amadan
provision: root-read census overlay for the placement shim (census ruling zddr3, #272)
Adds the zddr3 overlay: the exec shim's and VerifyPlacement's reads as accepted-legacy rows, three refreshed legacy rows, and census-ruling removals of placementLive and Manager.startIn. The legacy seal is re-pinned beside the zddr3 load. Narrow format changes: - An @removed row owned by H3 loads only when its basis starts with census-ruling-; H3 is still never a kept owner for an authority, hint or diagnostic row. - A still-declared unit may be retired only by an H3 census-ruling- removal, and only when the current scan finds no reads in it. The basis text is never evidence. Every other removal of a still-declared or still-classified unit fails as before, and a retired unit that reads again is an unclassified root read. rev3=census-ruling-zddr3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 files changed,
+208
−2
internal/cgroup/shim_linux.go+10 −0internal/provision/plan14_legacy_identity_test.go+54 −0internal/provision/plan14_root_reads_test.go+103 −2internal/provision/testdata/plan14-root-reads-zddr3.tsv+41 −0
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 342.055s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.105s
ok github.com/carlosframework/platform/cmd/moveprobe 92.214s
ok github.com/carlosframework/platform/cmd/zddprobe 0.383s
ok github.com/carlosframework/platform/internal/activator 227.795s
ok github.com/carlosframework/platform/internal/agentsock 0.022s
ok github.com/carlosframework/platform/internal/alerting 0.005s
ok github.com/carlosframework/platform/internal/analytics 0.020s
ok github.com/carlosframework/platform/internal/appconfig 2.296s
ok github.com/carlosframework/platform/internal/apperr 0.074s
ok github.com/carlosframework/platform/internal/applog 0.129s
ok github.com/carlosframework/platform/internal/awsinv 0.004s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.886s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.010s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.694s
ok github.com/carlosframework/platform/internal/changelog 0.299s
ok github.com/carlosframework/platform/internal/clamd 0.054s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 363.595s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 6.438s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.011s
ok github.com/carlosframework/platform/internal/dbverify 0.005s
ok github.com/carlosframework/platform/internal/dnsrec 0.004s
ok github.com/carlosframework/platform/internal/docsite 0.005s
ok github.com/carlosframework/platform/internal/domains 2.127s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 26.154s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.009s
ok github.com/carlosframework/platform/internal/fleetapi 0.126s
ok github.com/carlosframework/platform/internal/gate 1.657s
ok github.com/carlosframework/platform/internal/genselect 0.021s
ok github.com/carlosframework/platform/internal/geo 0.013s
ok github.com/carlosframework/platform/internal/geoip 0.034s
ok github.com/carlosframework/platform/internal/host 96.157s
ok github.com/carlosframework/platform/internal/hostactors 0.472s
ok github.com/carlosframework/platform/internal/hostbox 2.149s
ok github.com/carlosframework/platform/internal/hostclaim 0.499s
ok github.com/carlosframework/platform/internal/hostevidence 0.012s
ok github.com/carlosframework/platform/internal/hostexec 4.686s
ok github.com/carlosframework/platform/internal/hostfence 0.036s
ok github.com/carlosframework/platform/internal/hostfiles 10.436s
ok github.com/carlosframework/platform/internal/hostfloor 0.012s
ok github.com/carlosframework/platform/internal/hostguard 1.004s
ok github.com/carlosframework/platform/internal/hostops 1.433s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.014s
