amadan
rootfs apps: spec rev 5, JIT opt-in in v1 (R11)
Node aborts at start under MemoryDenyWriteExecute=yes (checked on systemd 257); node --jitless runs. Apps declare jit on rootfs releases; the box renders that release's starts without the line and checks the effective property after start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 files changed,
+49
−8
docs/superpowers/plans/2026-10-24-rootfs-apps-0-index.md+9 −0docs/superpowers/specs/2026-10-24-rootfs-apps-design.md+40 −8
CI passed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok amadan.net/carlos/platform.git/launchctx 0.013s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (1 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (145 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.852s
ok github.com/carlosframework/platform/cmd/moveprobe 12.023s
ok github.com/carlosframework/platform/cmd/zddprobe 0.773s
ok github.com/carlosframework/platform/internal/activator 59.312s
ok github.com/carlosframework/platform/internal/agentsock 0.028s
ok github.com/carlosframework/platform/internal/alerting 0.004s
ok github.com/carlosframework/platform/internal/analytics 0.034s
ok github.com/carlosframework/platform/internal/appconfig 3.106s
ok github.com/carlosframework/platform/internal/apperr 0.135s
ok github.com/carlosframework/platform/internal/applog 0.258s
ok github.com/carlosframework/platform/internal/awsinv 0.004s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.795s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.013s
ok github.com/carlosframework/platform/internal/caps 0.016s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.835s
ok github.com/carlosframework/platform/internal/changelog 0.653s
ok github.com/carlosframework/platform/internal/claimactivation 1.352s
ok github.com/carlosframework/platform/internal/clamd 0.060s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 8.398s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.014s
ok github.com/carlosframework/platform/internal/dbquery 0.008s
ok github.com/carlosframework/platform/internal/dbreads 2.159s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.004s
ok github.com/carlosframework/platform/internal/docsite 0.007s
ok github.com/carlosframework/platform/internal/domains 2.918s
ok github.com/carlosframework/platform/internal/doorkey 0.007s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 45.479s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.013s
ok github.com/carlosframework/platform/internal/fleetapi 0.181s
ok github.com/carlosframework/platform/internal/gate 1.815s
ok github.com/carlosframework/platform/internal/genselect 0.054s
ok github.com/carlosframework/platform/internal/geo 0.019s
ok github.com/carlosframework/platform/internal/geoip 0.074s
ok github.com/carlosframework/platform/internal/historyreadback 0.223s
ok github.com/carlosframework/platform/internal/host 142.608s
ok github.com/carlosframework/platform/internal/hostactors 6.656s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.007s
ok github.com/carlosframework/platform/internal/hostbox 3.247s
ok github.com/carlosframework/platform/internal/hostclaim 0.815s
ok github.com/carlosframework/platform/internal/hostenv 0.008s
ok github.com/carlosframework/platform/internal/hostevidence 0.008s
ok github.com/carlosframework/platform/internal/hostexec 5.514s
ok github.com/carlosframework/platform/internal/hostfence 0.062s
ok github.com/carlosframework/platform/internal/hostfiles 10.373s
ok github.com/carlosframework/platform/internal/hostfloor 0.022s
ok github.com/carlosframework/platform/internal/hostguard 1.044s
ok github.com/carlosframework/platform/internal/hostops 2.224s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.004s
ok github.com/carlosframework/platform/internal/hostquarantine 0.005s
ok github.com/carlosframework/platform/internal/hostrelocate 0.605s
ok github.com/carlosframework/platform/internal/hostresolve 0.229s
ok github.com/carlosframework/platform/internal/hostwrite 0.005s
ok github.com/carlosframework/platform/internal/infraview 0.009s
ok github.com/carlosframework/platform/internal/instancectl 5.245s
ok github.com/carlosframework/platform/internal/instanceexec 2.853s
ok github.com/carlosframework/platform/internal/instancefs 0.006s
ok github.com/carlosframework/platform/internal/instancekey 0.003s
ok github.com/carlosframework/platform/internal/instanceupdates 0.011s
ok github.com/carlosframework/platform/internal/layout 1.956s
