| 1 | | Prior finding | Disposition at `bcf3fcbb` | |
| 2 | |---|---| |
| 3 | | R2-1 | **Resolved for the reported forged-journal attack.** Authoritative journals move outside nested tenant mounts. The newly retained flat execution path creates a separate exposure, R3-1. | |
| 4 | | R2-2 | **Resolved.** Explicit mount ordering removes the reported cycle; cold-boot verification is specified. | |
| 5 | | R2-3 | **Resolved.** `/start` no longer resets an unloaded service. | |
| 6 | | R2-4 | **Partially resolved.** Persistent records are specified, but `/seed` still obtains its invocation ID through `show` **after** the oneshot finishes and can unload ([§5.3:765](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:765)). Retain request-to-invocation correlation before completion. A foreign invocation’s exit record also cannot detect that invocation while it remains running. The new record writer has an additional defect, R3-2. | |
| 7 | | R2-5 | **Partially resolved.** `done` requires emptiness, but `Stop` may return on context expiry ([§6.3:950](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:950)). The unchanged activator then calls `rep.Close`, releasing the lease despite unsuccessful termination ([activator.go:1015](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:1015), [1033](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:1033)). Preserve the lease until termination is proven. | |
| 8 | | R2-6 | **Resolved at spec level.** Reservation, bounded work outside the mutex, generation checks and stop coordination are specified. | |
| 9 | | R2-7 | **Resolved.** Presence recording, committed-row recognition and settled-nested classification cover the reported recovery states. | |
| 10 | | R2-8 | **Resolved.** Ownership preflight covers both migration directions. | |
| 11 | | R2-9 | **Partially resolved.** Explicit migration protects existing rows during the initial upgrade, but new-row creation contradicts that protection, R3-6. The claimed lossless refusal after downgrade is also false: a same-boot rollback retains nested run directories, so the old backend can serve nested DB/socket paths while minting a flat env file ([backend_exec.go:557](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:557), [579](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:579)). That creates a destination collision which the subsequent revert refuses. The downgrade protocol must prevent this mixed-layout execution. | |
| 12 | | R2-10 | **Resolved.** The run-directory traversal and socket-group contract are preserved. | |
| 13 | | R2-11 | **Resolved.** The shared host slice receives `MemorySwapMax`. | |
| 14 | | R2-12 | **Resolved.** Seed and run both prepare the admin token before composing their environment. | |
| 15 | | R2-13 | **Resolved.** Relocated discovery and preservation of the published aggregate are explicit. | |
| 16 | | R2-14 | **Partially resolved.** Both address families are tested and unrelated failures cannot produce readiness, but the replacement assertion rejects effective filtering, R3-4. | |
| 17 | | R1-4 | **Partially resolved.** EOF and mutex defects are addressed; the remaining completion defects are recorded under R2-4, R2-5 and R3-2. | |
| 18 | | R1-5 | **Partially resolved.** Preparation, cancellation and cleanup ordering are specified. Completion remains affected by the findings above, and the new control deadline shortens the seed budget, R3-5. | |
| 19 | | R1-8 | **Partially resolved.** The shared tier is restored, but systemd can overwrite the proposed family OOM setting, R3-3. | |
| 20 | | R1-12 | **Resolved at spec level.** The journal, recovery protocol and named consumer fences address the reported partial-migration failure. | |
| 21 | | R1-13 | **Partially resolved.** Reverse migration exists; the remaining downgrade defects are recorded under R2-9. | |
| 22 | | R1-15 | **Partially resolved.** The unsafe fallback is removed, but the replacement gate cannot establish readiness as written, R3-4. | |
| 23 | | R1-18 | **Partially resolved.** Remote reporting and compatibility with pre-field boxes are specified. Repair remains explicitly box-local in [§8.3:1301](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1301); the requested API-backed repair operation remains absent. | |
| 24 | |
| 25 | **R3-1 — P1 — §§5.4, 8.1–8.3: Retain the authenticated control service, but protect it from the flat tenants this revision keeps running.** |
| 26 | |
| 27 | The two-layout release runs `flat` and `custom` hosts as ordinary agent children. Those processes can read `/run/carlos/instance-control.token`, connect to the control socket, and write `/run/carlos/logs`. The assertion that the token is unavailable to tenants therefore becomes false during the specified transition. |
| 28 | |
| 29 | This also exposes a new root-write route. A flat tenant can replace a role’s log pathname with a symlink to a root-owned file, then authenticate a start request. It can create the required nested directories and launch description for its own host. Systemd opens the specified stdout pathname before applying the tenant sandbox, handing the app a writable descriptor to the target. The `nosymfollow` mounts do not cover `/run/carlos/logs`. |
| 30 | |
| 31 | Evidence: [flat/custom execution:1187](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1187), [token:746](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:746), [log directory:273](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:273), [systemd stdout setup](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/exec-invoke.c). |
| 32 | |
| 33 | **Correction:** retain the bearer-authenticated service, but define a transition boundary that excludes every unisolated tenant from its credentials and root-opened paths. Do not activate this authority alongside unchanged same-uid flat children. Include `custom` and excluded same-uid processes in that boundary. |
| 34 | |
| 35 | **R3-2 — P1 — §§4.1, 6.5: `ExecStopPost=+` still receives the explicit tmpfs mounts and cannot write the exit record.** |
| 36 | |
| 37 | The `+` prefix disables privilege restrictions and several sandbox settings. It does **not** remove the explicit `TemporaryFileSystem=` and `BindPaths=` configuration in systemd 257. Its execution code passes both into namespace setup independently of `needs_sandboxing`. |
| 38 | |
| 39 | Consequently, `instance-exit` runs as root but still sees the empty `/run/carlos` tmpfs with only the instance directory bound back in. `/run/carlos/exits` is absent. The helper cannot write its record; its failure can leave the unit failed with an invocation ID, which also excludes the spec’s unloaded-unit fallback. `done` can remain open permanently. |