ok github.com/carlosframework/platform/internal/hostquarantine 0.012s
ok github.com/carlosframework/platform/internal/hostrelocate 0.467s
ok github.com/carlosframework/platform/internal/hostresolve 0.141s
ok github.com/carlosframework/platform/internal/hostwrite 0.013s
ok github.com/carlosframework/platform/internal/infraview 0.012s
ok github.com/carlosframework/platform/internal/instancectl 1.819s
ok github.com/carlosframework/platform/internal/instanceexec 2.719s
ok github.com/carlosframework/platform/internal/instancefs 0.017s
ok github.com/carlosframework/platform/internal/instancekey 0.014s
ok github.com/carlosframework/platform/internal/instanceupdates 0.018s
ok github.com/carlosframework/platform/internal/layout 1.418s
ok github.com/carlosframework/platform/internal/lease 9.444s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.019s
ok github.com/carlosframework/platform/internal/ledger 0.025s
ok github.com/carlosframework/platform/internal/mail 0.181s
ok github.com/carlosframework/platform/internal/maintenance 0.086s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.515s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.071s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 20.936s
ok github.com/carlosframework/platform/internal/moves/archive 0.741s
ok github.com/carlosframework/platform/internal/objstore 0.183s
ok github.com/carlosframework/platform/internal/ops 0.164s
ok github.com/carlosframework/platform/internal/park 0.204s
ok github.com/carlosframework/platform/internal/privatefile 0.008s
ok github.com/carlosframework/platform/internal/provision 11.981s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 3.981s
ok github.com/carlosframework/platform/internal/relay 7.229s
ok github.com/carlosframework/platform/internal/release 19.937s
ok github.com/carlosframework/platform/internal/rollout 3.620s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.006s
ok github.com/carlosframework/platform/internal/rootparticipation 0.008s
ok github.com/carlosframework/platform/internal/rootstate 0.025s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.275s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.015s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.906s
ok github.com/carlosframework/platform/internal/status 0.042s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.298s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.006s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.549s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
minio: downloaded, digest verified
mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
mc: downloaded, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.022s
=== RUN TestT4StorageProbeMinio
2026/10/13 17:51:21 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DE282E7FD6B25A, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.021s
minio contract: PASS
diff --git a/internal/cgroup/shim_linux.go b/internal/cgroup/shim_linux.go| index f35f7214e..ec66620ed 100644 |
| --- a/internal/cgroup/shim_linux.go |
| +++ b/internal/cgroup/shim_linux.go |
| @@ -381,6 +381,16 @@ func parseShimErr(line string) (op string, errno int, ok bool) { |
| // fds, which are keep, keep+1 and keep+2. It writes nothing to fds 0 to 2. |
| // A failure before placement is confirmed writes "P <step>: <error>" and |
| // returns 125; tenant code has not run. |
| +// |
| +// Plan 14 root-read census, census ruling zddr3: the shim, its probe and |
| +// the parent-side start read only |
| +// |
| +// the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos |
| +// |
| +// On that basis their reads are accepted-legacy rows |
| +// (internal/provision/testdata/plan14-root-reads-zddr3.tsv). If the shim |
| +// ever runs as root, or reads anything outside that boundary, it stops |
