitized log excerpt from an authorized run-log reader, or a supported MCP job-log path with the actual API job ID.Issue #78 has no issue/comment attachments. Its accepted Podman pin
72b04715…and completeprovenance.jsonare absent from the user-owned toolroot; current source-built outputs2528a398…and4b835dc…do not match the accepted hash, and the latter remains diagnostic-only. No alternate binary was executed or promoted. Native acceptance remains unverified; STOP_REVISE remains. No review was dispatched for current head2dd5f746; prior review history was left unchanged. The issue and PR stay open. No merge, close, release, deployment or paid inference occurred.Follow-up to comment #17207: the workflow's
uv 0.9.30uv sync --lockedpassed locally, thenmake check package-check auditpassed in a sanitizedCI=true,GITHUB_ACTIONS=true,RUNNER_OS=Linuxenvironment withoutUV_OFFLINE(1,701 passed, 105 optional-native skips, 106 subtests)..forgejo/workflows/ci.yml,pyproject.tomlanduv.lockare unchanged from base; the only Makefile delta is in optional native targets not called by CI. No deterministic code/workflow failure reproduced. Run #2763 remains unclassified until an authorized Forgejo/runner operator supplies the actual failed step, exit status and a minimal sanitized log; no retry was triggered.Non-adopted replacement-pin proposal, if exact recovery remains impossible: existing source build SHA
2528a39892077aef1b7a5c7ea0b19a132f5945cf4b428a73f618140d7d94a9a4, from Podmanv6.1.3commit85b994955e0b4e30fbce9c8351cab85676140ede/ treed02cfd66899114f2e50023697ef4410365b30470. It used Go 1.26.8 (archive SHAd0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b), GCC 13.3.0,CGO_ENABLED=1,-trimpath, offline vendored modules, seccomp/systemd build tags, and checksummed Noble libseccomp/libsystemd/libgpgme/libassuan/libgpg-error build packages. Static ELF inspection showslibgpgme.so.11,libseccomp.so.2andlibc.so.6dependencies. Only one build is recorded; independent reproducibility and every native runtime/cgroupfs acceptance test remain unproven. This is a proposal only. Owner approval is required before authorizing this new digest for a reproducibility/native acceptance cycle; the accepted pin is not changed.Bounded Podman pin-qualification update for PR #85, current HEAD
5e54d83e020966f5cdda7bf46b2b0d629a6310be(basefa7fd5da97f47834e1c071f8fa1057b10430e4a4). CI #2777 for this exact SHA succeeded in 2m44s. The earlier #2763 failure remains unclassified and this success does not identify its cause.The independently rebuilt clean-source Podman v6.1.3 output exactly matches owner-authorized candidate SHA-256
2528a39892077aef1b7a5c7ea0b19a132f5945cf4b428a73f618140d7d94a9a4. Native qualification ran from a private user-owned toolroot, under transient delegated user scopes, without global Podman configuration changes. Results withtools.native_reception:make oci-worker-proof32 passed/0 skipped; real-Codex isolation suite 25 passed/0 skipped; 14 selected non-bwrap OwnedOCI cgroupfs lifecycle cases 14 passed/0 skipped.The actual worker reported
pids.max=256,memory.max=1073741824,cpu.max=100000 100000, zero effective capabilities,NoNewPrivs=1, seccomp mode 2, single uid/gid mapping, loopback-only networking, read-only root/cgroup mounts, and a writable workspace. Worker observation SHA-256057aff69366a75ba36543f09facc25911cabf6097fbb3e91ee5ce180d3cd15a5; factory receipt SHA-25663a9869c383da4d7e28423bbf266a8917e2b85bebcd9ca8dfcabe2f38f538a19. Qualification manifest:/tmp/kilo/kernel78-podman-qualification-20261015/qualification-results.json, SHA-2568b7e0f6b5c6f36ca8a8c6d1b8816789c98b2df82725404fe6d499c9bde0d6230.Verdict is partial qualification only, not production acceptance. The accepted bwrap artifact is unavailable; the three bwrap-dependent workspace-write scenarios and standalone native-proof suite were not run. No production pin or repository pin allowlist changed. Earliest native action: restore a bwrap binary with an already accepted SHA (
7c0da12…,77a506…, orec5ffd1…) atCREATIDY_TEST_BWRAP_BIN, or obtain owner approval to restore/rebuild that already-pinned test dependency. The full native acceptance must then run with zero skips.The bounded test-harness correction is commit
