Creatidy/creatidy-kernel
5
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

S01: fail-closed Linux bubblewrap verification/test boundary #74

Merged
kilo merged 2 commits from issue-50-verification-bwrap into develop 2026-10-07 10:05:39 +00:00
Conversation 2 Commits 2 Files changed 20 +2529 -14
kilo commented 2026-10-07 07:53:47 +00:00
Member
Copy link

Owner-Selected Scope

Refs #50. SAME sole-primary invocation kernel-loop-20261005T102040Z, no new controller/cycle. Owner explicitly resumed 2026-10-07: daemon-free Linux bubblewrap, default-deny filesystem/network, explicit required resources and real negative proof, verification/test execution ONLY. No full hostile harness/worker isolation; managed rootless OCI deferred. Exact mandate recorded #50 comment15516. ADR0008 states accepted direction and actual limited receipts, not authority from model prose.

This PR does not claim all broader original G09/worker requirements received, new authentication, a new daemon/profile migration or ordinary live execution. The selected profile covers untrusted test/verification children, including such execution for review; cold model/harness context and host controller remain trusted and unisolated. Final completion must respect this explicit role scope rather than silently close broader obligations.

Mechanisms

  • Core verification validates each trusted prerequisite before requesting later potentially executing checks; unrun checks have findings, not invented evidence. Direct TaskChecks command calls independently check exact subject/spec/Attempt/policy/base/head/paths/pinned clean HEAD/current authorization and structural gates. Rejected candidate tooling never executes merely because final acceptance will fail. Historical143/166 policy/digest/recovery shapes unchanged.
  • Opt-in BubblewrapVerifier behind verification-only ports, fixed controller resources/recipe/subject/snapshot/current-authorizer outside candidate data. No taskrun/ordinary-preparation trust upgrade. Explicit byte snapshots avoid .git/untracked/symlink/socket data, fixed narrow readonly Python closure under/toolchain, fresh workspace, private HOME/temp/dev/proc. No host root/HOME/usr/etc/controller/credentials/cache/socket mounts.
  • Pinned external bwrap0.11.0 exactsource9ca3b05ec787acfb4b17bed37db5719fa777834f; strict user/pid/net/ipc/uts/cgroup+mount isolation, no try/unshare-all fallback, capdrop/NNP/separate session/parent death/reaper/disabled userns. Lazy maintained libseccomp2.5.5 fixed network/namespace/mount/ptrace/FD/io_uring/alternateABI restrictions, no hand-authored BPF/customsandboxframework.
  • Controlled close_fds/stdinDEVNULL/pipes/setupFDs, consumed anonymous exec token after trusted bootstrap/nativePID1 ownership and current authority. Actual reaper-FD exposure was found/proved thenmasked/proc1. Outputbounded; timeout/cancel/revoke kills only owned nativePID, PIDnamespace containssetsid children. Settlement needs lifetimeEOF+exactPID1pidfd exit; observerloss staysunknown/retainscratch. No full host descendant census.
  • Optional locked Meson/Ninja setup verifies exact archive, builds utility unprivileged from owned extracted matching libcap prefix, no download duringtests/root install/daemon/configchange. Core/import safety unchanged, zero runtimePythondeps. all-groups audit includesoptionaltools. No externalbinary/source bundled/C copied; LGPL/source rights inADR/reusecatalogue.

Exact Subject And Actual Proof

Base/mergebase a9a65006cc, HEAD a72154e675, tree 2b0eabc350. Clean normal branch, owner-author Adrian, ordinarycommit/push; full20-file delta.

Parent independently inspected ALL executor/ports/build/tests/source/gates/operator claims, then executed closed env with explicit trusted binary:
CREATIDY_TEST_BWRAP_BIN=/tmp/kilo/kernel50-bwrap-build-20261007/build/bwrap make native-proof check package-check audit plusgitdiffcheck.