| +// being legacy and needs the Plan 14 owner's ruling. |
| func runShim(args []string) int { |
| if len(args) != 3 { |
| return 125 |
diff --git a/internal/provision/plan14_legacy_identity_test.go b/internal/provision/plan14_legacy_identity_test.go| index f96fea929..c0d52099d 100644 |
| --- a/internal/provision/plan14_legacy_identity_test.go |
| +++ b/internal/provision/plan14_legacy_identity_test.go |
| @@ -194,3 +194,57 @@ func TestPlan14Fix5OverlayPreservesLegacySeal(t *testing.T) { |
| t.Fatal("unexpected legacy seal", seal) |
| } |
| } |
| + |
| +// Census ruling zddr3 (#272): the placement shim's overlay, loaded after fix6. |
| +func TestPlan14Zddr3OverlayPreservesLegacySeal(t *testing.T) { |
| + root := censusRoot(t) |
| + inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}} |
| + for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv"} { |
| + if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil { |
| + t.Fatal(err) |
| + } |
| + } |
| + if errs := checkRootReadLegacy(inv, "65dba959f80cc47e9fd99be145ba8b24bb3b37ffaf77b47d1b9cc3e01da14b47"); len(errs) != 0 { |
| + t.Fatal(errs) |
| + } |
| + original := make(map[string]bool, len(inv.Legacy)) |
| + for hash := range inv.Legacy { |
| + original[hash] = true |
| + } |
| + if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-zddr3.tsv", &inv, true); err != nil { |
| + t.Fatal(err) |
| + } |
| + for hash := range original { |
| + if !inv.Legacy[hash] { |
| + t.Fatalf("zddr3 removed original freeze %s", hash) |
| + } |
| + } |
| + if len(inv.Legacy) != len(original)+13 { |
| + t.Fatal("census ruling zddr3 permits exactly thirteen new frozen declarations") |
| + } |
| + // Census ruling zddr3 seal: ten shim and VerifyPlacement rows plus three |
| + // refreshed legacy rows (openCleanupAt, StartWorkerStaged, spawnChildFrom). |
| + const seal = "c748e02bfe907a009ef42eb544b1a44fe813f4f7c13e454be3980aec4fade568" |
| + if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 { |
| + t.Fatal(errs) |
| + } |
| + for key, e := range inv.Entries { |
| + if strings.HasPrefix(key, "internal/cgroup/shim_linux.go:") || strings.HasPrefix(key, "internal/cgroup/verify_linux.go:") { |
| + if e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-zddr3;") { |
| + t.Fatalf("wrong zddr3 disposition: %+v", e) |
| + } |
| + } |
| + } |
| + for _, key := range []string{"internal/cgroup/cgroup_linux.go:placementLive", "internal/cgroup/cgroup.go:Manager.startIn"} { |
| + if !strings.HasPrefix(inv.Removed[key], "H3;census-ruling-zddr3: ") { |
| + t.Fatalf("%s lost its census-ruling removal", key) |
| + } |
| + if _, present := inv.Entries[key]; present { |
| + t.Fatalf("%s still classified", key) |
| + } |
| + } |
| + inv.Legacy[strings.Repeat("0", 64)] = true |
| + if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 { |
| + t.Fatal("unapproved legacy fingerprint accepted") |
| + } |
| +} |
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go| index 4f2a404c4..e51bd4792 100644 |
| --- a/internal/provision/plan14_root_reads_test.go |
| +++ b/internal/provision/plan14_root_reads_test.go |
| @@ -16,6 +16,7 @@ import ( |
| "os" |
| "os/exec" |
| "path/filepath" |
| + "reflect" |
| "sort" |
| "strings" |
| "testing" |
| @@ -436,7 +437,11 @@ func loadRootReadInventory(path string, inv *rootReadInventory, delta bool) erro |
| } |
| inv.Legacy[col[1]] = true |
| case "@removed": |
| - if len(col) != 5 || !rootReadKeptTask(col[3]) || strings.TrimSpace(col[4]) == "" { |
| + // H3 may own a removal only under a recorded census ruling (census |
| + // ruling zddr3); it never becomes a kept owner for an authority, |
| + // hint or diagnostic row, so rootReadKeptTask stays unchanged. |
| + owned := rootReadKeptTask(col[3]) || (len(col) == 5 && col[3] == "H3" && strings.HasPrefix(col[4], "census-ruling-")) |
