[Kernel][G11 G13] Protect host-qualified source cache ownership, locking and dispatch identity

kilo commented

2026-10-04 22:29:51 +00:00

Member

Goal

Owner: Kernel. Make canonical source cache identity include the host and protect acquisition/replacement/cleanup with real ownership and locking; use one shared source/baseline validation before every dispatch, including explicit overrides. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.

Why

Repositories with identical owner/name on different hosts currently collide. An unverified clean directory can be removed, concurrent acquisitions can race, and preflight checks do not automatically protect task run overrides. Users must not lose source data or execute the wrong repository.

Current Evidence

At eb4f4a2956, source_cache.py source_cache_key:59-70 uses URL path only; _fresh_clone uses PID staging, writes marker at203 without checking it, discards target at204/287 and has no acquisition lock. Exact remote verification/symlink refusal/bounded fetch exist and must remain. task preflight checks origin/clean source/structural baseline, while resolve_source returns explicit override and run_task/prepare_workspace do not reuse these checks. #44/PR #45 proves layout independence, not cross-host/concurrent ownership.

Scope

Define full canonical host/origin/repository identity without changing immutable task identities in place. Use existing lock/atomic publication mechanisms with acquisition/fetch/replace/cleanup ownership and current-use lifetime. Verify owned marker/metadata before destructive action; user/foreign/unrecognized trees are refused or preserved. Share source/base/clean/baseline validation between preflight and dispatch; no sibling search. Plan safe old-cache migration explicitly.

Acceptance Criteria

Same owner/repo on two hosts/ports obtains distinct correct caches; remote mismatch cannot adopt or destroy another user's/foreign tree. Marker identity/ownership is proved before deletion.
Forced interleaving of concurrent acquire/fetch/replace/cleanup and same-process threads cannot share staging, delete in-use cache or publish partial checkout; bounded lock refusal has actionable diagnostics.
task run with explicit --repo/config source refuses wrong origin, dirty source, stale/missing structural baseline and incompatible exact pin before any runtime dispatch. Tests assert no model start, not only final refusal.
Existing immutable task/Attempt/source provenance remains unchanged; old hostless entries migrate/quarantine with explicit evidence and no blind deletion or reclassification. Failed/interrupted migration preserves recoverable bytes.
Symlink/path/mount/permission failures, clone/fetch cancellation and interrupted publication leave truthful safe state; cleanup requires owned settled use, not an unchecked namespace assumption.
Preserve bounded Git/closed credentials/TLS/no remote writes; diagnostics, migration/install docs, synthetic native-filesystem regression/gates and exact-HEAD review.

Reuse

Reuse canonical Forge refs, bounded Git transport, existing source acquisition and SQLite/local locking/atomic publication patterns. Compare maintained Git/cache workspace mechanisms and native locking before adding code; exact revisions/license/negative/security/dependencies/maintenance evidence required. No repository discovery/cache framework.

Dependencies And Priority

Immediate data/identity safety before concurrent tasks or explicit-override live execution. Can repair independently of choosing future harness/gateway. Approved intake #49 consumes freshness; multi-task workspace ownership consumes locked sources; G13 migration receives compatibility evidence.

Constraints And Permissions

No destructive cleanup of unowned data, guessing host/sibling paths, source remote mutations, private data copying or immutable identity rewrite. Synthetic local repositories and forced concurrency suffice initially; real forge acquisition requires scoped read access, and live dispatch separately needs inference/effect authority. New migration authority beyond existing ownership requires owner decision.

Links

Parent: #46
Existing layout-independent source baseline: #44
Fresh intake: #49

Non-Goals

No arbitrary filesystem discovery, shared source DB or changes to workload repository.

