carlos / platform Public

| Prior finding | Disposition at bcf3fcbb | |---|---| | R2-1 | Resolved for the reported forged-journal attack. Authoritative journals move outside nested tenant mounts. The newly retained flat execution path creates a separate exposure, R3-1. | | R2-2 | Resolved. Explicit mount ordering removes the reported cycle; cold-boot verification is specified. | | R2-3 | Resolved. /start no longer resets an unloaded service. | | R2-4 | Partially resolved. Persistent records are specified, but /seed still obtains its invocation ID through show after the oneshot finishes and can unload (§5.3:765). Retain request-to-invocation correlation before completion. A foreign invocation’s exit record also cannot detect that invocation while it remains running. The new record writer has an additional defect, R3-2. | | R2-5 | Partially resolved. done requires emptiness, but Stop may return on context expiry (§6.3:950). The unchanged activator then calls rep.Close, releasing the lease despite unsuccessful termination (activator.go:1015, 1033). Preserve the lease until termination is proven. | | R2-6 | Resolved at spec level. Reservation, bounded work outside the mutex, generation checks and stop coordination are specified. | | R2-7 | Resolved. Presence recording, committed-row recognition and settled-nested classification cover the reported recovery states. | | R2-8 | Resolved. Ownership preflight covers both migration directions. | | R2-9 | Partially resolved. Explicit migration protects existing rows during the initial upgrade, but new-row creation contradicts that protection, R3-6. The claimed lossless refusal after downgrade is also false: a same-boot rollback retains nested run directories, so the old backend can serve nested DB/socket paths while minting a flat env file (backend_exec.go:557, 579). That creates a destination collision which the subsequent revert refuses. The downgrade protocol must prevent this mixed-layout execution. | | R2-10 | Resolved. The run-directory traversal and socket-group contract are preserved. | | R2-11 | Resolved. The shared host slice receives MemorySwapMax. | | R2-12 | Resolved. Seed and run both prepare the admin token before composing their environment. | | R2-13 | Resolved. Relocated discovery and preservation of the published aggregate are explicit. | | R2-14 | Partially resolved. Both address families are tested and unrelated failures cannot produce readiness, but the replacement assertion rejects effective filtering, R3-4. | | R1-4 | Partially resolved. EOF and mutex defects are addressed; the remaining completion defects are recorded under R2-4, R2-5 and R3-2. | | R1-5 | Partially resolved. Preparation, cancellation and cleanup ordering are specified. Completion remains affected by the findings above, and the new control deadline shortens the seed budget, R3-5. | | R1-8 | Partially resolved. The shared tier is restored, but systemd can overwrite the proposed family OOM setting, R3-3. | | R1-12 | Resolved at spec level. The journal, recovery protocol and named consumer fences address the reported partial-migration failure. | | R1-13 | Partially resolved. Reverse migration exists; the remaining downgrade defects are recorded under R2-9. | | R1-15 | Partially resolved. The unsafe fallback is removed, but the replacement gate cannot establish readiness as written, R3-4. | | R1-18 | Partially resolved. Remote reporting and compatibility with pre-field boxes are specified. Repair remains explicitly box-local in §8.3:1301; the requested API-backed repair operation remains absent. |

R3-1 — P1 — §§5.4, 8.1–8.3: Retain the authenticated control service, but protect it from the flat tenants this revision keeps running.

The two-layout release runs flat and custom hosts as ordinary agent children. Those processes can read /run/carlos/instance-control.token, connect to the control socket, and write /run/carlos/logs. The assertion that the token is unavailable to tenants therefore becomes false during the specified transition.

This also exposes a new root-write route. A flat tenant can replace a role’s log pathname with a symlink to a root-owned file, then authenticate a start request. It can create the required nested directories and launch description for its own host. Systemd opens the specified stdout pathname before applying the tenant sandbox, handing the app a writable descriptor to the target. The nosymfollow mounts do not cover /run/carlos/logs.

Evidence: flat/custom execution:1187, token:746, log directory:273, systemd stdout setup.

Correction: retain the bearer-authenticated service, but define a transition boundary that excludes every unisolated tenant from its credentials and root-opened paths. Do not activate this authority alongside unchanged same-uid flat children. Include custom and excluded same-uid processes in that boundary.

R3-2 — P1 — §§4.1, 6.5: ExecStopPost=+ still receives the explicit tmpfs mounts and cannot write the exit record.