  • Native 48 passed, zero skips (1positive,24actual hostile/lifecycle,22refusal/validation,1SYNTHETICobserver-loss explicitly distinguished).
  • Full 1295 tests + 57 subtests PASS, formatting/lint/basedpyright/importboundaries/secret scan/reproducible wheel/sdist/installedlegacy+ordinarycompat/audit/diffPASS.
  • ActualPython3.12.3 closure, bubblewrap0.11.0 binarySHAa75623409c0755c93ff5bba87ec4c407bf3dcb01d7b0d3c9802ee9a02a272e6f, libseccomp2.5.5, Ubuntu24.04.5 Linux6.18.33.2-WSL2x86_64. Repositorybuild tool separatelyproduced8f928cda...sourceunchanged andnative48PASS. Build/source digests not upstream-authorship signatures.
  • Actualcanary/symlink/proc/FD/cap/NNP/seccomp/namespace/socket/IP/ABI/mount/userns/write/flood/parentcrash/setsid-lockrelease/bystander/expiry/revoke negatives; no real secrets/profile/network services. Source/pin/version orfinalRejected alone NOTproof.

Limits And Gates

Sharedkernel/administrator/unisolatedparent/toolchain trusts/DoS remain; no VM or fullworker claim. OnlyselectedLinuxclosure hasreception; otherplatform/features/resources/binary/libseccomp refuse. Normalpytest missingmanagedbinary is skipped/UNPROVED, notnativeacceptance; make-native-proof missingbinfails. CanonicalbaselineCI withoutsetup won'tattestnativeLinuxenforcement: independent security-critical reviewer must runnative48no-skips with ownpin verification and fullrequiredgates. Native setup/proof/CI states distinguished, no skipcount asdenial orfallback.

Counted fresh whole-PR review remains pending (issue50count0/10). Every changedHEAD/base requires newcompletecurrentScope review; no implementation self-approval. No finalAPPROVE/merge/readiness or broadissueclosure claim. No liveinference/Routeroperation/privateaccess/newroleauth/rootlessOCI/main/release/deploy/credential/security expansion beyond owner's narrow profile decision.

## Owner-Selected Scope Refs #50. SAME sole-primary invocation `kernel-loop-20261005T102040Z`, no new controller/cycle. Owner explicitly resumed 2026-10-07: daemon-free Linux bubblewrap, default-deny filesystem/network, explicit required resources and real negative proof, **verification/test execution ONLY**. No full hostile harness/worker isolation; managed rootless OCI deferred. Exact mandate recorded #50 comment15516. ADR0008 states accepted direction and actual limited receipts, not authority from model prose. This PR does not claim all broader original G09/worker requirements received, new authentication, a new daemon/profile migration or ordinary live execution. The selected profile covers untrusted test/verification children, including such execution for review; cold model/harness context and host controller remain trusted and unisolated. Final completion must respect this explicit role scope rather than silently close broader obligations. ## Mechanisms - Core verification validates each trusted prerequisite before requesting later potentially executing checks; unrun checks have findings, not invented evidence. Direct TaskChecks command calls independently check exact subject/spec/Attempt/policy/base/head/paths/pinned clean HEAD/current authorization and structural gates. Rejected candidate tooling never executes merely because final acceptance will fail. Historical143/166 policy/digest/recovery shapes unchanged. - Opt-in `BubblewrapVerifier` behind verification-only ports, fixed controller resources/recipe/subject/snapshot/current-authorizer outside candidate data. No taskrun/ordinary-preparation trust upgrade. Explicit byte snapshots avoid .git/untracked/symlink/socket data, fixed narrow readonly Python closure under/toolchain, fresh workspace, private HOME/temp/dev/proc. No host root/HOME/usr/etc/controller/credentials/cache/socket mounts. - Pinned external bwrap0.11.0 exactsource9ca3b05ec787acfb4b17bed37db5719fa777834f; strict user/pid/net/ipc/uts/cgroup+mount isolation, no try/unshare-all fallback, capdrop/NNP/separate session/parent death/reaper/disabled userns. Lazy maintained libseccomp2.5.5 fixed network/namespace/mount/ptrace/FD/io_uring/alternateABI restrictions, no hand-authored BPF/customsandboxframework. - Controlled close_fds/stdinDEVNULL/pipes/setupFDs, consumed anonymous exec token after trusted bootstrap/nativePID1 ownership and current authority. Actual reaper-FD exposure was found/proved thenmasked/proc1. Outputbounded; timeout/cancel/revoke kills only owned nativePID, PIDnamespace containssetsid children. Settlement needs lifetimeEOF+exactPID1pidfd exit; observerloss staysunknown/retainscratch. No full host descendant census. - Optional locked Meson/Ninja setup verifies exact archive, builds utility unprivileged from owned extracted matching libcap prefix, no download duringtests/root install/daemon/configchange. Core/import safety unchanged, zero runtimePythondeps. all-groups audit includesoptionaltools. No externalbinary/source bundled/C copied; LGPL/source rights inADR/reusecatalogue. ## Exact Subject And Actual Proof Base/mergebase **a9a65006cc8cc5b5e4468746a18ff51daf742e6b**, HEAD **a72154e675adb513c6074dde6d0e0d91fa084d18**, tree **2b0eabc3505776ae38394962b9a4147aeac9cf64**. Clean normal branch, owner-author Adrian, ordinarycommit/push; full20-file delta. Parent independently inspected ALL executor/ports/build/tests/source/gates/operator claims, then executed closed env with explicit trusted binary: `CREATIDY_TEST_BWRAP_BIN=/tmp/kilo/kernel50-bwrap-build-20261007/build/bwrap make native-proof check package-check audit` plusgitdiffcheck. - Native **48 passed, zero skips** (1positive,24actual hostile/lifecycle,22refusal/validation,1SYNTHETICobserver-loss explicitly distinguished). - Full **1295 tests + 57 subtests PASS**, formatting/lint/basedpyright/importboundaries/secret scan/reproducible wheel/sdist/installedlegacy+ordinarycompat/audit/diffPASS. - ActualPython3.12.3 closure, bubblewrap0.11.0 binarySHAa75623409c0755c93ff5bba87ec4c407bf3dcb01d7b0d3c9802ee9a02a272e6f, libseccomp2.5.5, Ubuntu24.04.5 Linux6.18.33.2-WSL2x86_64. Repositorybuild tool separatelyproduced8f928cda...sourceunchanged andnative48PASS. Build/source digests not upstream-authorship signatures. - Actualcanary/symlink/proc/FD/cap/NNP/seccomp/namespace/socket/IP/ABI/mount/userns/write/flood/parentcrash/setsid-lockrelease/bystander/expiry/revoke negatives; no real secrets/profile/network services. Source/pin/version orfinalRejected alone NOTproof. ## Limits And Gates Sharedkernel/administrator/unisolatedparent/toolchain trusts/DoS remain; no VM or fullworker claim. OnlyselectedLinuxclosure hasreception; otherplatform/features/resources/binary/libseccomp refuse. Normalpytest missingmanagedbinary is skipped/UNPROVED, notnativeacceptance; make-native-proof missingbinfails. CanonicalbaselineCI withoutsetup won'tattestnativeLinuxenforcement: independent security-critical reviewer must runnative48no-skips with ownpin verification and fullrequiredgates. Native setup/proof/CI states distinguished, no skipcount asdenial orfallback. Counted fresh whole-PR review remains pending (issue50count0/10). Every changedHEAD/base requires newcompletecurrentScope review; no implementation self-approval. No finalAPPROVE/merge/readiness or broadissueclosure claim. No liveinference/Routeroperation/privateaccess/newroleauth/rootlessOCI/main/release/deploy/credential/security expansion beyond owner's narrow profile decision.
feat: enforce scoped Linux bubblewrap verification boundary (#50)
All checks were successful
ci / check (pull_request) Successful in 1m32s
Details
a72154e675
kilo commented 2026-10-07 08:20:57 +00:00
Author
Member
Copy link

Security-critical independent whole-PR review 1/10 completed on exact HEADa72154e675adb513c6074dde6d0e0d91fa084d18/basea9a65006cc8cc5b5e4468746a18ff51daf742e6b, native task ses_eeaa15d7affeuRUK1ww4lqmQHd: REQUEST_CHANGES, two actionable scoped findings. Count1 retained, no approval/merge/readiness; sameissue/PR/invocation, no newcycle.

  1. P1 pinned native reaper parent-death arming race. Upstream9ca3b05 bubblewrap.c forks the bootstrap3553, while namespacePID1 calls handle_die_with_parent only later in do_init624. Bootstrap can independently arm/emitR3598 whilePID1 is paused pre-arming; currentPPid/pidfd+bootstrap checks do not prove reaper parent-death setup. Exec token therefore could release under that schedule and parent death needn't kill the reparented late-arming namespace. SOURCEPROVEN, not forcedinterleaving reproducedyet; passing ordinary-schedule crash tests insufficient. Must require verified post-arming ownedPID1 readiness using maintained/pinned producer state and forced native schedule proof/locksettlement/bystander protection. No fullworker isolation involved.
  2. P2 duplicate evidence IDs only rejected after allchecks. Independent synthetic probe returned duplicate IDs forfirsttwo validchecks and laterindependent_review wrote its harmlessmarker before InvalidDomainValue. Mustdetect duplicate onreceipt BEFORElaterproducer and addno-effectregression preservingrefusal semantics.

