carlos / platform Public

rootfs: census overlays and approval card for Plan 1 (rootfs Plan 1 Task 12)

The root-read census, by AGENTS.md "The census" (#369): the 49 new
units (decisions) in a hand-written overlay, rootfs-apps-1-new, each
legacy accepted-legacy at J4, none a box unit; the 5 changed units and
5 envelopes (. with go.mod, internal/console, internal/hostops,
internal/release, internal/rootfsimage) by make census-propose
NAME=rootfs-apps-1. Both carry rev3=census-ruling-rootfs-apps-1 from the
start and join the chain manifest; plan14_root_reads_test.go is
unchanged. The card lists the decisions, the record-write entries and
the new squashfs module.

The record-write census re-pins main.go main (the __rootfs-check-probe
dispatch) and establishShipKind (Task 8's error wrap), and adds
ship_check.go const#2 as a key-site (paths inside a --check container).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 6 hours ago 9d0afbc58153e7c4fe9a7fdc5be66e991389d22d parent 5ba6076

5 files changed, +188 −12

docs/superpowers/notes/census-proposal-rootfs-apps-1.md +44 −0
internal/provision/rootfs_apps_1_census_test.go +25 −12
internal/provision/testdata/plan14-root-reads-chain.tsv +2 −0
internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv +100 −0
internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv +17 −0

diff --git a/docs/superpowers/notes/census-proposal-rootfs-apps-1.md b/docs/superpowers/notes/census-proposal-rootfs-apps-1.md

new file mode 100644

index 000000000..a6eac2646

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-rootfs-apps-1.md

@@ -0,0 +1,44 @@

+# Census approval: rootfs-apps-1

+Ruling `census-ruling-rootfs-apps-1`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

+|---|---|---|---|

+| `internal/console/apicli.go` `Server.handleAPIShip` | body | unchanged (1) | rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added |

+| `internal/hostops/mutation_boundary_putfrom.go` `conditionalRecordStore.PutFrom` | body | unchanged (1) | rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added |

+| `internal/hostops/mutation_boundary_putfrom.go` `mutationBoundary.PutFrom` | body | unchanged (1) | rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added |

+| `cli.go` `runShip` | sites | -file:ReadFile | rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added |

+Envelopes re-pinned: `.`, `internal/console`, `internal/hostops`, `internal/release`, `internal/rootfsimage`.

+Seal: `873bb2bce9fee9b41568b75653fb1df749465faf533413e9b0132ab4b80a4df0` → `225710f8b5e257ff0f72612b44a516dfe9f4bbd3df057e04b637dbd925dc0578`.

+Overlay: `internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.

+## Decisions (hand-written, not by census-propose)

+census-propose refuses new units, so these 49 rows are in a second overlay, `internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv`, written by hand following the chain's overlays and loaded just before the approvals above (seal `945934f5…` → `873bb2bc…`). Each is `legacy accepted-legacy` at J4 with `rev3=census-ruling-rootfs-apps-1` from the start. None is a box unit. The per-unit basis is in the overlay; in short:

+|---|---|---|---|

+| `ship_check_probe.go` | `cachedCheckProbe`, `fileSHA256`, `writeFileAtomic`, `checkProbeBinary`, `staticELF` | the CLI, as the person | the probe it caches under the user cache dir, and the running carlos executable |

+| `internal/rootfsimage` (29 units in `archive.go`, `dir.go`, `errors.go`, `flatten.go`, `framework.go`, `oci.go`, `processes.go`, `progarch.go`, `squashfs.go`, `tar.go`, `tree.go`) | | the CLI, as the person (imported only by the files above) | the image or directory the person named, and the spool in the CLI's own scratch; about half read no file (a `Command` field, an `io.Reader`'s `Read`, an in-memory tree lookup) |

+## Record-write census (hand-written, `internal/provision/rootfs_apps_1_census_test.go`)

+- New, `nonrecord`: `rootfs_ship.go` `putImmutableFrom` (the create-only streamed put of a release artifact) and `establishShipKind` (the create-only put of `apps/<acct>/<app>/kind.json`, once per app; Task 8 wrapped its errors, the same put).

