carlos / platform Public

ACCEPT for a dormant merge. No additional code blocker to flag-on found; the outstanding real-box checks remain required.

| Round-1 finding / triage item | Verdict | Evidence | |---|---|---| | 1. Registry/kernel observation races | ADDRESSED | inflight.go:103 records placements present at the start or changing during a read. Cleanup uses this for population and membership. gen.go:217 captures existing placements and excludes new registrations through the cold-parent writes. | | 2. Inherited ignored signals | ADDRESSED | shim_linux.go:143 captures the agent’s ignored set; shim_linux.go:517 restores and verifies it before exec. | | 3. Cancellation identity and member text | ADDRESSED | cgroup.go:535 returns the context sentinel directly, keeping placement detail in the operator log. | | 4. Unconditional deadline claim | ADDRESSED | verify_linux.go:30 and shim_linux.go:298 explicitly describe the prompt-termination assumption and unbounded synchronous reap. This is the documentation remedy permitted by round 1. | | 5. Shared scratch-directory cleanup | ADDRESSED | Roll notes:738 allocates a unique directory with mktemp -d and removes only that allocation. | | Before merge: inherited-state coverage | ADDRESSED | shimkernellinux_test.go:290 adds ignored SIGTERM and SIGUSR1; line 372 compares the complete observed state against a direct start. | | Before merge: cancellation classification/rendering | ADDRESSED | gen_test.go:912 requires the exact context error. logsink_test.go:254 checks classification, existing member wording, and execution attribution. | | Before merge: misleading KillAndEmpty guarantee | ADDRESSED | cleanup_linux.go:335 now says the kill occurs once and a late placement can leave the proof unproven until its deadline. | | Before dev re-check: activator recipe and strict-subtest separation | ADDRESSED | Roll notes:688 supplies compilation and invocation commands. Lines 698–703 run shim cases with RestrictNamespaces=yes; line 719 runs the strict clone3 case separately without it. Execution on the dev box remains owed. |

New findings: none.

The synchronization closes both reported interleavings. A registration or completion during a cleanup read invalidates its empty result; an existing placement captured by ensureParent remains conservatively counted even if it finishes during the kernel read. New registrations cannot proceed until the parent writes finish. The hold ends before startIn, and the shim ends its registration before invoking before (shim_linux.go:238). I found no callback/shim-wait lock cycle. Waiting registrations are not context-cancellable, so stalled cgroupfs operations can still stall them; this is not an unconditional latency guarantee.

For the agent’s stable signal dispositions, the restored set matches direct execution. In the installed Go runtime, clearSignalHandlers resets signals marked runtime-handled; sigignore clears that mark when installing an ignore. The shim restores ignores lost during its runtime startup. The new field comes from the agent’s /proc/self/status, not tenant arguments or environment. Capture and fork are not atomic against concurrent signal-disposition changes, so this is not a guarantee for arbitrary concurrent handler mutation.

The cancellation probe does not spawn under the inspected Go implementation: Cmd.Start checks the ended context before allocating child descriptors or starting a process. Its deferred cleanup can close pipe objects retained by the shallow copy, but this path follows a proven pre-exec failure and shim reaping. I found no descriptor leak or tenant execution from it. Successful or uncertain execution returns through the earlier success branch, before cancellation relabeling (cgroup.go:526). No new member-facing wording was introduced by this fix.

Containment and inherited authority: I found no path through the shim that executes tenant code before verified cgroup placement. Placement and identity verification precede acknowledgment; tenant exec additionally requires release and a successful R write (shim_linux.go:437). Internal descriptors are marked close-on-exec, and the cgroup directory descriptor is explicitly closed. I found no new descriptor or privilege leak. The authorized flat PID-move fallback still permits tenant execution before placement; required generation starts cannot reach it. Arming still declines when the real placement check fails.

Reviewed 02472fe5..bf3a0deb against the round-1 findings and surrounding code. No files changed or tests run; git diff --check passed. The implementer’s runtime-test receipts were not independently reproduced.