ok github.com/carlosframework/platform/internal/lbhealth 0.005s
ok github.com/carlosframework/platform/internal/lease 10.098s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.523s
ok github.com/carlosframework/platform/internal/ledger 0.027s
ok github.com/carlosframework/platform/internal/mail 0.276s
ok github.com/carlosframework/platform/internal/maintenance 0.084s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.626s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.078s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 21.494s
ok github.com/carlosframework/platform/internal/moves/archive 1.106s
ok github.com/carlosframework/platform/internal/objstore 0.281s
ok github.com/carlosframework/platform/internal/ops 0.184s
ok github.com/carlosframework/platform/internal/park 0.281s
ok github.com/carlosframework/platform/internal/plans 0.007s
ok github.com/carlosframework/platform/internal/privatefile 0.005s
ok github.com/carlosframework/platform/internal/provision 14.463s
ok github.com/carlosframework/platform/internal/publicrelease 0.013s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.630s
ok github.com/carlosframework/platform/internal/relay 7.202s
ok github.com/carlosframework/platform/internal/release 25.837s
ok github.com/carlosframework/platform/internal/rollout 3.786s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.060s
ok github.com/carlosframework/platform/internal/rootstate 0.028s
ok github.com/carlosframework/platform/internal/runs 0.532s
ok github.com/carlosframework/platform/internal/s3compat 0.006s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.806s
ok github.com/carlosframework/platform/internal/seeds 0.012s
ok github.com/carlosframework/platform/internal/sim/engines 2.810s
ok github.com/carlosframework/platform/internal/sim/hostlife 11.102s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.922s
ok github.com/carlosframework/platform/internal/status 0.117s
ok github.com/carlosframework/platform/internal/steering 0.010s
ok github.com/carlosframework/platform/internal/stopevidence 0.237s
ok github.com/carlosframework/platform/internal/svcrole 0.003s
ok github.com/carlosframework/platform/internal/telemetry 0.005s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.005s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.005s
ok github.com/carlosframework/platform/internal/usage 0.008s
ok github.com/carlosframework/platform/internal/version 0.003s
ok github.com/carlosframework/platform/internal/vet 1.656s
=== internal_console@0 (82 s)
ok github.com/carlosframework/platform/internal/console 79.754s
=== internal_console@1 (44 s)
ok github.com/carlosframework/platform/internal/console 41.915s
=== internal_console@2 (40 s)
ok github.com/carlosframework/platform/internal/console 38.564s
=== internal_console@3 (40 s)
ok github.com/carlosframework/platform/internal/console 38.227s
=== internal_console@4 (43 s)
ok github.com/carlosframework/platform/internal/console 40.888s
=== internal_console@5 (41 s)
ok github.com/carlosframework/platform/internal/console 38.850s
=== internal_console@6 (36 s)
ok github.com/carlosframework/platform/internal/console 34.462s
=== internal_console@7 (45 s)
ok github.com/carlosframework/platform/internal/console 42.920s
=== root@0 (110 s)
ok github.com/carlosframework/platform 107.977s
=== root@1 (84 s)
ok github.com/carlosframework/platform 82.574s
=== root@2 (92 s)
ok github.com/carlosframework/platform 89.951s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50528418 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.024s
=== RUN TestT4StorageProbeMinio
2026/10/24 18:02:26 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E1892B800BD355, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.022s
=== RUN TestS3StoreMinioContract
=== RUN TestS3StoreMinioContract/conditional_get_and_etag_listing
=== RUN TestS3StoreMinioContract/bump_through_every_mutation_path
--- PASS: TestS3StoreMinioContract (0.03s)
--- PASS: TestS3StoreMinioContract/conditional_get_and_etag_listing (0.01s)
--- PASS: TestS3StoreMinioContract/bump_through_every_mutation_path (0.02s)
PASS
ok github.com/carlosframework/platform/internal/release 0.033s
Bucket created successfully `local/dbf-deploy`.
Bucket created successfully `local/dbf-data-ie`.
Bucket created successfully `local/dbf-data-uk`.
local/dbf-deploy versioning is enabled
Created policy `dbf-console` successfully.
Created policy `dbf-ukbox` successfully.
Added user `dbfconsole` successfully.