+- New, `key-site`: `ship_check.go` `const#2`, the instance's paths inside a `--check` container (`/data/instances/check`, `/run/carlos/instances/check`) on volumes the check made on the person's machine. It writes no record and names no bucket key.

+- Re-pinned, class and kinds unchanged: `mutationBoundary.PutFrom` and `conditionalRecordStore.PutFrom` (a rootfs image key streams, as a GeoIP blob does; never a record body), and `main.go` `main` (dispatches `__rootfs-check-probe` before the command switch).

+## go.mod

+One new direct module, `github.com/KarpelesLab/squashfs v1.2.0` (the pure-Go squashfs writer and reader, used only by `internal/rootfsimage`), with two indirect lines it brings: `github.com/hanwen/go-fuse/v2 v2.1.0` and `github.com/ulikunitz/xz v0.5.10`. The `.` envelope above covers `go.mod` and `go.sum`.

diff --git a/internal/provision/rootfs_apps_1_census_test.go b/internal/provision/rootfs_apps_1_census_test.go

index d84642442..58ba9f4cf 100644

--- a/internal/provision/rootfs_apps_1_census_test.go

+++ b/internal/provision/rootfs_apps_1_census_test.go

@@ -1,18 +1,26 @@

package provision

-// Record-write census entries for rootfs apps Plan 1 Task 3 (an app's kind

-// fixed at its first ship, and a ship that streams its image from disk),

-// layered on dbRegionForward3WriteCensusInventory (main's newest). Reviewed

-// by the branch author; PROPOSED, the census owner rules on #280

+// Record-write census entries for rootfs apps Plan 1 (Task 3: an app's kind

+// fixed at its first ship, and a ship that streams its image from disk;

+// Task 8: the kind check's errors; Task 11: carlos ship --check), layered

+// on dbRegionForward3WriteCensusInventory (main's newest). Reviewed by the

+// branch author; PROPOSED, the census owner rules on #280

// (census-ruling-rootfs-apps-1).

-// New, both nonrecord:

-// - rootfs_ship.go putImmutableFrom: the create-only streamed put of a

-// release artifact (apps/<acct>/<app>/releases/<version>/<file>), the

-// streaming twin of putImmutable.

-// - rootfs_ship.go establishShipKind: the create-only put of an app's kind

-// marker (apps/<acct>/<app>/kind.json), written once by the app's first

-// ship and never rewritten.

+// New:

+// - rootfs_ship.go putImmutableFrom (nonrecord): the create-only streamed

+// put of a release artifact

+// (apps/<acct>/<app>/releases/<version>/<file>), the streaming twin of

+// putImmutable.

+// - rootfs_ship.go establishShipKind (nonrecord): the create-only put of

+// an app's kind marker (apps/<acct>/<app>/kind.json), written once by

+// the app's first ship and never rewritten. Task 8 wraps its errors in

+// release.ErrAppKindCheck; the same put.

+// - ship_check.go const#2 (key-site): the instance's paths inside a

+// carlos ship --check container (/data/instances/check and

+// /run/carlos/instances/check), as a box lays them out, on volumes the

+// check made on the person's machine; it writes no record and names no

+// bucket key.

// Re-pinned, class and kinds unchanged:

// - mutationBoundary.PutFrom: a create-only put of an exact release rootfs

@@ -21,6 +29,9 @@ package provision

// - conditionalRecordStore.PutFrom: the same key streams past the record

// checks, beside the GeoIP blob key; a rootfs image is never a record

// body.

+// - main.go main (key-site): dispatches __rootfs-check-probe, the --check

+// health probe run inside the web container, before the command

+// switch; its instances and sidecars literals are unchanged.

