Add fail-closed strict VM safety and scout-only macOS preview#2
Draft
g4nesh wants to merge 7 commits into
Draft
Conversation
Hard-disable every production host, OCI, mediator, broker, and whole-cycle path until broker-attested live evidence exists. Add the zero-NIC Virtualization.framework launcher contract, sealed request/result formats, bounded epoch and cleanup recovery, rejection-only Linux guest source, reproducible candidate-build gates, and independent fixture-only cycle verification. Add the Terra-high Codex evidence parser and conservative token ledger without exposing provider credentials or accepting model-authored usage. Add the owner-private macOS scout package, signal-safe process cleanup, strict repository nomination policy, deterministic rehearsal, schemas, documentation, and adversarial coverage. Verified locally with 446 tests under ResourceWarning=error, Ruff, compilation, schema and shell/plist checks, Swift launcher signing, guest static policy, a 14-check Seatbelt rehearsal, and a byte-identical 110-file package rebuild. Production contribution execution and publication remain source-disabled.
Make the container test image include every macOS-package and strict-VM source/evidence input so offline CI exercises the full safety tree. Scope Linux child-subreaper adoption to each runner execution, reap only the owned process group, restore prior state, and avoid recycled-PGID probes after a strict launcher is reaped. Tighten training fixture attestation to the exact in-tree orchestrator test module, add cross-platform cleanup regressions, explicitly reap the mocked failure fixture, and document the Linux cleanup contract. Verified with 465 warning-strict tests, static guest/Swift checks, a 14-check Seatbelt rehearsal, and deterministic 110-file package rebuilds.
Copy the docs tree into the CI test image and require every declared portable-package tree root to exist as a real directory before enumeration. This prevents an incomplete build context from silently producing a smaller but internally consistent archive. Add a missing-tree regression and reverify all 466 tests, Ruff, whitespace, and byte-identical 110-file package rebuilds at SHA-256 e74920c3b24ccbce9080581ca70efdf2978a5c503f70a08477578d7ebc270bc4.
Add source-disabled descriptor broker storage and dispatch with pre-access production gates, durable acknowledgement semantics, fixed launch policy, and identity-checked cleanup. Add a bounded canonical LFRQ guest interpreter plus supervisor device, descriptor, rlimit, Landlock, capability, no-new-privileges, and seccomp controls while keeping execution unreachable. Bind actual Codex argv, environment, stdin, executable, cwd, schema, and result paths; add fail-closed post-stop verification and a synthetic no-authority whole-cycle rehearsal. Align the prior_obs wire schema and add adversarial regression coverage for substitution, block devices, clone leakage, root replacement, cleanup failure, and protocol bounds. Verified with 519 passing tests, Ruff check/format, guest static locks, strict VM Swift compile/signature checks, and reproducible package verification. Production contribution execution remains disabled.
Recognize only root-owned sticky writable directories such as Linux /tmp as trusted ancestors for immutable Codex fixture files and synthetic rehearsal roots. Continue rejecting writable non-sticky ancestors, wrong-owner directories, symlink traversal, and same-UID claims; document the narrow exception and retain the dedicated-service activation requirement. Add direct policy regressions and verify all 521 tests, Ruff, reproducible package output, and fresh archive/tree binding.
Bind run-mode launches to the exact 2-vCPU, 2-GiB memory, 2-GiB scratch, 30-minute profile and require a sealed request disk. Add descriptor-native LFRQ admission that revalidates FD identity, canonical mediation usage and timestamps, active boot session, unexpired allocation, exact token reservation, request sections, target identity, and patch digest. Replace the broker journal model with bounded alternating complete slots, streaming hashes, lost-reply safety, reboot quarantine, monotonic rollover, token accounting, fork detection, and fail-closed malformed recovery. Define source-disabled macOS root-owned manifest, dedicated LaunchDaemon/XPC signing trust, and Linux cgroup-v2 descendant-empty evidence contracts without enabling any production adapter. Keep the installed workflow scout-only and extend adversarial tests and operator documentation for every new denial and activation boundary. Verification: 558 tests; Ruff check/format; Python compile; JSON/shell/static guest checks; Swift compile/signature; deterministic package/tree verification.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
/dev, descriptor audit, rlimits, cgroup limits, Landlock, capability drop,no_new_privs, and seccomp; the interpreter remains unreachable in this releaseprior_obswire schema and add adversarial coverage for substitution, block devices, exact-width fields, clone leakage, root replacement, cleanup failure, sticky temporary ancestors, and protocol/resource boundsSafety status
This PR intentionally does not enable unattended contribution execution. Public broker, provider-mediation, VM contribution, post-stop, whole-cycle handoff, and publisher entry points remain source-gated before launch or authority-bearing I/O. The guest interpreter is source-only, unbuilt, unbooted, and unreachable. The installed macOS preview remains read-only scout-only. No external issue, comment, fork, target branch, contribution run, or pull request was attempted by the worker.
Activation remains gated on:
Verification
ResourceWarningpromoted to errors; one live-OCI test is intentionally skipped locally9c64b18812b7a7d4a278887d3361c26badacb003d2e0ade31d1f9f7b3f00891f; a fresh owner-private extraction passes supplied-digest and archive/tree bindingmake guest-release-preflightfails as designed before resource access because reviewed trust roots are deliberately unconfiguredmake testwas attempted locally and could not start because this Mac has no Docker-compatible runtime9bb5b357869ee64980d36975a8b8d636d78e3381: push run 29672828150 and pull-request run 29672829229 both pass installed-wheel smoke, all offline tests, both image builds, the real OCI training rehearsal, evidence/cleanup validation, and the proof that no managed container remainsThe immediately preceding CI attempt exposed a Linux
/tmpportability bug in the new ancestor policy. The follow-up permits only the conventional root-owned sticky temporary boundary, continues to reject writable non-sticky or wrong-owner ancestors, adds direct regressions, and preserves the documented same-UID limitation.