| 1 | | Prior finding | Disposition at `b6a35685` | |
| 2 | |---|---| |
| 3 | | R3-1 | **Resolved for the reported token and root-stdout attacks.** Process authentication and the protected log mount address them. The replacement dial restriction introduces R4-1 below. | |
| 4 | | R3-2 | **Resolved.** `ExecStopPost=` now writes inside its actual namespace, to the instance’s run directory. | |
| 5 | | R3-3 | **Resolved.** The unsupported slice write is removed; per-service OOM families are an explicit design decision. | |
| 6 | | R3-4 | **Resolved for the TCP false-negative defect.** UDP observes the packet-filter error directly. The remaining IPv6 evidence gap is under R2-14; the new route-query defect is R4-4. | |
| 7 | | R3-5 | **Resolved.** The seed request has a 150-second deadline. | |
| 8 | | R3-6 | **Resolved.** Both minting paths retain flat defaults; externally supervised routes retain their existing contract. | |
| 9 | | R3-7 | **Resolved.** The agent can remove records from their new directory. | |
| 10 | | R2-4 | **Partially resolved.** Unloaded-unit termination is covered, but `/seed` still obtains identity after completion and can return an empty ID. Its fallback consumes an exit record that §6.5 expressly limits to event wording. The seed’s correlated completion result remains inconsistent between [§5.3](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:787) and [§6.5](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1053). | |
| 11 | | R2-5 | **Partially resolved.** Ordinary stops now retain the lease on uncertainty. However, the [foreign-invocation branch](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1087) declares completion before the replacement’s cgroup is empty. Separate “replacement detected” from `done`; termination must remain unproven until that writer stops. | |
| 12 | | R2-7 | **Regressed to partially resolved.** The new [recovery precheck](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1347) recomputes `from` from the current row before recognizing a committed CAS. After CAS, that row already names `to`, so validation rejects the legitimate journal. Changing fleet intent to `flat` likewise rejects an unfinished `nested` transaction. Validate both endpoint states and distinguish transaction intent from subsequently requested mode. | |
| 13 | | R2-9 | **Resolved for the reported upgrade and destination-collision defects.** Flat minting protects the first upgrade; the explicit revert order and env-aside rule cover the described downgrade recovery. The new migration failures are identified separately. | |
| 14 | | R2-14 | **Partially resolved.** IPv4 enforcement is tested, but [§8.5](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1434) permits readiness with IPv6 denial unexercised. Readiness is not invalidated when routing changes. Preserve unavailable evidence as unverified, or bound and monitor the no-route exception. | |
| 15 | | R1-4 | **Partially resolved.** EOF and mutex defects are resolved; the completion exception remains under R2-5. | |
| 16 | | R1-5 | **Partially resolved.** Preparation, execution budget, cancellation and stop-before-cleanup are specified. The seed completion-result inconsistency remains under R2-4. | |
| 17 | | R1-8 | **Resolved.** Shared tier limits are restored; the changed family OOM behavior is explicitly bounded and documented. | |
| 18 | | R1-12 | **Partially resolved.** Consumer fences are specified; recovery regresses as described under R2-7. | |
| 19 | | R1-13 | **Resolved for the reported missing reverse mechanism and database-history selection.** Explicit reversal and collision refusal replace those defects. | |
| 20 | | R1-15 | **Partially resolved.** The unsafe PID-namespace fallback remains removed. The remaining readiness issues are R2-14 and R4-4. | |
| 21 | | R1-18 | **Partially resolved.** Reporting and custom-row migration are remote. [Foreign-row repair](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1390) still explicitly requires a box-local command. | |
| 22 | |
| 23 | **R4-1 — P1 — §§5.4, 6.1, 9: Retain the authenticated control service, but replace the blanket root-peer rejection.** |
| 24 | |
| 25 | The new rule rejects every application connection whose `SO_PEERCRED` uid is zero. Existing `carlos-app@.socket` listeners are created by PID 1 and passed to DynamicUser services. Their peer credentials remain the credentials recorded at `listen()`: root. `SocketUser=carlos` changes the socket file’s ownership, not those credentials. Consequently, the proposed check rejects legitimate unit-backed application traffic and health checks. |