// None of these writes an instance or sidecar record.

func rootfsApps1WriteCensusInventory() []censusEntry {

@@ -28,6 +39,7 @@ func rootfsApps1WriteCensusInventory() []censusEntry {

repins := []censusEntry{

{"internal/hostops/mutation_boundary_putfrom.go", "mutationBoundary.PutFrom", "record-transport", "def:PutFrom,sel:Put,sel:PutObjectFrom,str:Put", "e04f3976e679699e57cb69b4ada1e3af92cdd7ed99ee7a52b0c12252b4473866"},

{"internal/hostops/mutation_boundary_putfrom.go", "conditionalRecordStore.PutFrom", "record-transport", "def:PutFrom,sel:Put,sel:PutObjectFrom", "50fef94769c4e4d4c49d72c657ff96b0d49a8fd5f03bca4cedce19f6e5fd0067"},

+ {"main.go", "main", "key-site", "lit:instances,lit:sidecars", "9e7ce53e2036cb300d9fd07e4cb173944633414483f9c4b59cfb72c29ceea6bb"},

}

for _, r := range repins {

found := false

@@ -46,6 +58,7 @@ func rootfsApps1WriteCensusInventory() []censusEntry {

}

return append(entries,

censusEntry{"internal/release/rootfs_ship.go", "putImmutableFrom", "nonrecord", "id:PutObjectFrom", "a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6"},

- censusEntry{"internal/release/rootfs_ship.go", "establishShipKind", "nonrecord", "sel:Put", "10112325518d4f7dff783adb0400148a77697c98cebe7a44e3198966a72eb224"},

+ censusEntry{"internal/release/rootfs_ship.go", "establishShipKind", "nonrecord", "sel:Put", "75ce5741858ffe4990f1b638c82f86d0a38ba928c6a3cd6d68ab2333d246f237"},

+ censusEntry{"ship_check.go", "const#2", "key-site", "lit:instances", "74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8"},

)

}

diff --git a/internal/provision/testdata/plan14-root-reads-chain.tsv b/internal/provision/testdata/plan14-root-reads-chain.tsv

index a67ca45fd..a7ae6401d 100644

--- a/internal/provision/testdata/plan14-root-reads-chain.tsv

+++ b/internal/provision/testdata/plan14-root-reads-chain.tsv

@@ -3,3 +3,5 @@

# make census-propose appends here; nothing else edits this file.

plan14-root-reads-sec-host-imdsv2-module.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a

plan14-root-reads-sec-deps-dos-bumps.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a

+plan14-root-reads-rootfs-apps-1-new.tsv 873bb2bce9fee9b41568b75653fb1df749465faf533413e9b0132ab4b80a4df0

+plan14-root-reads-rootfs-apps-1.tsv 225710f8b5e257ff0f72612b44a516dfe9f4bbd3df057e04b637dbd925dc0578

diff --git a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv

new file mode 100644

index 000000000..bb812bb1a

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv

@@ -0,0 +1,100 @@

+# Census overlay rootfs-apps-1-new (rootfs apps Plan 1: carlos ship --rootfs and --check, the console's rootfs ship door, release.ShipSpooled; spec docs/superpowers/specs/2026-10-24-rootfs-apps-design.md §5.1, §5.8), hand-written: the decisions census-propose refuses (AGENTS.md, The census). Loaded from the chain manifest after sec-deps-dos-bumps and before plan14-root-reads-rootfs-apps-1.tsv, which census-propose wrote for the approvals. Every row carries rev3=census-ruling-rootfs-apps-1 from the start; the census owner rules on #280 (docs/superpowers/notes/census-proposal-rootfs-apps-1.md).

+# 49 new units, each legacy accepted-legacy at J4, none a box unit. 43 run in the carlos CLI on a person's machine, as the person: 14 in the root package (cli.go shipNoteText, ship_rootfs.go, ship_runtime.go, ship_check.go, ship_check_probe.go; listeningPorts runs as the in-container probe inside the --check container) and 29 in internal/rootfsimage, imported only by those files. 2 are the console's (apiship_rootfs.go: the request body and its own spool). 2 are internal/release's, reached only from ShipSpooled (the console and the CLI's direct mode, each over a file it spooled itself), and 2 more in internal/release are matched on the word Command (release.Process's argv field). What they read: files the person named, scratch the CLI or the console made for itself, the probe cached under the user cache dir, the docker or podman CLI it runs; many read no file at all (a Command field, crypto/rand.Read, an io.Reader's Read, an in-memory tree lookup). Frozen declarations are added, so the seal moves; sec-deps-dos-bumps' is checked first.