Reviewer independently inspected COMPLETE20files/currentownerverification-testONLYscope/pinnedsource/licence/arch/grants/FDs/setup and executed native48PASSzero skips, full 1295tests+57subtests, package/audit/type/import/secrets/diffPASS. It fetched exactarchive independently matching552cec9c..., comparedsourcecontents, verifiedbinary/libseccompSHA and actualElf dependencies/noRPATH, initial/final canonicalGit+MCP refs/clean subject. Ownsyntheticnativeproc/symlink/toolchain/mountcanaryprobe passed. Theseexistingpasses doNOToverrideidentifiedrace/stream-invariantgap. Actual source/denial/refusal/syntheticobservercases andnativeplatform/trustedparent/caller/DoS/worker-role limits remain distinguished.

Currentparent source inspection verified ordering at exactownedsource; next boundedengineeringremediation addresses BOTH, without new owner choice, custom sandbox framework, upstreamsource alteration, root/daemon/kernel weakening, model/live/Router/private access or broader role claim. ChangedHEAD then freshcompletewholePR review/gates/nativeproof. Historical48/49completeevidence intact.

Security-critical independent whole-PR review **1/10** completed on exact HEADa72154e675adb513c6074dde6d0e0d91fa084d18/basea9a65006cc8cc5b5e4468746a18ff51daf742e6b, native task `ses_eeaa15d7affeuRUK1ww4lqmQHd`: **REQUEST_CHANGES**, two actionable scoped findings. Count1 retained, no approval/merge/readiness; sameissue/PR/invocation, no newcycle. 1. P1 pinned native reaper parent-death arming race. Upstream9ca3b05 bubblewrap.c forks the bootstrap3553, while namespacePID1 calls handle_die_with_parent only later in do_init624. Bootstrap can independently arm/emitR3598 whilePID1 is paused pre-arming; currentPPid/pidfd+bootstrap checks do not prove reaper parent-death setup. Exec token therefore could release under that schedule and parent death needn't kill the reparented late-arming namespace. SOURCEPROVEN, not forcedinterleaving reproducedyet; passing ordinary-schedule crash tests insufficient. Must require verified post-arming ownedPID1 readiness using maintained/pinned producer state and forced native schedule proof/locksettlement/bystander protection. No fullworker isolation involved. 2. P2 duplicate evidence IDs only rejected after allchecks. Independent synthetic probe returned duplicate IDs forfirsttwo validchecks and laterindependent_review wrote its harmlessmarker before InvalidDomainValue. Mustdetect duplicate onreceipt BEFORElaterproducer and addno-effectregression preservingrefusal semantics. Reviewer independently inspected COMPLETE20files/currentownerverification-testONLYscope/pinnedsource/licence/arch/grants/FDs/setup and executed **native48PASSzero skips**, full **1295tests+57subtests**, package/audit/type/import/secrets/diffPASS. It fetched exactarchive independently matching552cec9c..., comparedsourcecontents, verifiedbinary/libseccompSHA and actualElf dependencies/noRPATH, initial/final canonicalGit+MCP refs/clean subject. Ownsyntheticnativeproc/symlink/toolchain/mountcanaryprobe passed. Theseexistingpasses doNOToverrideidentifiedrace/stream-invariantgap. Actual source/denial/refusal/syntheticobservercases andnativeplatform/trustedparent/caller/DoS/worker-role limits remain distinguished. Currentparent source inspection verified ordering at exactownedsource; next boundedengineeringremediation addresses BOTH, without new owner choice, custom sandbox framework, upstreamsource alteration, root/daemon/kernel weakening, model/live/Router/private access or broader role claim. ChangedHEAD then freshcompletewholePR review/gates/nativeproof. Historical48/49completeevidence intact.
fix: await owned reaper arming and reject duplicate evidence early (#50)
All checks were successful
ci / check (pull_request) Successful in 1m32s
Details
30c7204144
kilo merged commit 1deb32900d into develop 2026-10-07 10:05:39 +00:00
kilo commented 2026-10-07 20:47:03 +00:00
Author
Member
Copy link

Owner-scoped reception COMPLETE, SAMEinvocation kernel-loop-20261005T102040Z. Fresh independent security-reviewordinal3 ses_eea492a73ffegIOmtx07Xwbu2G APPROVE[] exactHEAD30c72041445c571fc84d4a1786996123a2c941e7/basea9a65006cc8cc5b5e4468746a18ff51daf742e6b; ordinal1REQ reproduced/repaired, ordinal2connection-reset(noverdict)consumed, full3/10historypreserved. No parent self-review/reviewerresume/model/criteria weakening.