| + if len(col) != 5 || !owned || strings.TrimSpace(col[4]) == "" { |
| return fmt.Errorf("%s:%d: removal needs owner and basis", path, i+1) |
| } |
| key = col[1] + ":" + col[2] |
| @@ -640,6 +645,12 @@ func TestPlan14RootReadCensus(t *testing.T) { |
| if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-fix6.tsv"), &inv, true); err != nil { |
| t.Fatal(err) |
| } |
| + if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-zddr3.tsv"), &inv, true); err != nil { |
| + t.Fatal(err) |
| + } |
| + // Census ruling zddr3 (#272): the exec shim's accepted-legacy rows and the |
| + // three refreshed legacy rows add thirteen frozen declarations. |
| + seal = "c748e02bfe907a009ef42eb544b1a44fe813f4f7c13e454be3980aec4fade568" |
| errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...) |
| errs = append(errs, checkRootReadDeclarations(got, inv)...) |
| if len(errs) > 0 { |
| @@ -685,6 +696,82 @@ func TestPlan14RootReadCensusRejectsDrift(t *testing.T) { |
| } |
| } |
| +// Census ruling zddr3: H3 owns a removal only with a census-ruling basis, |
| +// and never owns an authority row. |
| +func TestPlan14RemovedH3NeedsCensusRuling(t *testing.T) { |
| + for name, tc := range map[string]struct { |
| + row string |
| + load bool |
| + }{ |
| + "ruling": {"@removed\tinternal/cgroup/cgroup.go\tManager.startIn\tH3\tcensus-ruling-zddr3: placement moved into the shim.", true}, |
| + "no ruling": {"@removed\tinternal/cgroup/cgroup.go\tManager.startIn\tH3\tplacement moved into the shim.", false}, |
| + "inner": {"@removed\tinternal/cgroup/cgroup.go\tManager.startIn\tH3\tsee census-ruling-zddr3", false}, |
| + "authority": {"internal/cgroup/cgroup.go\tManager.startIn\tauthority\tH3\tcensus-ruling-zddr3\tfile:Open@1\t" + strings.Repeat("a", 64), false}, |
| + "other owner": {"@removed\tinternal/cgroup/cgroup.go\tManager.startIn\tH4\tcensus-ruling-zddr3: placement moved into the shim.", false}, |
| + } { |
| + t.Run(name, func(t *testing.T) { |
| + path := filepath.Join(t.TempDir(), "overlay.tsv") |
| + if err := os.WriteFile(path, []byte(tc.row+"\n"), 0o644); err != nil { |
| + t.Fatal(err) |
| + } |
| + inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}} |
| + err := loadRootReadInventory(path, &inv, true) |
| + if tc.load && err != nil { |
| + t.Fatal(err) |
| + } |
| + if !tc.load && err == nil { |
| + t.Fatal("row loaded without a census-ruling basis or kept owner") |
| + } |
| + }) |
| + } |
| +} |
| + |
| +// Census ruling zddr3: an H3 census-ruling removal retires a still-declared |
| +// unit only while the scan finds no read in it. Every other removal of a |
| +// still-declared unit fails as before, and a retired unit that reads again |
| +// is an unclassified root read that needs a fresh classification. |
| +func TestPlan14RetiredDeclarationNeedsNoReads(t *testing.T) { |
| + e := classifiedRootRead{rootReadEntry: rootReadEntry{File: "internal/cgroup/cgroup.go", Unit: "Manager.startIn", Kinds: "file:Open@40", Digest: strings.Repeat("a", 64)}, Class: "legacy", Task: "accepted-legacy", Basis: "accepted-legacy;rev3=J1;basis=placement"} |
| + key := e.File + ":" + e.Unit |
| + body := strings.Repeat("b", 64) |
| + inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}, Legacy: map[string]bool{rootReadLegacyFingerprint(e): true}, Frozen: map[string]classifiedRootRead{key: e}, Removed: map[string]string{key: "H3;census-ruling-zddr3: no longer reads"}} |
| + present := []string{"removed legacy declaration still present " + key} |
| + |
| + // Still declared, no reads: retired. |
| + quiet := rootReadScan{Declarations: map[string]string{key: body}} |
| + if errs := checkRootReadDeclarations(quiet, inv); len(errs) != 0 { |
| + t.Fatal(errs) |
| + } |
| + if errs := compareRootReads(quiet, inv); len(errs) != 0 { |
| + t.Fatal(errs) |
| + } |
| + |
| + // (a) Still declared and still reading: the census-ruling basis does not help. |
| + reading := rootReadScan{Entries: []rootReadEntry{{File: e.File, Unit: e.Unit, Kinds: "file:Open@40", Digest: body}}, Declarations: map[string]string{key: body}} |
| + if errs := checkRootReadDeclarations(reading, inv); !reflect.DeepEqual(errs, present) { |
| + t.Fatalf("retired unit with reads: %v", errs) |
| + } |
| + // Re-reading: the retired entry gives no silent pass. |
| + if errs := compareRootReads(reading, inv); !reflect.DeepEqual(errs, []string{"unclassified root read " + key + " file:Open@40"}) { |
| + t.Fatalf("retired unit reading again: %v", errs) |
| + } |
| + |
| + // (b) Any removal that is not H3 with a census-ruling basis fails as before. |
| + for _, removal := range []string{"C; removed obsolete delegate after reviewed root authority conversion", "E4;census-ruling-zddr3: no longer reads", "H3;no longer reads", "H3; census-ruling-zddr3: no longer reads"} { |
| + inv.Removed[key] = removal |
| + if errs := checkRootReadDeclarations(quiet, inv); !reflect.DeepEqual(errs, present) { |
| + t.Fatalf("%q retired a still-declared unit: %v", removal, errs) |
| + } |
| + } |
| + |
| + // Still classified: fails even with no reads. |
| + inv.Removed[key] = "H3;census-ruling-zddr3: no longer reads" |
| + inv.Entries[key] = e |
| + if errs := checkRootReadDeclarations(quiet, inv); !reflect.DeepEqual(errs, present) { |
| + t.Fatalf("classified unit retired: %v", errs) |
| + } |
| +} |
| + |
| func TestPlan14LegacyFreezeRequiresReclassification(t *testing.T) { |
| e := classifiedRootRead{rootReadEntry: rootReadEntry{File: "internal/host/old.go", Unit: "oldRootRead", Kinds: "registry:Unit@10", Digest: strings.Repeat("a", 64)}, Class: "legacy", Task: "accepted-legacy", Basis: "accepted-legacy;rev3=J1;basis=root-route"} |
| key := e.File + ":" + e.Unit |
| @@ -744,7 +831,11 @@ func checkRootReadDeclarations(scan rootReadScan, inv rootReadInventory) []strin |
| current, classified := inv.Entries[key] |
| removal := inv.Removed[key] |
| if removal != "" { |
| - if exists || classified { |
| + // Census ruling zddr3: an H3 census-ruling removal may retire a |
| + // unit that is still declared only when this scan finds no read in |
| + // it. The basis text is never evidence; the scan is. |
| + retired := exists && strings.HasPrefix(removal, "H3;census-ruling-") && !rootReadScanned(scan, key) |
| + if (exists && !retired) || classified { |
| errs = append(errs, "removed legacy declaration still present "+key) |
| } |
| continue |
| @@ -768,3 +859,13 @@ func checkRootReadDeclarations(scan rootReadScan, inv rootReadInventory) []strin |
| sort.Strings(errs) |
| return errs |
| } |
| + |
| +// rootReadScanned reports whether the scan has a read entry for the unit. |
| +func rootReadScanned(scan rootReadScan, key string) bool { |
| + for _, e := range scan.Entries { |
| + if e.File+":"+e.Unit == key { |
| + return true |
| + } |
| + } |
| + return false |
| +} |
diff --git a/internal/provision/testdata/plan14-root-reads-zddr3.tsv b/internal/provision/testdata/plan14-root-reads-zddr3.tsv| new file mode 100644 |
| index 000000000..5e3d78289 |
| --- /dev/null |
| +++ b/internal/provision/testdata/plan14-root-reads-zddr3.tsv |
| @@ -0,0 +1,41 @@ |
| +# Plan 14 census ruling zddr3 (#272): the agent's exec shim replaces clone3 placement. Its reads, and the reads of the parent-side start and VerifyPlacement, are accepted legacy because they stay within the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. |
| +# If the shim ever runs as root or reads outside that boundary it stops being legacy and needs the Plan 14 owner's ruling. Earlier overlays are immutable. |