+@legacy 4a9dbe55f930719356c73d38a7e92a62d7ff2e1ad88e267565989251d28b1292 cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54

+@legacy 099fcb9aceae22e32c976d4c47d3262d2d2a2a42445845d7968f6737615db50a internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d

+@legacy 4bcf91a53925368438328c280f7e2cffb68ca40edd1d5a4138d197d5144509ea internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads only the upload it spooled; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150

+@legacy 3c40d72a06c394dfff8ea2db6b5ef7a48235f29b144f7a771b90d851facb98c3 internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17

+@legacy 0c20259a67f7c49d39171d96a06011770851af460270a30d7fb06ba04f553ed4 internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398

+@legacy f1662a273a07f1c63ef82adb6ff0a3208b3d29a6b4562fca5a50f4d4226d5395 internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27

+@legacy 94e3922bed4b0df1bde55554c09dc9765ee620e1125721673be25f4018646bd8 internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6

+@legacy 9173125d07a721094c05ea5eeb9120477ec9f3e123ea2c4dec445877e79ef481 internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397

+@legacy 1e15921d5ec8f9186291e8cdbf144ba8619851e353678340bb74da5de99c5a1a internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 1d982791f1bf96191360b2ef87473ef723d49a2de0be8ae8c84c19c8a831ea91

+@legacy 4ce9c95915443f2c22c10b77c845a916a8f243ec516701e689a5573022a88cd4 internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4

+@legacy 980af1a9be9f489c84b9e5f9a94e36f45498107244ae279179acb33d81e580f1 internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c

+@legacy 83ceebf009515bf6b0db99cd2c0ca5fcbe5718c002f70322353a03308486b506 internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@205,file:Read@24 8e05e9c4a9914b84fbf9c39662cfb8408b3e83c9537c66fcc697454c8087740c

+@legacy 4adcd87a4cf55bcdb2c7fd8b6fbc1d387a8f1e69c98bfca3dce1063ff0bdd4ae internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f

+@legacy 38687b3a14749ceedc43514d8ba068c240ff5a46f929708434f0890d6729a380 internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35

+@legacy 8708098c5a62564e5167d96de9f80738857c2eaf06ec44ce541430e332010ca6 internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5

+@legacy 8386a5a0c23c595ce2f016e28ff838f50cba8c3f2e3d1958be614518bff8f720 internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4

+@legacy 927c5246cda1b1e5a8af125c5b8389627d3b3dcd73dd688d0ef46ef26f23d0eb internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1

+@legacy 183d5a2b50be88d1ab713c5d74e05798503e80a6e8814efa11e6387c8cdf8e84 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@279 b98c944496214a92627a79ef98c06d17a008ce17fbfa3356ba68b9c2f515b7b2

+@legacy c187fa6fa0464d0739b063159cfdbde65172dc4a859421257d915354d705c0e7 internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103

+@legacy d55f2ea60600cd9b7abf644c0c94817ba8cfbab7c6b87eef6ac07aa3a213c80d internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@549,file:Command@574 82c5e34d66bc73d613486fc8ab913d50d21246014b42d5ab9d2c2542049d3d66

+@legacy eb0946e4251047589ff151c848bd2d6d1fab3bf651436a02cd6fed94941b7723 internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9

+@legacy 645a8572481d74bb18b892b0c972ec76d6bb7a580905ab993fc9a662a719828d internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a

+@legacy 2016b0945e612ce342558483f00f11b96022320877472c5b473baf5e79cf9047 internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667

+@legacy 78f7744b11bdb013bf6ef3a05876746f33edd1db49351db7e4be67a2bcdefb17 internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792

+@legacy 4f2b03b8cb11cf9b0509ff577ecbfcbfdcf38cde637e24f04847ddc7e4223408 internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab

+@legacy 21a567de8b1e8bce9f452ad04a1d65c3d7fe8adb66de4ec60c8ed17594e4c631 internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6

+@legacy 1da905f3bfdc194c42bad6fe5cfef528830e4bb1e4d8babe9ff77f5223c18614 internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef

+@legacy 6d2b7723ec229d29e753abab980830ac25f5e0e16d411c7400b222f621e82106 internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178

+@legacy dc4cb84cc9c7e128bb27901fbb2d6736d4b9c1cb8af56fcdf106e49f6aaf4a16 internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594

+@legacy 5bb2d77ffdfaa3abd24b2c7dba8bbfb4ebc9830763fd3b1b264fd9361b51f387 internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8

+@legacy 26b8c71698044b42089fcba6558309a166015bb0e45125b1b7b33c0ac9754809 internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082

+@legacy 4b77e79861d5320fd1ddc23cd27d94a5eb574b003e88e2053649230a7f7ec5ab internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa

+@legacy 874192cedc6e364d72be6d4b3a49c8c849eb1dde8ae37b49aa5e8ccd941de27d internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531

+@legacy 3abc9f24b1bc610c76561df20f9734c826324ca51453552f5e4f1752985ae328 internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d

+@legacy 349b05675adef44a1a3331d79989fcef013cdf27b25dc3a0c0ac006dc8617599 internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05

+@legacy bf3a0d8bb4e28239911727bfcd1fabbfa8d10817b7d2163902fb6140854ed645 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@285 56305d3166cf57a6397f4ec591dbf8596dbf8bd19d8be11a4417fee5ce10ac8c

+@legacy 1b8938c8d50e48ad187a7acde871b20cfda3b9af9dd3cec276dc5b76a51b679c ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8

+@legacy 3a80febe2bc13dceef326bb1f3a71e91a738b8903fa172ac98dcb85302552631 ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4

+@legacy 355e3ead803016c7080595fccdeee34cc16e4764f1a3e8737d66a27e4b452337 ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1

+@legacy 024c19d025e7f22b0b09ebb49527d6e4db32a7982478c113ce34395da72b5a90 ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (<cache>/carlos/check-probe/<tag>/), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root file:ReadFile@289 3281ca827a5734d9ea3d2257943f5feb44fc019a7f6b7d76ca05b9ba411c4b17

+@legacy 6f2a41a1ba94310a52f7995beff204fc3523a34a526f9f1d757a2730a0d1b0b0 ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0

+@legacy 7180f2f5a41ec9d0267aaab27b52927dadc64cd35e05c8c87f78a8e5dd6b7cdc ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda

+@legacy fd8281363fa24883d43579d4d0189265631045ca68bcaa185c3910387482774f ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a

+@legacy 403933a3d332f17b70ce2f1e9b99ccf073e9063aaa65316ac68b92a558de9d09 ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799

+@legacy a17d36cf8011a6b08e6ba3468b9cf0dab687e57673612c7de53feedd3aafec80 ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root file:CreateTemp@86 24a4d97025ef0f88391fcd835406bfec2d837a5de934c6108775123005430592

+@legacy 3a3fdc18e773848d3d2cead508bbd04ad05b789781aa7d7bdc2afcae187b864f ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates <scratch>/rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf

+@legacy 213612395cfa923e8e5f395691fc2f28b167860fe81bd1b562535095771c23ad ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa

+@legacy bf0ad85f3bbdc981bf313e25b302dc887b92ce94cb07f47502e8ac46b97f3c5c ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root file:CommandContext@135 77f5f8918e0e82daea7d4590c5d543b0869ced58ce9a1773865007636c2ec9c4

+@legacy 610f1e4501e73a6fb1fac81013e77c464c7695e2c37e3999302a96ad969944ce ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to <scratch>/image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d

+cli.go shipNoteText legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --notes-file the person named (os.ReadFile), moved out of runShip so the rootfs path shares it; decides nothing for root file:ReadFile@223 5ff92a8a2c69c43489ae0bb175b6ed77f591cd149bd726e8b1d9e77ce1279f54

+internal/console/apiship_rootfs.go shipBody.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), reads the ship request's HTTP body under the door's byte limit (the reader's Read, not a file); decides nothing for root file:Read@19,file:Read@398 d14b28f4d7d27cef252623996b3f86e3c5d04bae08d4195abeabe341bda41c8d