| 26 | |
| 27 | Evidence: [the new restriction](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:853), [existing socket-activation contract](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/units/carlos-app@.socket:1), [Linux `SO_PEERCRED` semantics](https://man7.org/linux/man-pages/man7/unix.7.html), [systemd socket ownership semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.socket.xml). |
| 28 | |
| 29 | **Correction:** keep process authentication and define an anti-proxy check that distinguishes the control endpoint from legitimate systemd-created application listeners. Do not substitute a general root-peer exception. Verify both permitted socket activation and refused control-channel proxying with real sockets. |
| 30 | |
| 31 | **R4-2 — P1 — §§3.2, 8.2: The required bind mount prevents migration by rename.** |
| 32 | |
| 33 | `/data/instances` is a bind mount before the agent starts. Moving `/data/H.db` to `/data/instances/H/H.db` therefore crosses mount points. Linux rejects that rename with `EXDEV`, even though both paths refer to the same underlying filesystem. Reverse migration fails for the same reason. |
| 34 | |
| 35 | The first database rename consequently fails after the journal has fenced the host. Repeating the prescribed recovery cannot complete it. |
| 36 | |
| 37 | Evidence: [the bind mount](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:370), [the migration’s `os.Rename` requirement](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1336), [Linux `rename(2)` and `EXDEV`](https://man7.org/linux/man-pages/man2/rename.2.html). |
| 38 | |
| 39 | **Correction:** specify a protected migration view in which both endpoints share one mount, preserving the approved rename approach and ordinary consumers’ `nosymfollow` protection. Verify both directions with the actual mounts installed. |
| 40 | |
| 41 | **R4-3 — P2 — §§8.2–8.3: Custom-path migration looks for environment files in the wrong directory.** |
| 42 | |
| 43 | For a custom database such as `/data/sub/store.db`, step 3 takes environment artifacts from its source directory. The existing backend instead reads `/data/<host>.env`, `/data/<host>.config.env` and `/data/<host>-sidecar.env`, independently of `DBPath`. |
| 44 | |
| 45 | The pass therefore records those artifacts as absent, moves the database, and starts the nested instance without its existing overrides or sidecar configuration. Token preparation mints a replacement token. The quarantine source is also wrong for a custom basename: existing code uses `dbPath + ".corrupt"`. |
| 46 | |
| 47 | Evidence: [migration source derivation](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1297), [environment composition](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:785), [sidecar path](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:865), [quarantine path](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:273). |
| 48 | |
| 49 | **Correction:** derive each source from its existing contract: database-relative WAL, SHM, shadow and quarantine; `DataDir`-relative environment files. Verify a custom database with both a subdirectory and a different basename. |
| 50 | |
| 51 | **R4-4 — P2 — §§5.2, 8.5: The control service forbids the route query its probe requires.** |
| 52 | |
| 53 | The control service must run `ip -6 route show default`, but its unit permits only `AF_UNIX`. The `ip` command opens an `AF_NETLINK` socket and inherits the service’s restriction. It cannot obtain the routing evidence specified by the readiness protocol. |
| 54 | |
| 55 | Evidence: [service restriction](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:763), [required query](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1435), [iproute2 socket creation](https://raw.githubusercontent.com/iproute2/iproute2/main/lib/libnetlink.c), [systemd address-family restrictions](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml). |
| 56 | |
| 57 | **Correction:** permit the required route-query socket in the control service or assign the query to an appropriately permitted helper. Treat query failure separately from an empty result. An empty default-route list also does not establish the absence of more-specific IPv6 routes. |
| 58 | |
| 59 | **Verdict: request changes.** |
amadan