Supportednonforce/nonauto merge todevelop1deb32900d10dab6a3baad0c454ef9aa19c58733, exactparentsbase+HEAD/tree84ddc4dc912a000b8c0fe90047cc033a6eb840e2 identicallyreviewed, ancestry/statusverified. Native+integratedfullgatesPASS55ZEROskips/1303tests+57subtests/package/audit/diff. Oldephemeralscratchnativebinabsentfirstsetup didNOTcountasproof; restoredmatchingpinnedsource/header/runtimeviarepo setup withnohostinstall/dependencywaiver andnativeall55reproved againstrebuiltbinaryb86be326c70893bce3226de259455da28a7eb3496188205cde7a4048d355f698. Nativehashpathchange notsigned/reproducibleattestation. ExactPRCI2366+integratedpush2367SUCCESS, baselineCIdoesnotnativeattest. Normalcheckoutcleandevelop.

#50closed with explicit owner's verification/test-CHILD ONLY reception and remainingbroaderroles deferred. This status doesNOTreceivefullworker/Codex/model/wholecold-harness isolation/allG09/OCI/livemode orgrantanything; consumersmustactualrole-specificreceipts. Unprovenprearming/liveness preservesunknownscratch; trustedhost/caller/admin/kernel/toolchain/DoSlimits unchanged. No private/live/Router/main/release/deploy/securityexpansion.

Fullscope/commands/proof/history/missing-binrecovery/limits: #50 (comment) . Sameinvocation nowfreshSELECT, all48/49historiespreserved. EmbeddedinitialHEAD/counts inhistoricalPRbody are superseded bytheseactualGit/MCP/native receipts, notrewritten aspassingearlierstates.

Owner-scoped reception COMPLETE, SAMEinvocation `kernel-loop-20261005T102040Z`. Fresh independent security-reviewordinal3 `ses_eea492a73ffegIOmtx07Xwbu2G` APPROVE[] exactHEAD30c72041445c571fc84d4a1786996123a2c941e7/basea9a65006cc8cc5b5e4468746a18ff51daf742e6b; ordinal1REQ reproduced/repaired, ordinal2connection-reset(noverdict)consumed, full3/10historypreserved. No parent self-review/reviewerresume/model/criteria weakening. Supportednonforce/nonauto merge todevelop1deb32900d10dab6a3baad0c454ef9aa19c58733, exactparentsbase+HEAD/tree84ddc4dc912a000b8c0fe90047cc033a6eb840e2 identicallyreviewed, ancestry/statusverified. Native+integratedfullgatesPASS55ZEROskips/1303tests+57subtests/package/audit/diff. Oldephemeralscratchnativebinabsentfirstsetup didNOTcountasproof; restoredmatchingpinnedsource/header/runtimeviarepo setup withnohostinstall/dependencywaiver andnativeall55reproved againstrebuiltbinaryb86be326c70893bce3226de259455da28a7eb3496188205cde7a4048d355f698. Nativehashpathchange notsigned/reproducibleattestation. ExactPRCI2366+integratedpush2367SUCCESS, baselineCIdoesnotnativeattest. Normalcheckoutcleandevelop. #50closed with explicit owner's **verification/test-CHILD ONLY** reception and remainingbroaderroles deferred. This status doesNOTreceivefullworker/Codex/model/wholecold-harness isolation/allG09/OCI/livemode orgrantanything; consumersmustactualrole-specificreceipts. Unprovenprearming/liveness preservesunknownscratch; trustedhost/caller/admin/kernel/toolchain/DoSlimits unchanged. No private/live/Router/main/release/deploy/securityexpansion. Fullscope/commands/proof/history/missing-binrecovery/limits: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/50#issuecomment-15570 . Sameinvocation nowfreshSELECT, all48/49historiespreserved. EmbeddedinitialHEAD/counts inhistoricalPRbody are superseded bytheseactualGit/MCP/native receipts, notrewritten aspassingearlierstates.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/creatidy-kernel!74
No description provided.