+internal/console/apiship_rootfs.go spoolRootfsPart legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): new (rootfs Plan 1), creates the upload's spool file (O_EXCL, 0600) in its own private directory under the console's seed scratch, reserved before the body is read and removed on every path; reads only the upload it spooled; decides nothing for root file:OpenFile@114 46acf7814f63300522ec5b21936b02f63e29f1e6d22e8da8c60cb697a6584150

+internal/release/rootfs.go type Process legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the release manifest's process type, compiled into every carlos binary: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@23 fd439e6bfa93df12a105bccbe41604aae8b6c71248830884685f9fb25dc4cb17

+internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the shape rule for a manifest's processes, run at ship (console and CLI) and on decode: new (rootfs Plan 1); the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@242,file:Command@61,file:Command@80 66c6ce57518082f62c7a55895351cfc5ba65781e906074cb094b5f6c82c6d398

+internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27

+internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6

+internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397

+internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 1d982791f1bf96191360b2ef87473ef723d49a2de0be8ae8c84c19c8a831ea91

+internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4

+internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c

+internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@205,file:Read@24 8e05e9c4a9914b84fbf9c39662cfb8408b3e83c9537c66fcc697454c8087740c

+internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f

+internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35

+internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5

+internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4

+internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1

+internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@279 b98c944496214a92627a79ef98c06d17a008ce17fbfa3356ba68b9c2f515b7b2

+internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103

+internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@549,file:Command@574 82c5e34d66bc73d613486fc8ab913d50d21246014b42d5ab9d2c2542049d3d66

+internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9

+internal/rootfsimage/processes.go jitOf legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, names the program a process runs, from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@56 af5faa5d1eb5e07e2f330dbdf08efbe89d7a4af73ac10c667029fbb2f751a60a

+internal/rootfsimage/processes.go shebangRuntime legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most the first shebangBytes of one script of the person's image through Tree.Open, for the JIT warning; decides nothing for root file:Open@60 46fd0d8c36717f12e1da2bc1bcdd4452b03077c5217cdb777181e618e69a9667

+internal/rootfsimage/progarch.go Tree.head legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads at most 20 bytes of a regular file of the person's directory source through Tree.Open, to name a program not built for linux/arm64; decides nothing for root file:Open@60 e7aa22afec3b4581c58c14ef25b1dff69ec7ce89ee10d7a62a18408c61d82792

+internal/rootfsimage/squashfs.go treeFS.Lstat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Lstat@16,file:Stat@65 f3ba827c853bcf504c2931d880147b32c3c1fa328e453e36a3ad7258a81768ab

+internal/rootfsimage/squashfs.go treeFS.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the tree; a regular file's bytes come through treeFS.ReadFile; decides nothing for root file:Open@16,file:ReadFile@204 51d5cb9d3a1655644a3f9d718fb14853964ab64c546cba1efe1ca9c287cf90f6

+internal/rootfsimage/squashfs.go treeFS.ReadDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a listing, reads no file; decides nothing for root file:ReadDir@16 06438d0c8d4806ae807aefe04fe2ca0882ed805b5df19cc4947d7be321d046ef

+internal/rootfsimage/squashfs.go treeFS.ReadFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads exactly the size the tree recorded of a regular file through Tree.Open (the spool under the CLI's own scratch, or the person's directory source in place), refusing a file that changed size; decides nothing for root file:Open@139,file:Read@461,file:ReadFile@16 4d4f4214cd70d7f95e018c2284a6091490f67e0438461ae6d84f1e09268e6178

+internal/rootfsimage/squashfs.go treeFS.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the squashfs writer's view of the in-memory tree; a lookup, reads no file; decides nothing for root file:Stat@16 426d5d99a9b28a6c7e1b1650f60ee32dcb6df54a66715441c1f814f441e1c594

+internal/rootfsimage/squashfs.go treeFile.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads bytes already in memory (from treeFS.ReadFile); reads no file; decides nothing for root file:Read@19 226e1cf7c0fb761b2d929a70f0ac48662678f0a6107b255192e881086ab438b8

