| 1 | | Prior finding | Disposition at `251e4d3c` | |
| 2 | |---|---| |
| 3 | | R9-1 | **Resolved.** `ProtectControlGroups=yes` covers all tenant roles and the probe; §8.5 requires a refused cgroup-control write. | |
| 4 | | R9-2 | **Resolved for the reported restore-drill exposure.** `/var/cache` and `/var/lib` are hidden (§§4.1, 8.5). | |
| 5 | | R8-1 | **Resolved.** Wake refreshes the committed row before `Acquire`; migration reloads routing before releasing admission (§§6.8, 8.2). | |
| 6 | | R5-2 | **Resolved.** Downgrade checks every row’s paths regardless of flags; unflagging nested rows is refused (§8.2). | |
| 7 | | R5-3 | **Resolved.** Directory, socket, unit and slice names use the bounded `InstanceID` (§§3.1, 5.3). | |
| 8 | | R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain identity and results through capture (§§4.2, 5.3). | |
| 9 | | R2-5 | **Resolved.** Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease (§§6.3, 6.5). | |
| 10 | | R2-7 | **Resolved.** Recovery derives both endpoints from the journal’s direction, completes that transaction, then converges to current intent (§8.2). | |
| 11 | | R2-9 | **Resolved.** Flat minting, explicit reversal and downgrade guards cover the reported failures (§§8.1–8.2). | |
| 12 | | R2-14 | **Resolved at spec level.** The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). | |
| 13 | | R1-4 | **Resolved.** Completion is independent of log EOF; blocking observations remain outside the activator mutex (§§6.4–6.7). | |
| 14 | | R1-5 | **Resolved.** Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). | |
| 15 | | R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). | |
| 16 | | R1-12 | **Resolved.** Consumer fences and bidirectional recovery cover interrupted migration (§8.2). | |
| 17 | | R1-13 | **Resolved.** Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). | |
| 18 | | R1-15 | **Resolved for the reported PID/IMDS defects.** No unsafe fallback remains; the behavioural gate is specified (§8.5). | |
| 19 | | R1-18 | **Resolved under the recorded ruling.** Remote operations and reporting are specified; the `foreign` repair residual remains explicitly accepted (§§8.3–8.4). | |
| 20 | |
| 21 | **R10-1 — P1 — §§4.1, 8.5, 9: Isolated tenants can read the platform relay’s region master.** |
| 22 | |
| 23 | Retain §5.4’s process-authenticated control service. Extend the filesystem boundary to platform credential inputs. |
| 24 | |
| 25 | The [tenant template](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:609) leaves `/etc/carlos` visible. `ProtectSystem=strict` makes that directory read-only; it does not prevent reading its files. [systemd execution semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml). |
| 26 | |
| 27 | The existing [relay unit](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/units/carlos-relay.service:18) runs as `carlos:carlos`. Its [masters reader](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/relay/masters.go:101) opens `/etc/carlos/relay-masters` directly. The [relay design specifies `root:carlos`, mode `0640`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-07-relay-stun-turn-design.md:325), so every isolated tenant’s `Group=carlos` grants the same read. |
| 28 | |
| 29 | On a box armed according to that contract, a tenant can therefore read and exfiltrate the region master. This exposes the secret from which the relay [derives each app’s authentication key](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/relay/server.go:665), including other accounts’ keys. |
| 30 | |
| 31 | The probe can pass throughout. The new [§9 audit](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1778) inventories writable directories, so it misses a root-written credential that a platform process only reads. |
| 32 | |
| 33 | **Correction:** hide `/etc/carlos` from all three tenant templates and the probe. Extend §9’s audit to credential inputs, including the relay masters file and supported alternate locations. Require a behavioural check that a tenant cannot read a fixture master staged with the relay’s actual ownership and permissions. |
| 34 | |
| 35 | **Verdict: request changes.** |
amadan