amadan
Isolated exec spec: revision 12, codex accept with corrections applied
Round 11 findings committed unedited; verdict accept with corrections. The one correction: the probe fixture in /etc/carlos comes from tmpfiles at bootstrap and the control service verifies its ownership and mode before accepting a verdict.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ1ZvWj7naf73GjTX8MBv5
2 files changed,
+48
−4
docs/superpowers/specs/2026-09-11-isolated-exec-design.md+19 −4docs/superpowers/specs/CODEX-FINDINGS-ISOLATED-EXEC-R11.md+29 −0
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-11-isolated-exec-design.md b/docs/superpowers/specs/2026-09-11-isolated-exec-design.md| index c0af6bf55..25e7ed0de 100644 |
| --- a/docs/superpowers/specs/2026-09-11-isolated-exec-design.md |
| +++ b/docs/superpowers/specs/2026-09-11-isolated-exec-design.md |
| @@ -1,7 +1,9 @@ |
| # Isolated exec — every exec-backed instance in its own namespace |
| -**Date:** 2026-09-11 · **Status:** revision 11, after codex rounds 1 to 10 |
| -(19 + 14 + 7 + 4 + 3 + 1 + 1 + 1 + 2 + 1 findings, all accepted; §13) · **Requested by:** discussion |
| +**Date:** 2026-09-11 · **Status:** revision 12; codex verdict after |
| +round 11 is **accept with corrections**, and the one correction is |
| +applied here (54 findings over 11 rounds, all accepted; §13); awaiting |
| +Paul's review · **Requested by:** discussion |
| #126 (Tito, with box evidence), approved in direction by Paul on |
| 2026-09-11 |
| @@ -437,6 +439,7 @@ d /data/instances 0755 carlos carlos - |
| d /data/layout 0700 carlos carlos - |
| d /run/carlos/.instances 2750 carlos carlos-sockets - |
| d /run/carlos/.logs 0700 carlos carlos - |
| +f /etc/carlos/probe-secret 0640 root carlos - probe |
| d /run/carlos/instances 2750 carlos carlos-sockets - |
| d /run/carlos/logs 0700 carlos carlos - |
| d /run/carlos-control 0750 root carlos - |
| @@ -1662,8 +1665,16 @@ verdict line: |
| - a write to `cgroup.kill` under any cgroup directory it can name |
| (its own included) fails with `EROFS`; |
| - `/etc/carlos` cannot be opened (`EACCES` or `ENOENT`, never a |
| - listing), and a fixture file the control service stages beforehand |
| - as `root:carlos 0640` at `/etc/carlos/probe-secret` cannot be read; |
| + listing), and the fixture `/etc/carlos/probe-secret` cannot be read. |
| + The fixture is **not** written by the control service, whose |
| + `ProtectSystem=strict` makes `/etc` read-only to it (codex R11-1); it |
| + is a tmpfiles line (§3.2, `f /etc/carlos/probe-secret 0640 root |
| + carlos - probe`) applied by bootstrap and by `update-platform-binary.sh`'s |
| + `systemd-tmpfiles --create`, before any probe runs. The control |
| + service, before it accepts a probe verdict, `stat`s the fixture and |
| + requires `root:carlos 0640`; a missing or differently-owned fixture is |
| + itself a `not ready` verdict line (`probe fixture absent`), never a |
| + vacuous pass; |
| - `/proc` lists only itself, and its own pid is 1; |
| - a symlink it creates in its directory is refused with `ELOOP`, and |
| `/proc/self/mountinfo` shows `nosymfollow` on both bound directories; |
| @@ -2091,3 +2102,7 @@ rollback runs the old binary). |
| - **Round 10** (codex, `CODEX-FINDINGS-ISOLATED-EXEC-R10.md`, 1 new |
| finding, every prior item resolved, verdict request changes). Accepted: |
| R10-1 `InaccessiblePaths=/etc/carlos` in the templates and the probe; the audit extends to credential inputs a `carlos`-group process reads (§4.1, §8.5, §9). |
| +- **Round 11** (codex, `CODEX-FINDINGS-ISOLATED-EXEC-R11.md`, 1 new |
| + finding, every prior item resolved, **verdict accept with |
| + corrections**). The correction is applied in this revision: |