Added user `dbfukbox` successfully.
Attached Policies: [dbf-console]
To User: dbfconsole
Attached Policies: [dbf-ukbox]
To User: dbfukbox
=== RUN TestDBForwardMinio
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 18:02:29 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 18:02:29 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 18:02:29 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 18:02:29 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 18:02:29 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/24 18:02:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 18:02:29 console: could not notify member@example.com of a CLI token issue: keymail: lookup member@example.com: keymail: GET /api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A44471: could not determine target mailbox
agent.go:135: dbreads: dbr_kqkfgbhxcs6pxutlhdnvuyvfyi: planned 3 files (1544 bytes) and restored to 3 in 10ms
agent.go:135: dbreads: dbr_kqkfgbhxcs6pxutlhdnvuyvfyi: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:02:30 console: db read dbr_kqkfgbhxcs6pxutlhdnvuyvfyi: relayed 1 chunks (102 bytes) in 1.004s, ended done
agent.go:135: dbreads: dbr_ee63tkg5xyxkstrtynfg3a2o3i: planned 1 files (720 bytes) and restored to 1 in 8ms
agent.go:135: dbreads: dbr_ee63tkg5xyxkstrtynfg3a2o3i: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:02:31 console: db read dbr_ee63tkg5xyxkstrtynfg3a2o3i: relayed 1 chunks (102 bytes) in 1.003s, ended done
agent.go:135: dbreads: dbr_fexsqlr6cdpyeecimf6ihduv24: planned 3 files (1544 bytes) and held through 3 in 10ms
agent.go:135: dbreads: dbr_fexsqlr6cdpyeecimf6ihduv24: output 1544 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:02:32 console: db read dbr_fexsqlr6cdpyeecimf6ihduv24: relayed 1 chunks (1641 bytes) in 1.003s, ended done
=== RUN TestDBForwardMinio/by_disconnect
=== NAME TestDBForwardMinio
agent.go:135: dbreads: dbr_b4zfskory4rlbjtufemixklm4u: planned 3 files (1544 bytes) and restored to 3 in 9ms
2026/10/24 18:02:32 console: db read dbr_b4zfskory4rlbjtufemixklm4u: relayed 0 chunks (0 bytes) in 14ms, ended client gone
agent.go:135: dbreads: dbr_b4zfskory4rlbjtufemixklm4u: output 5 bytes in 1 confirmed chunks in 27ms
=== RUN TestDBForwardMinio/by_timeout
=== NAME TestDBForwardMinio
agent.go:135: dbreads: dbr_a5ni6lysgxci4pvgouwtw3v5w4: planned 3 files (1544 bytes) and restored to 3 in 9ms
2026/10/24 18:02:52 console: db read dbr_a5ni6lysgxci4pvgouwtw3v5w4: relayed 0 chunks (0 bytes) in 19.717s, ended no-result
agent.go:135: dbreads: dbr_a5ni6lysgxci4pvgouwtw3v5w4: output 5 bytes in 1 confirmed chunks in 19.702s
--- PASS: TestDBForwardMinio (23.08s)
--- PASS: TestDBForwardMinio/by_disconnect (0.15s)
--- PASS: TestDBForwardMinio/by_timeout (19.83s)
PASS
ok github.com/carlosframework/platform/internal/console 23.094s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-24-rootfs-apps-0-index.md b/docs/superpowers/plans/2026-10-24-rootfs-apps-0-index.md| index ed44cb0e7..3cb0594a1 100644 |
| --- a/docs/superpowers/plans/2026-10-24-rootfs-apps-0-index.md |
| +++ b/docs/superpowers/plans/2026-10-24-rootfs-apps-0-index.md |
| @@ -216,6 +216,15 @@ code stops and records the problem at the top of its own file under |
| ## Paul's rulings after the spec (2026-10-24; do not reopen) |
| - **R7. `carlos run` on fleet boxes is carried over Plan 6's box-dials-the-console door.** The box dials the console per run on a signed grant, and the console makes the record and `runs/` writes the store door refuses a fleet box (Plan 6 Task 16, which also removes the fleet arm of `runClassRefusal`). Until it lands, Plan 3 keeps `carlos run` refused on fleet boxes, with today's sentence. Plan 4's sample and dev-fleet checklist never depend on `carlos run` on a fleet box for spec §6 step 1. |
| +- **R11. JIT opt-in in v1** (Paul, 2026-10-24; spec rev 5 §5.11, C10). |
| + Manifest field `JIT bool \`json:"jit,omitempty"\`` on rootfs releases |
| + only (Plan 1: type, validation, ship door, `--check` warning for |
| + Node/Bun/Deno images without it). The control service reads it from the |
| + root-staged manifest and renders the start without |
| + `MemoryDenyWriteExecute` (a per-start drop-in, the same mechanism as the |
| + gen and worker drop-ins), then checks the effective property after start |
| + and stops on mismatch (Plan 2). Plan 4's docs add a Node note. No record |
| + or route field: it is per release. |
| - **R8. Who grants egress.** The account that owns a fleet grants egress for its own apps on its own fleet boxes, and within that account **owners only** (Paul, 2026-10-24; members cannot grant or widen a grant); on a single-tenant deployment the platform operator grants (Plan 5 F3, Task 8). The box's `OwnBoxAllowed` is unchanged and still decides where a grant may open anything. |
| - **R9. Rootfs instances default to the 1 GB tier** (`cgroup.TierChildren`), not 512 MB. Plan 2 owns the tier selection (`rootfsTier`, `GenTier`); Plan 1's `--check` limits memory to it; Plan 4's docs say 1 GB. |
| - **R10. The dev e2e box.** A new `t4g.small` (arm64) in the dev account (AWS profile `kass`, eu-west-1), as a fleet box, plus its fleet token and a `carlos store` bucket and IAM user, deleted after the checks. Approved by Paul 2026-10-24 for Plan 2 Task 10 and Plan 4 Task 11, which cite it. Any change in account, region, resource type, cost or duration needs a fresh approval; Plans 5 and 6's dev checks are not covered by it. |
diff --git a/docs/superpowers/specs/2026-10-24-rootfs-apps-design.md b/docs/superpowers/specs/2026-10-24-rootfs-apps-design.md| index 990e12a3f..a2ceefc89 100644 |
| --- a/docs/superpowers/specs/2026-10-24-rootfs-apps-design.md |
| +++ b/docs/superpowers/specs/2026-10-24-rootfs-apps-design.md |
| @@ -1,14 +1,16 @@ |
| # Rootfs apps: run any Linux app on your own boxes, isolated like a CARLOS instance |
| **Date:** 2026-10-24 |
| -**Revision:** 4. Draft from a brainstorming session with Paul, 2026-10-24. |
| +**Revision:** 5. Draft from a brainstorming session with Paul, 2026-10-24. |
| Rev 2 answers Astra's builder check (`CODEX-FINDINGS-ROOTFS-APPS-R1.md`, |
| six questions): §5.0 is new, §5.6 and §5.7 are narrowed, §5.2 settles |
| deploy overlap. Marked **(B1-n)**. Rev 3 adds the `release` process |
| (§5.2.1, Paul: "Perfect"), makes `carlos run` part of v1 (§5.5) and adds |
| interactive sessions (§5.10). Rev 4: `carlos console` as a declared |
| shorthand (§5.10), and Q1 answered: stateless replicas land before |
| -step 3 (§6, §13). |
| +step 3 (§6, §13). Rev 5: the JIT opt-in moves into v1 (R11, §5.11), |
| +because Node aborts at start under `MemoryDenyWriteExecute=yes` (checked on |
| +systemd 257: plain `node` aborts, `node --jitless` runs). |
| **Discussion:** amadan carlos/platform #366. |
| **Base:** origin/main 64a002c8. |
| @@ -65,10 +67,6 @@ the artifact, the launch contract and a few lifecycle pieces. |
| the sample app does that (§6.1). |
| - **Building on the platform.** The platform never builds, never pulls |
| from a registry and never runs Docker. |
| -- **JIT runtimes.** `MemoryDenyWriteExecute=yes` stays. Ruby's YJIT, |
| - PHP's opcache JIT, V8 and the JVM's JIT need writable and executable |
| - memory. Ruby, PHP and Python run without a JIT. A capability that |
| - drops this one line is deferred (§12). |
| - **Free hosted trials.** Testing is free on the developer's machine |
| (G5). Carloku does not run trial boxes. |
| @@ -100,6 +98,10 @@ the artifact, the launch contract and a few lifecycle pieces. |
| processes. |
