amadan
merge review: pin Delegate= in the unit test; the monitoring spec names the third scan root
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2 files changed,
+21
−0
docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md+8 −0internal/host/host_test.go+13 −0
diff --git a/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md b/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md| index f2c37a17b..8acc6e523 100644 |
| --- a/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md |
| +++ b/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md |
| @@ -46,6 +46,14 @@ cgroup v2 files, never `ps` scraping: |
| Discovery therefore scans the top level of `system.slice` **and** one |
| level down inside each `system-*.slice` child; a top-level-only scan |
| finds every platform unit and no tenant at all. |
| + **Amended 2026-08-08 (exec-child accounting, |
| + `2026-08-07-exec-child-accounting-design.md`):** a third scan root was |
| + added — the subtree systemd delegates to `carlos-edge.service`, where |
| + exec-backed instances (children of the agent, no unit of their own) are |
| + accounted in per-host `carlos-exec@<host>` cgroups. Those keys are |
| + deliberately not `.service` names: no such units exist. Member-less |
| + dirs are skipped (absence is the data), and a box without delegation |
| + simply has no third root. |
| - Per unit: CPU fraction (`cpu.stat` usage_usec delta over wall clock), |
| `memory.current`, `memory.peak`, and cumulative read/write bytes from |
| `io.stat`. |
diff --git a/internal/host/host_test.go b/internal/host/host_test.go| index 52c7d1a4e..f7b844a10 100644 |
| --- a/internal/host/host_test.go |
| +++ b/internal/host/host_test.go |
| @@ -116,11 +116,24 @@ func TestBootstrapWritesUnitsToStagingDir(t *testing.T) { |
| "SystemCallFilter=@system-service", |
| "User=carlos", |
| "Restart=always", |
| + // Delegation is the SOLE mechanism behind exec-instance readings |
| + // fleet-wide (exec-child accounting spec): without it the agent's |
| + // cgroup manager degrades to nil and every exec-backed tenant goes |
| + // blind on the Instances page. |
| + "Delegate=cpu memory io pids", |
| } { |
| if !strings.Contains(string(edge), want) { |
| t.Errorf("carlos-edge.service: missing %q", want) |
| } |
| } |
| + // The counterpart of Delegate=: ProtectControlGroups would mount the |
| + // cgroup tree read-only and silently un-arm delegation. Its hardening is |
| + // retained by ownership (DAC) instead — see the unit file's comment. A |
| + // future "hardening cleanup" that re-adds it must fail here, not on the |
| + // fleet. |
| + if strings.Contains(string(edge), "ProtectControlGroups=") { |
| + t.Error("carlos-edge.service: the ProtectControlGroups= directive is deliberately absent (Delegate= needs the subtree writable); do not re-add it") |
| + } |
| // The tenant socket unit: systemd owns the listener as carlos so the |
| // edge can connect and tenants can't reach each other (the whole point). |