| 40 | |
| 41 | Evidence: [template:509](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:509), [record writer:995](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:995); systemd’s `apply_mount_namespace`, particularly lines 2993 and 3093–3097, in [exec-invoke.c](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/exec-invoke.c). |
| 42 | |
| 43 | **Correction:** use a completion-record mechanism that actually operates in the host mount namespace. Keep its writable endpoint unavailable to the app; `+` alone does not establish that separation. |
| 44 | |
| 45 | **R3-3 — P2 — §§4.3, 6.6: systemd manages the slice’s `memory.oom.group` and can clear the manual setting.** |
| 46 | |
| 47 | The spec explicitly relies on systemd leaving this attribute alone. In v257, the common memory-controller application code writes `memory.oom.group` from the unit’s `CGroupContext`, including for slices. Its default is false. |
| 48 | |
| 49 | Reapplying memory properties therefore writes `0`. The specified sidecar-start sequence does exactly that on a slice whose main process is already running, before the broker writes `1` again. Other systemd reapplications have no corresponding repair step. The family OOM guarantee does not hold continuously. |
| 50 | |
| 51 | Evidence: [§4.3:679](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:679); `cgroup_context_apply`, lines 2030–2052, in [systemd cgroup.c](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/cgroup.c), and [slice property application](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/dbus-slice.c). |
| 52 | |
| 53 | **Correction:** give the family OOM setting a supported ownership and update mechanism that preserves it while tenants run, including across property changes and reloads. Remove the claim that systemd does not manage it. |
| 54 | |
| 55 | **R3-4 — P1 — §8.5: The readiness probe rejects correctly enforced IMDS filtering.** |
| 56 | |
| 57 | `IPAddressDeny=` attaches packet filters, not a connect-address rejection hook. For an ordinary TCP connection, dropping the outgoing SYN does not guarantee that `connect()` returns `EPERM`. Linux’s TCP connect path retains most transmission failures and retries the SYN; the caller can time out. An unavailable IPv6 route can fail before filtering is exercised. |
| 58 | |
| 59 | The probe classifies both outcomes as `not enforced`, so a correctly isolated box can never become ready and its nested tenants cannot wake. |
| 60 | |
| 61 | Evidence: [required errno:1336](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1336), [systemd ingress/egress filter attachment](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/bpf-firewall.c), and `tcp_connect`, lines 3862–3881, in [Linux 6.12 tcp_output.c](https://raw.githubusercontent.com/torvalds/linux/v6.12/net/ipv4/tcp_output.c). |
| 62 | |
| 63 | **Correction:** prove effective filtering using an observation appropriate to packet filtering, with controlled reachability and evidence for both address families. Preserve the refusal on unavailable evidence; do not substitute either “any connection failure” or “must return EPERM.” |
| 64 | |
| 65 | **R3-5 — P1 — §§5.3, 6.2: The universal 30-second control deadline makes valid seeds permanently unwakeable.** |
| 66 | |
| 67 | `/seed` blocks until its oneshot finishes, but every agent control request now has a 30-second deadline. A seed that normally completes in 45 seconds is cancelled and stopped on every wake, despite the explicitly retained 120-second seed budget. Its partial database is then removed and the next wake repeats the failure. |
| 68 | |
| 69 | Evidence: [blocking seed request:766](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:766), [universal deadline:799](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:799), [seed cleanup:927](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:927), [existing budget:466](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:466). |
| 70 | |
| 71 | **Correction:** give the blocking seed request a budget covering seed execution and termination, or return its invocation promptly and observe completion separately. Keep sidecar control calls bounded independently. |
| 72 | |
| 73 | **R3-6 — P1 — §§8.1, 8.2, 9: Unconditional nested defaults bypass the migration boundary.** |
| 74 | |
| 75 | Section 9 requires newly provisioned rows to use nested paths. A provisioning pass during the candidate’s gate can therefore create a nested host before any `layout migrate` command. Failed-gate rollback then encounters the incompatible layout that the two-layout release claims cannot exist yet. |
| 76 | |
| 77 | The same default change also reaches externally supervised routes. `routeFor` uses `DerivesPaths()`, whose predicate includes socket instances with `Hibernate=false`; `carlos add` likewise assigns defaults independently of hibernation. Those new routes receive nested paths although their unchanged supervisors still use the flat layout. |
| 78 | |
| 79 | Evidence: [new-row requirement:1407](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1407), [compatibility promise:1182](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1182), [routeFor:299](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/provision/reconcile.go:299), [DerivesPaths:280](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/provision/provision.go:280), [CLI defaults:118](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/cli.go:118). |
| 80 | |
| 81 | **Correction:** select new-row defaults using both activator eligibility and explicit box migration state. Before migration is enabled, retain flat defaults; externally supervised routes retain their existing path contract. |
| 82 | |
| 83 | **R3-7 — P2 — §§3.1, 6.5: The agent cannot delete consumed exit records.** |
| 84 | |
| 85 | `/run/carlos/exits` is `0750 root:carlos`, while the agent runs as uid `carlos`. Reading a record is permitted; unlinking it requires write permission on the directory, which the agent lacks. Both per-record acknowledgement and startup cleanup therefore fail, leaving records to accumulate in `/run`. |
| 86 | |
| 87 | Evidence: [directory ownership:277](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:277), [required cleanup:1033](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1033). |
| 88 | |
| 89 | **Correction:** assign acknowledgement and cleanup to the root broker through a bounded operation, preserving the protection against forged records. |
| 90 | |
| 91 | **Verdict: request changes.** |
amadan