+internal/rootfsimage/squashfs.go treeFile.Stat legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, an in-memory entry's info; reads no file; decides nothing for root file:Stat@19 df4b21a4f97b380a56870d7b4d984dd5e46f31e1f407daa8426bb3c88ba6f082

+internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the image file its caller created in its own scratch, for its size after writing; decides nothing for root file:Stat@1987 273105c82eedfdad9598f62da631268d6658abf2530a736f9e65cdd9e5b649aa

+internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531

+internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d

+internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05

+internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@285 56305d3166cf57a6397f4ec591dbf8596dbf8bd19d8be11a4417fee5ce10ac8c

+ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8

+ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4

+ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1

+ship_check_probe.go cachedCheckProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the sha256 it recorded beside the probe binary it cached under the user cache dir (<cache>/carlos/check-probe/<tag>/), to check the copy before mounting it, and fetches a signed, checksummed release asset when it is absent or damaged; decides nothing for root file:ReadFile@289 3281ca827a5734d9ea3d2257943f5feb44fc019a7f6b7d76ca05b9ba411c4b17

+ship_check_probe.go checkProbeBinary legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), resolves the running carlos executable's own path (filepath.EvalSymlinks) to mount it as the in-container probe, or CARLOS_CHECK_PROBE when the person set it; decides nothing for root file:EvalSymlinks@271 6da69f2d06b63a702dc178d091c053d9c63e95aa851e17e64cd7381c5b4e29f0

+ship_check_probe.go fileSHA256 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the probe binary it cached under the user cache dir to hash it against its recorded sha256; decides nothing for root file:Open@58 4e45c59d7c9465d8033f993de91fa17e8d81e1e3e3dd9c959fb3aa0e1b743cda

+ship_check_probe.go listeningPorts legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), run as the in-container probe (carlos __rootfs-check-probe, uid 65534 inside the --check container, the carlos binary mounted read-only): opens /proc/net/tcp and /proc/net/tcp6 inside that container to name the ports web listens on when it misses the socket; never on a box; decides nothing for root file:Open@107 4b48f8b7a6b82fdb794d61f1451ba94a34ebd73abda84b2dac398e4822631e9a

+ship_check_probe.go staticELF legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), opens the running carlos executable (debug/elf.Open) to see that it has no program interpreter before mounting it in the image; decides nothing for root file:Open@46 d1d0ff59e269d7f189d49ef2993e33c2a571cb118622c0cfcdb24ca479d87799

+ship_check_probe.go writeFileAtomic legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates a temp file beside the probe it caches under the user cache dir and renames it into place (writes, does not read); decides nothing for root file:CreateTemp@86 24a4d97025ef0f88391fcd835406bfec2d837a5de934c6108775123005430592

+ship_rootfs.go buildRootfs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), creates <scratch>/rootfs.squashfs (O_EXCL, 0600) in its own private scratch under the system temp dir, which runShip removes on every path and on a stop signal; Command is release.Process's argv field, not os/exec; the source is read through rootfsimage; decides nothing for root file:Command@1016,file:OpenFile@1379 410bdfc067caf4a02b84e6388302f4dcac16e1b913ae58a2af58cd0376f1b7bf

+ship_rootfs.go readProcessesFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), reads the --processes file the person named (os.ReadFile) and decodes it with release.DecodeProcesses; decides nothing for root file:ReadFile@87 88e5324d435c9aa9d027155e6b60afa2fbea74b65066f9db25704f3dda3320fa

+ship_runtime.go execRunner legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), runs the docker or podman CLI (exec.CommandContext) found on PATH or named by CARLOS_CONTAINER_RUNTIME, as the person, for docker save of a local image name, the --check import, run, inspect, logs and removal; decides nothing for root file:CommandContext@135 77f5f8918e0e82daea7d4590c5d543b0869ced58ce9a1773865007636c2ec9c4

+ship_runtime.go openRootfsSource legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), stats the source the person named; an existing path goes to rootfsimage.Open, a local image name is exported with the runtime to <scratch>/image.tar in its own scratch and opened there; Open is rootfsimage.Open; decides nothing for root file:Open@268,file:Stat@146 5d90d22dd97cb5cc12a1c4d58cebe365e592be325141c545d1bf42a7e98ec58d

diff --git a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv

new file mode 100644

index 000000000..8ebffeb9f

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv

@@ -0,0 +1,17 @@

+# Census overlay rootfs-apps-1, written by census-propose (#369). census-ruling-rootfs-apps-1, approved by the census owner before the merge; the approval card is docs/superpowers/notes/census-proposal-rootfs-apps-1.md.

