amadan
Isolated exec brief: round 2 instructions
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ1ZvWj7naf73GjTX8MBv5
1 file changed,
+41
−17
docs/superpowers/specs/CODEX-REVIEW-BRIEF-ISOLATED-EXEC.md+41 −17
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-ISOLATED-EXEC.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-ISOLATED-EXEC.md| index 78d245b88..3211c58c6 100644 |
| --- a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-ISOLATED-EXEC.md |
| +++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-ISOLATED-EXEC.md |
| @@ -60,31 +60,55 @@ output is a findings report, not an edit. Do not modify any file. |
| instance, and which `systemctl` verbs an unprivileged caller may run |
| without polkit. |
| +## Rounds after the first |
| + |
| +From round 2 on, the prior rounds' findings files |
| +(`CODEX-FINDINGS-ISOLATED-EXEC.md`, then `-R2.md`, ...) are committed |
| +beside the spec, and the spec's §13 records how each finding was |
| +taken. **Start your report with a disposition table**: one row per |
| +prior finding, stating whether the revision resolves it, resolves it |
| +partially (say what is missing), or does not resolve it. Then report |
| +only findings that are new in this revision, numbered `R<n>-1` onward |
| +for the current round. Do not repeat a resolved finding; do not |
| +re-argue a ruling. |
| + |
| ## Decisions already taken (report a mechanism that fails one; do not re-argue one) |
| - Paul approved approach 3 on 2026-09-11: the activator keeps ownership; |
| the process becomes a systemd template unit; still uid `carlos`; |
| namespace isolation; no console change; migration by rename. |
| - Approaches 1 and 2 (spec §12) are rejected. |
| +- Ruled with codex R1-1 (2026-09-11): the root channel is the |
| + `carlos-instance-control` service with a bearer token; polkit is not |
| + installed and not relied on. Report a way the token or the channel |
| + fails; do not re-open the polkit comparison. |
| -## The one decision that is open, and yours to advise on |
| - |
| -§5.4: the root channel is either the `carlos-instance-control` service |
| -(a root, socket-activated HTTP-over-unix server with four verbs) or a |
| -polkit rules grant that lets uid `carlos` run the `systemctl` verbs it |
| -already issues. The spec's author advises the control service and gives |
| -four reasons. **Advise for or against, with reasons, as a numbered |
| -finding.** In particular: |
| +## Things to check hard in revision 2 |
| -- find any way an instance inside the §4.1 namespace can reach |
| - `/run/carlos/instance-control.sock`, or make the agent send a request |
| - it did not intend (the agent composes requests from registry rows and |
| - manifests; consider what a tenant controls in those); |
| -- say whether a polkit rules file can express "start, stop, reset-failed |
| - and set-property on `carlos-instance*@*.service` only", and what |
| - installing polkit on the box image would cost; |
| -- say whether `systemctl set-property --runtime` on a template instance |
| - that has never been started behaves as §5.3 assumes. |
| +- **`nosymfollow` (§3.2).** Does a bind mount of a directory onto itself |
| + with `nosymfollow` hold for lookups through the covering mount from |
| + the agent's namespace, and through systemd's `BindPaths=` bind inside |
| + the instance's namespace? Is there any path the agent, the edge, PID 1 |
| + (`StandardOutput=file:`) or litestream resolves under the instance |
| + trees that is not on that mount? Is the `openat2` helper redundant, |
| + insufficient, or wrong in any flag? |
| +- **The token (§5.4).** Where does it live, who writes it, who reads it, |
| + and can an instance obtain it or cause the agent to present it on the |
| + instance's behalf? |
| +- **Exit observation (§6.5).** `cgroup.events` inotify semantics for |
| + `populated`; the invocation id match; the fallback poll; what happens |
| + to a proc whose unit is restarted by something other than the agent. |
| +- **Slices (§4.3).** `Slice=carlos-instances-%i.slice` from a template |
| + with an escaped instance name; on-demand slice creation; |
| + `set-property --runtime` on a slice that does not exist yet; whether |
| + moving the edge into `carlos.slice` keeps the 2026-08-28 wall's |
| + semantics. |
| +- **The fence (§8.1) and the reverse migration (§8.3).** Every consumer |
| + that must honour the marker; the recovery table; the "two databases" |
| + refusal; what `carlos system rollback` does today and whether a leg |
| + can be added before the binary swap. |
| +- **The probe and the gate (§8.4).** Can the probe pass while an instance |
| + would not be isolated? Can it fail while instances would be? |
| ## What matters most |