| + R11-1 the probe fixture comes from tmpfiles at bootstrap, and the control service verifies its ownership and mode before accepting a verdict (§3.2, §8.5). |
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-ISOLATED-EXEC-R11.md b/docs/superpowers/specs/CODEX-FINDINGS-ISOLATED-EXEC-R11.md| new file mode 100644 |
| index 000000000..40ab36e69 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-ISOLATED-EXEC-R11.md |
| @@ -0,0 +1,29 @@ |
| +| Prior finding | Disposition at `c5393728` | |
| +|---|---| |
| +| R10-1 | **Resolved for the credential exposure.** All tenant roles hide `/etc/carlos`; §9 extends the audit to credential reads. The new probe setup has a separate defect below. | |
| +| R5-2 | **Resolved.** Downgrade checks every row’s paths regardless of flags and requires completed reversal; unflagging nested rows is refused (§8.2). | |
| +| R5-3 | **Resolved.** Directory, socket, unit and slice names consistently use bounded `InstanceID(host)` (§§3.1, 5.3). | |
| +| R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain invocation identity and results through capture (§§4.2, 5.3). | |
| +| R2-5 | **Resolved.** Completion requires terminal state and cgroup emptiness, including foreign invocations; uncertain stops retain the lease (§§6.3, 6.5). | |
| +| R2-7 | **Resolved.** Recovery derives both endpoints from journal direction, completes that transaction, then converges to current intent (§8.2). | |
| +| R2-9 | **Resolved.** Flat minting, explicit reversal, env asides and completed-reversal downgrade guards cover the reported failures (§§8.1–8.2). | |
| +| R2-14 | **Resolved at spec level.** The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). | |
| +| R1-4 | **Resolved.** Log EOF does not establish termination; blocking observations remain outside the activator mutex (§§6.4–6.7). | |
| +| R1-5 | **Resolved.** Seed preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). | |
| +| R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). | |
| +| R1-12 | **Resolved.** Named consumer fences and bidirectional journal recovery cover interrupted migration (§8.2). | |
| +| R1-13 | **Resolved.** Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). | |
| +| R1-15 | **Resolved for the reported PID/IMDS defects.** No unsafe fallback remains; the behavioural gate is specified (§8.5). | |
| +| R1-18 | **Resolved under the recorded ruling.** Remote operations and reporting are specified; the `foreign` repair residual remains explicitly accepted (§§8.3–8.4). | |
| + |
| +**R11-1 — P2 — §§5.2, 8.5: The control service’s sandbox prevents creation of the new probe fixture.** |
| + |
| +Retain §5.4’s process-authenticated control service. |
| + |
| +[§8.5 requires the control service to stage `/etc/carlos/probe-secret`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1664) as `root:carlos 0640` before running the probe. But [the supplied control-service unit](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:857) sets `ProtectSystem=strict` without a writable exception for that path. This makes `/etc` read-only inside the service; ordinary file creation fails with `EROFS` despite running as root. [systemd execution semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml). |
| + |
| +On a clean rollout, the mandatory fixture therefore cannot be prepared as specified. Honouring the setup failure prevents readiness; proceeding without the fixture makes its unreadability check vacuous. |
| + |
| +**Correction:** assign fixture creation to root bootstrap/tmpfiles, ordered before the probe. Have the control service verify that the fixture exists with the required ownership and mode before accepting the probe result. Keep `/etc/carlos` inaccessible in every tenant template. |
| + |
| +**Verdict: accept with corrections.** |
| \ No newline at end of file |