+# 4 body, 1 sites, 5 envelope: each changed unit re-frozen at its existing disposition with its claim appended.

+@legacy 43d048ddf5ec82c84844d12ad697954bbfba250d3e371aa0dcc67037389d027d cli.go runShipAPI legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: the success lines moved into printAPIShipped, which ship_rootfs.go shares; the same result returned; no read added file:CreateTemp@522,file:Stat@1958 01af3c42c7f108f37abc402aec11bf035a544a73b2e14796a29f97bcf4b2979f

+@legacy ee300133781b7f0e96187f4791e258df4ba7dc3d8e403c5bbc1325e0413a2aea internal/console/apicli.go Server.handleAPIShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added file:ReadAll@11932 2fbe1f40880a35a486b21542afce6e40db56f1df260f5fac57a7bd0e15496d7b

+@legacy 7ec6d86d921e65ea491d2b9aaf36a996abca524daefacb107cab07939c8e5174 internal/hostops/mutation_boundary_putfrom.go conditionalRecordStore.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added file:ReadAll@397 50fef94769c4e4d4c49d72c657ff96b0d49a8fd5f03bca4cedce19f6e5fd0067

+@legacy fc4325af9d68b2b10fecde21cdcaafdb9b6e4abbd688f321e5a1c59b9b9db4ec internal/hostops/mutation_boundary_putfrom.go mutationBoundary.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added file:ReadAll@311 e04f3976e679699e57cb69b4ada1e3af92cdd7ed99ee7a52b0c12252b4473866

+@legacy fecf7d311f638cf2a4eddafd17dd32213692986d03269ec5c90f137340779afa cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added file:ReadFile@7227,file:ReadFile@7451 4a3c3140be83b5ab36f44b7fbfe78c67b4a10bab435b9196a721712c5047f241

+cli.go runShipAPI legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: the success lines moved into printAPIShipped, which ship_rootfs.go shares; the same result returned; no read added file:CreateTemp@522,file:Stat@1958 01af3c42c7f108f37abc402aec11bf035a544a73b2e14796a29f97bcf4b2979f

+internal/console/apicli.go Server.handleAPIShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added file:ReadAll@11932 2fbe1f40880a35a486b21542afce6e40db56f1df260f5fac57a7bd0e15496d7b

+internal/hostops/mutation_boundary_putfrom.go conditionalRecordStore.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added file:ReadAll@397 50fef94769c4e4d4c49d72c657ff96b0d49a8fd5f03bca4cedce19f6e5fd0067

+internal/hostops/mutation_boundary_putfrom.go mutationBoundary.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added file:ReadAll@311 e04f3976e679699e57cb69b4ada1e3af92cdd7ed99ee7a52b0c12252b4473866

+cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added file:ReadFile@7227,file:ReadFile@7451 4a3c3140be83b5ab36f44b7fbfe78c67b4a10bab435b9196a721712c5047f241

+@coverage . 901f60039e4b3e376e411af65e1fdd1a539e886ee11ea7a961b43b3a3a86cb94

+@coverage internal/console 80060e0ef5d5b285df970abc6d5a080bdc6249599f4842d3a00e8e456f60410e

+@coverage internal/hostops 075130a7118bd616dda1b37cf4769837a60af677e645ba0b2fe7d2b995940efb

+@coverage internal/release 99a17e1ad7dd5089bb73f97a43b714303c80c374efba17131f7c6684abec6df0

+@coverage internal/rootfsimage 9091abc01b3ebe57306fb0c4489d0cea972c0aec9298e35f9f219eda17cb8812