The + prefix disables privilege restrictions and several sandbox settings. It does not remove the explicit TemporaryFileSystem= and BindPaths= configuration in systemd 257. Its execution code passes both into namespace setup independently of needs_sandboxing.

Consequently, instance-exit runs as root but still sees the empty /run/carlos tmpfs with only the instance directory bound back in. /run/carlos/exits is absent. The helper cannot write its record; its failure can leave the unit failed with an invocation ID, which also excludes the spec’s unloaded-unit fallback. done can remain open permanently.

Evidence: template:509, record writer:995; systemd’s apply_mount_namespace, particularly lines 2993 and 3093–3097, in exec-invoke.c.

Correction: use a completion-record mechanism that actually operates in the host mount namespace. Keep its writable endpoint unavailable to the app; + alone does not establish that separation.

R3-3 — P2 — §§4.3, 6.6: systemd manages the slice’s memory.oom.group and can clear the manual setting.

The spec explicitly relies on systemd leaving this attribute alone. In v257, the common memory-controller application code writes memory.oom.group from the unit’s CGroupContext, including for slices. Its default is false.

Reapplying memory properties therefore writes 0. The specified sidecar-start sequence does exactly that on a slice whose main process is already running, before the broker writes 1 again. Other systemd reapplications have no corresponding repair step. The family OOM guarantee does not hold continuously.

Evidence: §4.3:679; cgroup_context_apply, lines 2030–2052, in systemd cgroup.c, and slice property application.

Correction: give the family OOM setting a supported ownership and update mechanism that preserves it while tenants run, including across property changes and reloads. Remove the claim that systemd does not manage it.

R3-4 — P1 — §8.5: The readiness probe rejects correctly enforced IMDS filtering.

IPAddressDeny= attaches packet filters, not a connect-address rejection hook. For an ordinary TCP connection, dropping the outgoing SYN does not guarantee that connect() returns EPERM. Linux’s TCP connect path retains most transmission failures and retries the SYN; the caller can time out. An unavailable IPv6 route can fail before filtering is exercised.

The probe classifies both outcomes as not enforced, so a correctly isolated box can never become ready and its nested tenants cannot wake.

Evidence: required errno:1336, systemd ingress/egress filter attachment, and tcp_connect, lines 3862–3881, in Linux 6.12 tcp_output.c.

Correction: prove effective filtering using an observation appropriate to packet filtering, with controlled reachability and evidence for both address families. Preserve the refusal on unavailable evidence; do not substitute either “any connection failure” or “must return EPERM.”

R3-5 — P1 — §§5.3, 6.2: The universal 30-second control deadline makes valid seeds permanently unwakeable.

/seed blocks until its oneshot finishes, but every agent control request now has a 30-second deadline. A seed that normally completes in 45 seconds is cancelled and stopped on every wake, despite the explicitly retained 120-second seed budget. Its partial database is then removed and the next wake repeats the failure.

Evidence: blocking seed request:766, universal deadline:799, seed cleanup:927, existing budget:466.

Correction: give the blocking seed request a budget covering seed execution and termination, or return its invocation promptly and observe completion separately. Keep sidecar control calls bounded independently.

R3-6 — P1 — §§8.1, 8.2, 9: Unconditional nested defaults bypass the migration boundary.

Section 9 requires newly provisioned rows to use nested paths. A provisioning pass during the candidate’s gate can therefore create a nested host before any layout migrate command. Failed-gate rollback then encounters the incompatible layout that the two-layout release claims cannot exist yet.

The same default change also reaches externally supervised routes. routeFor uses DerivesPaths(), whose predicate includes socket instances with Hibernate=false; carlos add likewise assigns defaults independently of hibernation. Those new routes receive nested paths although their unchanged supervisors still use the flat layout.

Evidence: new-row requirement:1407, compatibility promise:1182, routeFor:299, DerivesPaths:280, CLI defaults:118.

Correction: select new-row defaults using both activator eligibility and explicit box migration state. Before migration is enabled, retain flat defaults; externally supervised routes retain their existing path contract.

R3-7 — P2 — §§3.1, 6.5: The agent cannot delete consumed exit records.

/run/carlos/exits is 0750 root:carlos, while the agent runs as uid carlos. Reading a record is permitted; unlinking it requires write permission on the directory, which the agent lacks. Both per-record acknowledgement and startup cleanup therefore fail, leaving records to accumulate in /run.

Evidence: directory ownership:277, required cleanup:1033.

Correction: assign acknowledgement and cleanup to the root broker through a bounded operation, preserving the protection against forged records.

Verdict: request changes.