| +@legacy 47342b08763898bff8f58e91a39c63d8f376e68202a1343465ff7bd8a2ab7cf2 internal/cgroup/shim_linux.go joinCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: Openat of cgroup.procs relative to the validated dir fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Openat@47 fc7b193b461306cd596cf052be09e7f00dd6c13685e1febc7fd930a8b4146ea0 |
| +internal/cgroup/shim_linux.go joinCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: Openat of cgroup.procs relative to the validated dir fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Openat@47 fc7b193b461306cd596cf052be09e7f00dd6c13685e1febc7fd930a8b4146ea0 |
| +@legacy 08551c090f04d40d1013baee16200faf9ebf7b1b9948ef8f84fc695a23276718 internal/cgroup/shim_linux.go verifyCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstat of the dir fd and the Lstat of /sys/fs/cgroup plus expected are identity checks that keep placement inside the subtree; they tighten it and widen no trust; the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstat@376,file:Lstat@441,file:ReadFile@67 3cfeb2e9c2ccbf65372ddb5a639c3a10a72e5532211c6507d56343e5e98f4e5b |
| +internal/cgroup/shim_linux.go verifyCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstat of the dir fd and the Lstat of /sys/fs/cgroup plus expected are identity checks that keep placement inside the subtree; they tighten it and widen no trust; the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstat@376,file:Lstat@441,file:ReadFile@67 3cfeb2e9c2ccbf65372ddb5a639c3a10a72e5532211c6507d56343e5e98f4e5b |
| +@legacy f3c761d0e8d81cb908229d3512a39cb968a5dadb0fb8185d82741eae0ed86eff internal/cgroup/shim_linux.go runProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@35 5356bb77d65caf264da4536608cd925c7e68ed466aa25e5ab007b43eae56fe8f |
| +internal/cgroup/shim_linux.go runProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@35 5356bb77d65caf264da4536608cd925c7e68ed466aa25e5ab007b43eae56fe8f |
| +@legacy 3e0187927a2d63bb61bd0c158712bfb74abdee75e52b1a2380812d3fb77ae3c9 internal/cgroup/shim_linux.go Manager.startViaShimBy legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the opened cgroup dir is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the Open of that dir is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstatfs@699,file:Open@455 d218799999581dbd6fe80b5906891b6f2d1e033d6c33423836175429d33f407a |
| +internal/cgroup/shim_linux.go Manager.startViaShimBy legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the opened cgroup dir is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the Open of that dir is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstatfs@699,file:Open@455 d218799999581dbd6fe80b5906891b6f2d1e033d6c33423836175429d33f407a |
| +@legacy 95d1d262f694c674484b3a6729def30201a23ecdd3b7321d001da0bbd47fe128 internal/cgroup/shim_linux.go runShim legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the dir fd is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the tenant Exec is the same act as the agent's existing tenant spawn and the spec arrives from its own parent over the pipe; the Read of the release byte from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Exec@3014,file:Fstatfs@1305,file:Read@1927 8f164d8c1f0681064813ad4bf9e1850da0b270f9970f47e025b549b05e763a6d |
| +internal/cgroup/shim_linux.go runShim legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the dir fd is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the tenant Exec is the same act as the agent's existing tenant spawn and the spec arrives from its own parent over the pipe; the Read of the release byte from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Exec@3014,file:Fstatfs@1305,file:Read@1927 8f164d8c1f0681064813ad4bf9e1850da0b270f9970f47e025b549b05e763a6d |