| - **R5. Always-on by default.** "Hibernating Rails apps suck anyway with |
| that long wake-from-sleep." Hibernation stays available as an opt-in. |
| +- **R11. JIT opt-in in v1** (Paul, 2026-10-24). An app may declare that |
| + it needs a JIT; its processes then run without |
| + `MemoryDenyWriteExecute`. Node, Bun, Deno, Ruby's YJIT and the JVM need |
| + it. §5.11. |
| - **R6. Language-neutral.** The design names Rails as the first case and |
| must work for PHP (Laravel, FrankenPHP), Django and similar. |
| @@ -539,6 +541,35 @@ interactive session needs a live, two-way stream with a terminal. |
| - Not required for step 1 of §6. Required before step 4: a team leaving |
| Kubernetes uses `kubectl exec -it ... rails console` and will miss it. |
| +### 5.11 The JIT opt-in (R11) |
| + |
| +- **Why.** V8 (Node, Deno), JavaScriptCore (Bun), YJIT, opcache's JIT |
| + and the JVM write machine code into memory and then make it |
| + executable. `MemoryDenyWriteExecute=yes` forbids that; Node aborts at |
| + start. `node --jitless` runs, interpreted only and without |
| + WebAssembly, which is not a product. |
| +- **Declaration.** The release manifest carries `"jit": true` (rootfs |
| + releases only; refused on binary releases in v1). It is per release: |
| + changing it between releases is an ordinary deploy, because nothing |
| + about the instance's data or placement depends on it. |
| +- **Effect.** Every process of that release (web, workers, release, |
| + console, `carlos run`, interactive sessions) runs without |
| + `MemoryDenyWriteExecute`. Nothing else in the namespace block changes: |
| + same mounts, same capability set (empty), `NoNewPrivileges`, the same |
| + egress fence, tier and slice. |
| +- **Who decides.** The box reads `jit` from the root-staged manifest of |
| + the release it is starting, never from tenant config or the record. |
| +- **Where.** Only where rootfs apps run at all (R1): the customer's own |
| + boxes. A JIT app weakens nothing for anyone else. |
| +- **Proof.** After each start the control service checks the unit's |
| + effective `MemoryDenyWriteExecute` matches the release's `jit` value, |
| + and stops the unit if it does not, as it checks `ControlGroup` for C5. |
| + The rootfs probe keeps proving the line is present by default. |
| +- **`carlos ship --check`** runs JIT apps the same way it runs others |
| + (local container runtimes do not apply that filter); it warns when an |
| + image looks like Node, Bun or Deno and the manifest does not declare |
| + `jit`, because it will pass locally and abort on the box. |
| + |
| ## 6. Order of work |
| 1. **A Rails 8 sample app on a Carloku fleet box.** SQLite with Solid |
| @@ -583,6 +614,9 @@ interactive session needs a live, two-way stream with a terminal. |
| - C9. An interactive session runs inside the instance's namespace and |
| slice like every other process of the instance (C5), and is refused |
| unless the app allows it. |
| +- C10. Only a release that declares `jit` runs without |
| + `MemoryDenyWriteExecute`, and the effective unit property is checked |
| + after every start. |
| - C7. One writer still holds: one box runs a given instance, under the |
| lease, always-on or not. |
| @@ -664,8 +698,6 @@ resource IDs. Managed databases are the customer's choice of endpoint. |
| rootfs apps that declare no local database, and existing binary apps |
| that keep all their state in S3 with compare-and-swap. Region HA's dormant load-balancer health answer |
| and private forwarding are a starting point. |
| -- **JIT opt-in**: a capability that drops `MemoryDenyWriteExecute` for |
| - one app, on its own boxes only. |
| - **More than one SQLite file per instance**. |
| - **Rootfs on shared boxes**, once the variant has earned trust. |