5e54d83: proof cleanup now explicitly removes only the exact observed container, and cold recovery tests reopen the correct privatecontrol/kernel.db. STOP_REVISE remains; no review was dispatched, no candidate was promoted, and no merge, close, release, deployment, paid inference or global host change occurred.Bubblewrap recovery result for PR #85: the repository-native
tools/setup_bubblewrap.pywas run once from the pinned 0.13.0 source archive and exact Noble libcap packages in a private user-owned output directory. Source archive hash matched ADR 0008; libcap-dev/runtime package hashes matched the recorded prefix; locked Meson 1.12.1/Ninja 1.13.2 and GCC 13.3.0 were used. No package was installed globally.That build emitted SHA-256
956cb41aec4589d5e0ee04d06f56e93305f161fe8f4e3eed39bb4e50ccc29394, which matches neither approved digest7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237nor77a5060956dd8356f737c775174aa92c06264d0f3b2ccad43fd731e6d4caa827. Only the setup tool's version probe ran; it was not put inCREATIDY_TEST_BWRAP_BIN, used by native tests, or added to an allowlist. No second build variation was attempted. Read-only record:/tmp/kilo/bwrap-qualification-20261015/bubblewrap-build-result.json, SHA-25623084710beb12555f2d4fffe6a11684e2bab08fe928b63636160609f17610247.The accepted Bwrap-dependent
make native-proofand fullmake codex-oci-proofgates remain UNVERIFIED. The next prerequisite is the existing approved77a506…or7c0da12…binary with its original provenance/library closure, or the exact historical repository-build output path/inputs needed to reproduce one of those digests. This authorization did not permit adopting956cb…. PR/issue stay open; ordinal14 remains consumed, ordinal15 is unused, and no review was dispatched.Bubblewrap repository-native recovery attempt: the verified 0.13.0 archive
e55bdb06f051664ecd3297d449a8b679b7cd1c73adb292b73a81d9b03c5fc462at source commit719a4fd474d44b26906bcf2b1b0fb6eddd8d56d0was built once withtools/setup_bubblewrap.py, locked Meson 1.12.1/Ninja 1.13.2, GCC 13.3.0 and extracted Ubuntulibcap-dev/libcap21:2.66-5ubuntu2.4 (SHA-25607f2462867569a2119a2ad0f1593232663f2d1612b791c230d22a8d73a15abee/23c627c77c66552a658e62852f244f4946dc543898e0ec5428d5dc6bffde2d6a). No host packages were installed.The output is
956cb41aec4589d5e0ee04d06f56e93305f161fe8f4e3eed39bb4e50ccc29394, outside the existing approved set (77a5060956dd8356f737c775174aa92c06264d0f3b2ccad43fd731e6d4caa827, preferred;7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237). The repository setup performed only its version probe; no native tests used this output, it was not configured asCREATIDY_TEST_BWRAP_BIN, and no allowlist changed. No second build was attempted.Read-only provenance/result:
/tmp/kilo/bwrap-qualification-20261015/bubblewrap-build-result.json, SHA-25623084710beb12555f2d4fffe6a11684e2bab08fe928b63636160609f17610247.make native-proofand fullmake codex-oci-proofremain UNVERIFIED. The exact next prerequisite is an already-approved77a…or7c…binary with its original provenance and library closure from its authorized owner; the current decision does not authorize adopting956cb…. PR/issue remain open, ordinal14 consumed and ordinal15 unused; no review or lifecycle action occurred.Owner-authorized Bwrap diagnostic qualification for PR #85 completed on the isolated candidate SHA
956cb41aec4589d5e0ee04d06f56e93305f161fe8f4e3eed39bb4e50ccc29394(Bwrap 0.13.0; pinned commit/archive unchanged). With a disposable test checkout adding only this exact digest,make native-proofpassed 67/0; fullmake codex-oci-proofpassed 42/0; installed-wheel native reception passed 17/0. No production hash, main allowlist, global configuration or host packages were changed.Positive native Codex edit receipt: six forbidden paths denied, mount/PID/network/user namespace IDs matched the subprocess, 12 init-FD refusals, CapEff zero, NoNewPrivs=1, seccomp mode 2/filter 1, single UID mapping, loopback only, read-only root/cgroup and writable workspace. The Bwrap negative
edit-legacy/edit-diagnosticgates still report expectedUNMETwithpolicy_relaxed=false; workspace-write/outer-namespace policy conflict remains unresolved. Model provider was synthetic; no paid inference.Evidence:
/tmp/kilo/bwrap-qualification-20261015/bubblewrap-diagnostic-results.jsonSHA-25623a0049d868a175939fd71fc102d1c4bf059ba5e7fafe488aeca725ed9770631. The candidate is still diagnostic-only, not formally adopted. A proposed pin/provenance update is staged only in disposable/tmp/kilo/kernel53-bwrap-pin-proposal(diff SHA-2560a4004fc913f4a40c2eeb14ca6f2f6389e31d8e2139bf8726bba27519036caba); no proposal changes were applied to PR #85.Digest reconciliation: ADR 0008 and canonical #80 receipts formally list
7c0da12…and77a506…. The current test allowlist also containsec5ffd1…; its historical record is only a standalone 67/0 result, its complete provenance artifact is unavailable, and no full Codex/factory receipt or ADR approval was found. It is test-allowlisted, not inferred as a formal pin. The proposal recommends removing ec5 from the formal allowlist while adding 956 only after explicit owner acceptance.PR #85/issue #53 remain open at HEAD
5e54d83e020966f5cdda7bf46b2b0d629a6310be; exact-head CI #2777 is green. AC4 remains open, including autonomous expiry, effects outside OwnedOCI, and the workspace-write gate. Review ordinal14 remains consumed; ordinal15 unused. No review, merge, close, release, deployment, paid inference, or pin promotion occurred.Formal test-pin proposal is prepared but not applied:
/tmp/kilo/kernel53-bwrap-pin-proposalhas a staged four-file diff (SHA-2560a4004fc913f4a40c2eeb14ca6f2f6389e31d8e2139bf8726bba27519036caba) covering ADR 0008, Codex setup guidance, the Bwrap digest allowlist, and complete 0.13.0/956 provenance.The proposed formal set is
{7c0da12…, 77a506…, 956cb41…}. It removesec5ffd1…from the formal factory allowlist because the existing ADR/#80 receipts do not include it and its retained local evidence is standalone-only; the proposal records the test allowlist discrepancy. Owner approval is required before applying this test-pin/provenance change. If ec5 should remain, provide its complete original provenance and full Codex/factory acceptance evidence first. This proposal does not adopt Bwrap for production or close the workspace-write/AC4 gaps.Qualification evidence clarification: the standalone
make native-proofrun exercises Bwrap SHA956cb41aec4589d5e0ee04d06f56e93305f161fe8f4e3eed39bb4e50ccc29394without Podman. The Codex OCI and installed-wheel runs used the separate Podman candidate SHA2528a39892077aef1b7a5c7ea0b19a132f5945cf4b428a73f618140d7d94a9a4in the isolated toolroot. That Podman candidate remains diagnostic-only and unpromoted, so the combined-stack results are diagnostic, not formal production conformance.The corrected diagnostic manifest now records both candidate hashes and this scope:
/tmp/kilo/bwrap-qualification-20261015/bubblewrap-diagnostic-results.json, SHA-256c25c9a8725cc36fb14dc17038ee054658ae9f812195fecd1a3b6f475fe0daff3. No source/test/pin change was made to the main PR in this Bwrap diagnostic. The staged pin proposal remains separate at/tmp/kilo/kernel53-bwrap-pin-proposal(diff SHA-2560a4004fc913f4a40c2eeb14ca6f2f6389e31d8e2139bf8726bba27519036caba), awaiting explicit owner acceptance.PR #85 is updated to exact head
a9bcde7be26b2daddd8482f3216abfaef0167b3d(base/merge-basefa7fd5da97f47834e1c071f8fa1057b10430e4a4). Commita9bcde7adds a native grant-expiry regression and a diagnostic evidence row only. It observes an in-boundary detached writer stop past persisted grant expiry without Runtime/controller polling, denies fresh authority, and records the absence of a cgroup-settled receipt; container removal is test cleanup, not settlement proof.Validation on this content: focused expiry regression passed;
make check package-check auditpassed (1,704 passed, 106 subtests, 106 optional-native skips);make codex-oci-proof43/0 and installed-wheel reception 18/0 passed only with diagnostic Podman2528a398…; standalonemake native-proof67/0 used Bwrap956cb41…, authorized for native tests only. Exact-head Forgejo CI #2818 succeeded in 2m44s: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/191. Combined results with Podman2528a398…do not establish accepted native conformance.Issue #53 and PR #85 remain open under STOP_REVISE. Universal AC4, continuous per-effect enforcement, effects outside OwnedOCI, durable expiry/revocation settlement, and the remaining native/channel/ABI and IDE gaps are unresolved. Review ordinal 14 is consumed as COMMENT; ordinal 15 remains unused. No merge, issue closure, release, or deployment.
Strict Expiry Boundary Result (local diagnostic, not committed)
REFUTED for the current native OwnedOCI/PID-1 mechanism.
oci_bootstrap.py:63-68checks the worker deadline in a userspace loop (selecttimeout at most 100 ms), whileworker_deadlinepasses the persisted grant/lease upper bound (sqlite_store.py:1021-1028). Native descendants retain direct writable-workspace and subprocess syscalls.SQLiteProgramStore.checkdenies Kernel-mediated admissions at/after expiry (core/authority.py:78-80), but does not interpose on those syscalls. Cgroup freeze/kill is reached by explicit revocation handling (oci_lifecycle.py:866-889), not by the deadline timer.A controlled synthetic native test was added locally and passed against the previously built diagnostic-only Podman
2528a398…toolroot and synthetic Codex provider. The test intentionally stopped only the authenticated PID-1 via its retained PIDFD before expiry, leaving the cgroup unfrozen and descendants runnable. It distinguished a pre-expiry workspace effect from a new post-expiry subprocess/file effect with the same realtime clock plus host inode timestamps:1792106313000000000 ns; pre-expiry effect mtime:1792106282601995970 ns.frozen=0,populated=1.1792106314003785423 ns; descendant requested the new subprocess at1792106314005088178 ns; its newO_EXCLfile had mtime/ctime1792106314126179774 ns, 1.126 s after expiry, while PID-1 was still stopped.store.checkdenied the expired grant, but no explicit revocation was committed (revoked=false), no cgroup-frozen/settled artifact existed, and the post-expiry effect succeeded. After SIGCONT, PID-1 exited and cgrouppopulated=0; exact container removal was test cleanup, not a durable settlement receipt.Receipt:
/tmp/kilo/runtime-conformance-dyg_9gb4/grant-expiry-race-receipt.json, SHA-256efe32596a60bb98546da62a90ecdd48d4d41e624739b71d8a5d6d5685106d6bd. This is diagnostic evidence using a non-accepted Podman candidate, not general native conformance acceptance. No Bwrap or Podman source investigation/pin change was performed. The regression is uncommitted/unpushed and is not part of PR HEADa9bcde7.No shorter polling interval or existing cgroup deadline can supply an exact syscall boundary: the deadline loop is userspace/schedulable, and cgroup freeze/kill has no grant-expiry timer. Strict expiration therefore needs an owner-authorized trusted per-effect enforcement design; otherwise keep native execution gated and AC4 unmet. No production code or architecture was changed. STOP_REVISE remains; review15 unused; no merge, issue closure, release or deployment.
Follow-up to #17375: the owner authorized ADR-level design only. A local, uncommitted draft is at
docs/adr/0010-strict-native-effect-expiry.md(Status: Proposed). It specifies the candidate per-effect admission boundary, preserves pre-expiry in-flight operations, separates durable authority/effect fencing/worker termination/settlement, and does not select a broker placement or authorize a service, API, schema, dependency, pin, or implementation. The diagnostic regression and ADR remain uncommitted/unpushed; PR #85 still points toa9bcde7. Strict AC4 remains unmet and STOP_REVISE; review15 remains unused.Bounded Mediator Design Outcome
Feasibility: rejected using only the existing controller/store/journal and current Codex executor. The refined Proposed ADR is local at
docs/adr/0010-strict-native-effect-expiry.md; it has not been committed or pushed.The concrete no-new-process candidate is an inline seccomp user-notification broker on the existing SQLite owner thread: remove all worker writable mounts/FDs, deny unmodelled effects, never use
SECCOMP_IOCTL_NOTIF_CONTINUE, journal each child effect before controller-side execution, and use a boot-scoped monotonic deadline. The candidate fails as a behavior-preserving minimum: it cannot transparently emulatefork/cloneorexecvefrom another process; allowing native continuation leaves the documented argument TOCTOU; routing commands through controller-owned OCI exec replaces Codex's process/stdio/TTY executor. Complete file mediation also requires a new FD table, per-effect journal identity/outcome/reconciliation, a store change for single-use parent grants, and monotonic expiry state. The currentCodexRuntimeonly gates thread/turn start, while native descendants retain the workspace-write syscall path.A host-kernel LSM/eBPF guard is a possible service-free direction but requires a new privileged host enforcement mechanism, supported-kernel/hook-coverage proof, policy lifecycle and journal contract; it is not implemented or accepted here. The precise owner decision is whether to authorize such a privileged mechanism (or separately authorize a broker/executor redesign) or keep native Codex gated for strict-expiry AC4. AC4 remains binding and unmet on the current runtime.
No runtime/profile/pin change, implementation, review15, commit/push, merge, release or deployment. PR #85 remains open at
a9bcde7be26b2daddd8482f3216abfaef0167b3d; basefa7fd5da97f47834e1c071f8fa1057b10430e4a4; STOP_REVISE.Evidence Closeout:
9a38843Committed and pushed only
tests/test_oci_runtime_conformance.pyand Proposeddocs/adr/0010-strict-native-effect-expiry.md. The test is explicitly diagnostic: a passing result is positive proof that a post-expiry native effect occurred, not acceptance. The stored receipt is/tmp/kilo/runtime-conformance-dyg_9gb4/grant-expiry-race-receipt.json(SHA-256efe32596a60bb98546da62a90ecdd48d4d41e624739b71d8a5d6d5685106d6bd), produced with diagnostic-only Podman2528a398….Owner rejection is recorded in ADR 0010: no in-process seccomp mediator, privileged eBPF/LSM, broker, service, or executor redesign is authorized. AC4 remains unchanged and unmet. The exact gate is strict expiry preventing genuinely new native filesystem/process effects; PID-1 deadline polling and eventual cgroup termination do not satisfy it. Keep issue #53 and PR #85 open under STOP_REVISE.
Sanitized
make checkpassed (1,704 passed, 107 optional-native skipped, 106 subtests);make package-checkpassed. The ordinary check skipped the native diagnostic, so those passing gates do not establish AC4. Exact-head Forgejo CI #2834 is running: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/192. Review ordinals 1–14 are preserved and ordinal 15 remains unused. No merge, closure, release, deployment, pin change, or privileged host modification.Exact-head Forgejo CI #2834 completed successfully in 2m41s for
9a38843eb948b2ab1c4c396786e5d9239f5d0394: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/192. This confirms repository CI for the evidence commit only; it does not convert the diagnostic's positive post-expiry effect into an AC4 pass. The strict native expiry gate remains unmet and issue #53/PR #85 remain open.Owner decision (2026-10-16): retire issue #53 as not implemented under the current architecture. Strict-expiry AC4 remains binding and unmet; the diagnostic proves the current PID-1/cgroup mechanism does not establish the required per-effect cutoff. No new broker, service, executor redesign, eBPF/LSM, or policy relaxation is authorized. The separate trusted-development STOP follow-up is #90; it does not resolve AC4. Issue-local downstream gates in #59 and #60 remain unsatisfied; closure here does not satisfy them.
Owner reauthorization (2026-10-16): continue only the bounded revocation-remediation path already implemented through the existing AuthorityBroker/OwnedOCI boundary. This supersedes the prior retirement disposition only for that scope; strict native expiry remains REFUTED and AC4 remains binding/unmet. The cgroupfs cold-recovery design proof is recorded in ADR 0009/tests and
.task_progress.md: controller/SQLite/PIDFD loss, durable fence, frozen subtree, cold exact cgroup/container identity, post-revocation exec denial, cgroup.kill/populated=0, exact removal, reopened receipt, workspace retention. This is diagnostic-only Podman evidence, not accepted native conformance. No new service, broker, privileged mechanism, review, merge, release, or deployment is authorized by this continuation.Owner reauthorization (2026-10-16): issue #53 is reopened for the bounded existing AuthorityBroker/OwnedOCI revocation-remediation scope only. The cgroupfs cold-recovery design proof already recorded in ADR 0009 and
test_cold_revoke_recovers_after_store_and_pidfd_losspasses as diagnostic evidence within the existing boundary; it is not accepted production/native conformance. The scoped fence/freeze/kill/empty-receipt/exact-removal implementation is already on PR head9a38843. Strict native expiration remains REFUTED/unmet; AC4 is not closed or weakened. STOP_REVISE and all prior review history remain intact. No new review is dispatched.Reopened-continuation check: Forgejo CI #2859 succeeded in 2m39s for exact head
9a38843eb948b2ab1c4c396786e5d9239f5d0394: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/193. This is validation of the existing scoped revocation branch; it does not establish accepted production/native conformance or strict expiry. No source change or review dispatch occurred.Owner-directed state correction (2026-10-16): restore #53 to CLOSED / NOT IMPLEMENTED and preserve the unmet strict-expiry AC4 requirement. The temporary reopening was caused solely by the later continuation prompt to resume the bounded revocation-remediation work; it did not accept the cold diagnostic as AC4 or authorize a new enforcement architecture. The branch and all evidence remain preserved. Issue #90 remains separate.
Owner decision reaffirmed (2026-10-16 21:38): issue #53 is CLOSED / NOT IMPLEMENTED; strict native-expiry AC4 remains binding and unmet. The temporary reopening for revocation continuation is superseded. The cold-recovery diagnostic does not change this decision. Preserve all commits/evidence and do not reopen without a new owner decision.
kilo referenced this issue2026-10-16 22:59:18 +00:00
kilo referenced this issue2026-10-17 17:54:24 +00:00