| +@legacy 4b87c9076f8511fa2b55735368daa56bec6bbac3d4f183a97e3d83e4bb14ab6c internal/cgroup/shim_linux.go Manager.startShimCore legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadAll and ReadBytes on the shim's status pipe are the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadAll@4798,file:ReadAll@5531,file:ReadBytes@3682 6f8213988e3058c6a28ecb2ab6163a0707559370c10def0bff6c11df145e5d37 |
| +internal/cgroup/shim_linux.go Manager.startShimCore legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadAll and ReadBytes on the shim's status pipe are the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadAll@4798,file:ReadAll@5531,file:ReadBytes@3682 6f8213988e3058c6a28ecb2ab6163a0707559370c10def0bff6c11df145e5d37 |
| +@legacy 09b132e3d911ff8377041f276aeb9302fa5061b15b471695246ab6802004baec internal/cgroup/shim_linux.go readFull legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Read of the spec from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Read@70 18102503e2e905c6d2f66bf283a1771b040901453da54de6b38187482bfb35f0 |
| +internal/cgroup/shim_linux.go readFull legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Read of the spec from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Read@70 18102503e2e905c6d2f66bf283a1771b040901453da54de6b38187482bfb35f0 |
| +@legacy ca4a93ae17133c7672ab2c32d1c648d5fc1e3d51d22dd54447f832aa1798921c internal/cgroup/shim_linux.go cloexecFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadDir of /proc/self/fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadDir@247 2616633acc24c5f94832c1908a5d1cb982331fb32596f8d1cfc9abb883607d7d |
| +internal/cgroup/shim_linux.go cloexecFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadDir of /proc/self/fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadDir@247 2616633acc24c5f94832c1908a5d1cb982331fb32596f8d1cfc9abb883607d7d |
| +@legacy e92f485cac500d854b9ba8a49cf4eb16f8b5779970b91435b0cc1893713557f1 internal/cgroup/shim_linux.go ignoredSignals legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/status is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@53 2137cd40a78ffa3d19ba3791c97ad50b7faf029fa778ebd419ea66516603f063 |
| +internal/cgroup/shim_linux.go ignoredSignals legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/status is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@53 2137cd40a78ffa3d19ba3791c97ad50b7faf029fa778ebd419ea66516603f063 |
| +@legacy b7e7496ed98ddf3ec9adfc3e6e776a20e81b38fae822e304e9f8e5ea5e1be656 internal/cgroup/verify_linux.go Manager.VerifyPlacement legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Statfs of the delegated root, the scratch child's memory.max and the __cgprobe self-exec of /proc/self/exe are all under the agent's own delegated root. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@1475,file:ReadFile@2227,file:Statfs@714 932c2d38e3fa6b24a7724f2a72155d248540fb0f82d76362e04b8804f198c636 |
| +internal/cgroup/verify_linux.go Manager.VerifyPlacement legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Statfs of the delegated root, the scratch child's memory.max and the __cgprobe self-exec of /proc/self/exe are all under the agent's own delegated root. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@1475,file:ReadFile@2227,file:Statfs@714 932c2d38e3fa6b24a7724f2a72155d248540fb0f82d76362e04b8804f198c636 |
| +@legacy 22beb37296952b24cf000b4b3f6379a3e7f61761f6c9fd7237083a0a72bb1ebf internal/cgroup/cleanup_linux.go Manager.openCleanupAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row; its OpenFile is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:OpenFile@302 dd1825275361cddc52d34652f5030d3c74d04081e823e1bc2c34c90d9abeeddd |