## Goal Owner: Kernel. Make canonical source cache identity include the host and protect acquisition/replacement/cleanup with real ownership and locking; use one shared source/baseline validation before every dispatch, including explicit overrides. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief. ## Why Repositories with identical owner/name on different hosts currently collide. An unverified clean directory can be removed, concurrent acquisitions can race, and preflight checks do not automatically protect task run overrides. Users must not lose source data or execute the wrong repository. ## Current Evidence At eb4f4a2956712bfaf39a3271e1523e7f77a91e26, source_cache.py source_cache_key:59-70 uses URL path only; _fresh_clone uses PID staging, writes marker at203 without checking it, discards target at204/287 and has no acquisition lock. Exact remote verification/symlink refusal/bounded fetch exist and must remain. task preflight checks origin/clean source/structural baseline, while resolve_source returns explicit override and run_task/prepare_workspace do not reuse these checks. #44/PR #45 proves layout independence, not cross-host/concurrent ownership. ## Scope Define full canonical host/origin/repository identity without changing immutable task identities in place. Use existing lock/atomic publication mechanisms with acquisition/fetch/replace/cleanup ownership and current-use lifetime. Verify owned marker/metadata before destructive action; user/foreign/unrecognized trees are refused or preserved. Share source/base/clean/baseline validation between preflight and dispatch; no sibling search. Plan safe old-cache migration explicitly. ## Acceptance Criteria 1. Same owner/repo on two hosts/ports obtains distinct correct caches; remote mismatch cannot adopt or destroy another user's/foreign tree. Marker identity/ownership is proved before deletion. 2. Forced interleaving of concurrent acquire/fetch/replace/cleanup and same-process threads cannot share staging, delete in-use cache or publish partial checkout; bounded lock refusal has actionable diagnostics. 3. task run with explicit --repo/config source refuses wrong origin, dirty source, stale/missing structural baseline and incompatible exact pin before any runtime dispatch. Tests assert no model start, not only final refusal. 4. Existing immutable task/Attempt/source provenance remains unchanged; old hostless entries migrate/quarantine with explicit evidence and no blind deletion or reclassification. Failed/interrupted migration preserves recoverable bytes. 5. Symlink/path/mount/permission failures, clone/fetch cancellation and interrupted publication leave truthful safe state; cleanup requires owned settled use, not an unchecked namespace assumption. 6. Preserve bounded Git/closed credentials/TLS/no remote writes; diagnostics, migration/install docs, synthetic native-filesystem regression/gates and exact-HEAD review. ## Reuse Reuse canonical Forge refs, bounded Git transport, existing source acquisition and SQLite/local locking/atomic publication patterns. Compare maintained Git/cache workspace mechanisms and native locking before adding code; exact revisions/license/negative/security/dependencies/maintenance evidence required. No repository discovery/cache framework. ## Dependencies And Priority Immediate data/identity safety before concurrent tasks or explicit-override live execution. Can repair independently of choosing future harness/gateway. Approved intake #49 consumes freshness; multi-task workspace ownership consumes locked sources; G13 migration receives compatibility evidence. ## Constraints And Permissions No destructive cleanup of unowned data, guessing host/sibling paths, source remote mutations, private data copying or immutable identity rewrite. Synthetic local repositories and forced concurrency suffice initially; real forge acquisition requires scoped read access, and live dispatch separately needs inference/effect authority. New migration authority beyond existing ownership requires owner decision. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Existing layout-independent source baseline: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/44 - Fresh intake: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/49 ## Non-Goals No arbitrary filesystem discovery, shared source DB or changes to workload repository.

kilo referenced this issue

2026-10-04 22:40:26 +00:00

[Kernel][G08] Serve authoritative state and reconnectable progress to CLI, Console and notifications #57

kilo referenced this issue

2026-10-04 22:40:26 +00:00

[Kernel][G01-G13] Accept the installed controlled-task path end to end #60

kilo referenced this issue

2026-10-04 22:40:26 +00:00

[Kernel][G13] Prove public installation, contract compatibility and safe state/profile migration #62

kilo referenced this issue

2026-10-04 22:51:53 +00:00

docs: align shared harness, routing and observability architecture (#46) #63

kilo referenced this issue

2026-10-04 22:58:10 +00:00

Align Creatidy Kernel with the shared harness, routing and observability architecture #46

kilo referenced this issue

2026-10-07 22:21:51 +00:00

[Kernel][G01] Integrate the proved harness lifecycle through the existing Runtime boundary #53

adrian.tkacz referenced this issue from a commit

2026-10-08 06:11:57 +00:00

fix: protect qualified source ownership and native admission (#61)

kilo referenced this issue

2026-10-08 06:12:22 +00:00

Protect host-qualified source ownership and dispatch admission (#61) #75

kilo commented

2026-10-08 06:12:33 +00:00

Author

Member

Implementation published as PR #75: #75

Base 1deb32900d10dab6a3baad0c454ef9aa19c58733; HEAD b0550563f8f5a9f0104444b6de3c230c8043ce02. Qualified v2 ownership/locks, non-destructive staging/publication and legacy handling, shared source/snapshot admission and literal historical recovery implemented. Parent closed-environment make check package-check audit && git diff --check passed: 1305 tests +57 subtests, 53 optional native verification skips; installed offline source smoke passed. No live workload acquisition or inference. Fresh independent exact-HEAD whole-PR review is next; issue remains open. #53 universal executor proof and broader concurrency/isolation remain separate gates.