| +internal/cgroup/cleanup_linux.go Manager.openCleanupAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row; its OpenFile is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:OpenFile@302 dd1825275361cddc52d34652f5030d3c74d04081e823e1bc2c34c90d9abeeddd |
| +@legacy b2323851f8abd44a94b29e78db9bf5bb80a1247e6172d74232c4fbae4e2c5572 internal/activator/backend_exec.go ExecBackend.StartWorkerStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@3507,registry:Args@227,registry:Args@378,registry:Host@1388,registry:Host@2610,registry:Host@3629,registry:Host@369,registry:Host@4515,registry:Host@473,registry:Host@589,registry:Host@685,whole:Route@1148,whole:Route@1692,whole:Route@2238,whole:Route@3459,whole:Route@3590,whole:Route@4356,whole:Route@4446 f6e9b917b370986421fbc258dc95a723a6f4fb55bbd18b13f061129aa36ea89e |
| +internal/activator/backend_exec.go ExecBackend.StartWorkerStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@3507,registry:Args@227,registry:Args@378,registry:Host@1388,registry:Host@2610,registry:Host@3629,registry:Host@369,registry:Host@4515,registry:Host@473,registry:Host@589,registry:Host@685,whole:Route@1148,whole:Route@1692,whole:Route@2238,whole:Route@3459,whole:Route@3590,whole:Route@4356,whole:Route@4446 f6e9b917b370986421fbc258dc95a723a6f4fb55bbd18b13f061129aa36ea89e |
| +@legacy 6a1b077906f03ba5b111c525310be6b60aff1b294d3ddaec6bcf84f1364838d5 internal/activator/backend_exec.go ExecBackend.spawnChildFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@9682,registry:Host@10964,registry:Host@11058,registry:Host@164,registry:Host@3773,registry:Host@3828,registry:Host@3908,registry:Host@4006,registry:Host@4127,whole:Route@10079,whole:Route@11355,whole:Route@11447,whole:Route@1602,whole:Route@1864,whole:Route@193,whole:Route@4321,whole:Route@6392,whole:Route@8365,whole:Route@9628 2ca8591aed976f81f770a3fdc96499393d59936ede24cb42a79f5aa3dd017ae8 |
| +internal/activator/backend_exec.go ExecBackend.spawnChildFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@9682,registry:Host@10964,registry:Host@11058,registry:Host@164,registry:Host@3773,registry:Host@3828,registry:Host@3908,registry:Host@4006,registry:Host@4127,whole:Route@10079,whole:Route@11355,whole:Route@11447,whole:Route@1602,whole:Route@1864,whole:Route@193,whole:Route@4321,whole:Route@6392,whole:Route@8365,whole:Route@9628 2ca8591aed976f81f770a3fdc96499393d59936ede24cb42a79f5aa3dd017ae8 |
| +@remove internal/cgroup/cgroup_linux.go placementLive |
| +@removed internal/cgroup/cgroup_linux.go placementLive H3 census-ruling-zddr3: placement verification moved into the agent's exec shim; its reads are accepted-legacy rows in this overlay. |
| +@remove internal/cgroup/cgroup.go Manager.startIn |
| +@removed internal/cgroup/cgroup.go Manager.startIn H3 census-ruling-zddr3: no longer reads; cgroup placement moved into the agent's exec shim (accepted-legacy rows in this overlay). |
| +# Envelopes, census ruling zddr3: each changed root source envelope below is accepted only because the units inside it are the ones listed above; boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. |
| +@coverage . f1e899cdd021baecbf67a2458be91fcf82baa0510f0af863942f7f510cce9519 |
| +@coverage cmd/zddprobe ba4960a38c316deb4032b5569bf7ed9aa3c762262e560b351f43c73fbc3a64e2 |
| +@coverage internal/activator aaa8f424e27268dcc8c53cacc711cbbd6bab1b96f5905523bca609fa22a7abe4 |
| +@coverage internal/cgroup 6fbf28661b36f73d612e4af02efbccd6a6567be3d2a987de6178fd407f8eaaac |
| +@coverage internal/host 834daf0443763909fe447fb029891d129ac9e178c8bace1915cf6e5f25b5f68f |
| +@coverage internal/instancectl 0a4b786ac0b7eb01285fb51bc2711abd87e53eaf33e6d881a6cc3a8683289416 |
| +@coverage internal/rolloutwords 0ec71bcebe6e5573ef8bb3e520228bc7f1fdb02feab0788d8cad3a1f2997b02e |
| +@coverage internal/status f1b105f9144165c6a03ffc7d06f60fe4b9de74454ba540a9c5909e72b7e6b67e |