Implementation published as PR #75: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/75 Base `1deb32900d10dab6a3baad0c454ef9aa19c58733`; HEAD `b0550563f8f5a9f0104444b6de3c230c8043ce02`. Qualified v2 ownership/locks, non-destructive staging/publication and legacy handling, shared source/snapshot admission and literal historical recovery implemented. Parent closed-environment `make check package-check audit && git diff --check` passed: 1305 tests +57 subtests, 53 optional native verification skips; installed offline source smoke passed. No live workload acquisition or inference. Fresh independent exact-HEAD whole-PR review is next; issue remains open. #53 universal executor proof and broader concurrency/isolation remain separate gates.

adrian.tkacz referenced this issue from a commit

2026-10-08 06:31:04 +00:00

fix: transfer exact admitted bases and reject Git-root mounts (#61)

adrian.tkacz referenced this issue from a commit

2026-10-08 06:56:52 +00:00

fix: validate native Git configuration and preserve stopped recovery (#61)

adrian.tkacz referenced this issue from a commit

2026-10-08 07:15:33 +00:00

fix: reject ambiguous origin URLs before source fetch and dispatch (#61)

adrian.tkacz referenced this issue from a commit

2026-10-08 07:34:53 +00:00

fix: refuse reconstruction of missing frozen Attempt objects (#61)

kilo referenced this issue from a commit

2026-10-08 07:46:46 +00:00

Merge PR #75: host-qualified source ownership and dispatch admission (#61)

kilo commented

2026-10-08 07:51:30 +00:00

Author

Member

Completed through PR #75: #75

Verified normal merge 71c132761b522c7faeee1a1aca51f1a296a947ec has parents base 1deb32900d10dab6a3baad0c454ef9aa19c58733 and independently approved HEAD 6b8074484fcde26c4d0089bb593401f344139b59; integrated tree equals approved tree 24c516c6cdca6e368eb5bdf639f1fe65fe12e87b. All normal implementation/remediation commits retained. Five fresh whole-PR reviews consumed; final ordinal5 APPROVE/findings[].

Integrated closed-environment uv sync --locked and make check package-check audit && git diff --check passed: 1321 tests +57 subtests, 53 optional verification-only native skips; format/lint/types/inward imports/secret scan/audit, reproducible wheel/sdist, isolated CLI/intake/source smoke passed. Canonical exact-head CI2377 and integrated CI2378 SUCCESS.

Acceptance received with synthetic real-Git/native-filesystem evidence: distinct hosts/ports and strict single origin; inode/token ownership and non-destructive preservation; same-thread/process acquisition/fetch/use contention and native-child lease retention; no partial publication; exact remote-only base transfer; zero-start wrong-origin/dirty/baseline/pin/indirection/helper/gitlink/expiry negatives; historical #143/#166 source/Attempt identities and stopped recovery preserved. Missing original Attempt objects refuse rather than rebuild from mutable source. Unknown legacy/corrupt/staging bytes remain untouched; no destructive cleanup or live workload acquisition.

This closes only #61's trusted cooperative native-local source boundary. #53 universal executor conformance, wider concurrency/isolation, live execution, product GO, main/releases/deployment remain unreceived or separately authorized. Issue closure follows verified integration and acceptance, not PR approval alone.

Completed through PR #75: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/75 Verified normal merge `71c132761b522c7faeee1a1aca51f1a296a947ec` has parents base `1deb32900d10dab6a3baad0c454ef9aa19c58733` and independently approved HEAD `6b8074484fcde26c4d0089bb593401f344139b59`; integrated tree equals approved tree `24c516c6cdca6e368eb5bdf639f1fe65fe12e87b`. All normal implementation/remediation commits retained. Five fresh whole-PR reviews consumed; final ordinal5 APPROVE/findings[]. Integrated closed-environment `uv sync --locked` and `make check package-check audit && git diff --check` passed: 1321 tests +57 subtests, 53 optional verification-only native skips; format/lint/types/inward imports/secret scan/audit, reproducible wheel/sdist, isolated CLI/intake/source smoke passed. Canonical exact-head CI2377 and integrated CI2378 SUCCESS. Acceptance received with synthetic real-Git/native-filesystem evidence: distinct hosts/ports and strict single origin; inode/token ownership and non-destructive preservation; same-thread/process acquisition/fetch/use contention and native-child lease retention; no partial publication; exact remote-only base transfer; zero-start wrong-origin/dirty/baseline/pin/indirection/helper/gitlink/expiry negatives; historical #143/#166 source/Attempt identities and stopped recovery preserved. Missing original Attempt objects refuse rather than rebuild from mutable source. Unknown legacy/corrupt/staging bytes remain untouched; no destructive cleanup or live workload acquisition. This closes only #61's trusted cooperative native-local source boundary. #53 universal executor conformance, wider concurrency/isolation, live execution, product GO, main/releases/deployment remain unreceived or separately authorized. Issue closure follows verified integration and acceptance, not PR approval alone.

kilo closed this issue

2026-10-08 07:51:37 +00:00

kilo referenced this issue

2026-10-08 08:09:35 +00:00

[Kernel][G05] Propagate approved task requirements to Router without L0 fallback #51

kilo referenced this issue

2026-10-08 15:42:33 +00:00

Bounded whole-worker executor isolation proof for #53 #78

kilo referenced this issue

2026-10-18 10:51:27 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue