carlos / platform Public

| Prior finding | Disposition at d76f5364 | |---|---| | R8-1 | Resolved at spec level. Wake refreshes the committed row before Acquire; migration reloads routing before releasing admission (§§6.8, 8.2). | | R5-2 | Resolved. Downgrade checks every row’s paths regardless of flags; unflagging nested rows is refused (§8.2). | | R5-3 | Resolved. Unit and socket names use the bounded InstanceID (§§3.1, 5.3). | | R2-4 | Resolved. Blocking seed execution and RemainAfterExit=yes retain identity and results through capture (§§4.2, 5.3). | | R2-5 | Resolved. Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease (§§6.3, 6.5). | | R2-7 | Resolved. Recovery derives both endpoints from journal direction, completes that transaction, then converges to current intent (§8.2). | | R2-9 | Resolved. Flat minting, explicit reversal and downgrade guards cover the reported failures (§§8.1–8.2). | | R2-14 | Resolved at spec level. The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). | | R1-4 | Resolved. Completion is independent of log EOF; blocking observations remain outside the activator mutex (§§6.4–6.7). | | R1-5 | Resolved. Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). | | R1-8 | Resolved under the recorded decision. Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). | | R1-12 | Resolved. Consumer fences and bidirectional recovery cover interrupted migration (§8.2). | | R1-13 | Resolved. Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). | | R1-15 | Resolved for the reported PID/IMDS defects. No unsafe fallback remains; the behavioural gate is specified (§8.5). | | R1-18 | Resolved under the recorded ruling. Remote operations and reporting are specified; the foreign repair residual remains explicitly accepted (§§8.3–8.4). |

R9-1 — P1 — §§5.4, 4.1, 6.6: A tenant can stop the agent without using the authenticated channel.

Retain §5.4’s process-authenticated control service. The namespace leaves a separate process-control path available.

The template’s hardening block omits ProtectControlGroups=. ProtectSystem=strict excludes kernel API filesystems, and systemd explicitly leaves /sys/fs/cgroup writable under ProtectKernelTunables=yes unless control-group protection is enabled. systemd namespace implementation.

Section 6.6 retains the delegation machinery for this release. That machinery creates supervise/ as carlos and moves the agent into it. Linux creates its control files with the creator’s ownership and owner-write permission. Consequently, the specified tenant can write 1 to:

/sys/fs/cgroup/carlos.slice/carlos-edge.service/supervise/cgroup.kill

That kills the agent; writing to the adjacent cgroup.freeze freezes it. These operations require no visible target PID and no connection to the control service. PID isolation therefore does not prevent them. Linux ownership and kill implementation, cgroup control semantics.

Correction: add ProtectControlGroups=yes to all three tenant templates and the probe, preserving the agent’s delegation separately. Require a behavioural check that a tenant cannot write the agent’s delegated cgroup controls.

R9-2 — P1 — §§4.1, 8.5, 9: Restore drills expose sibling databases outside the hidden data tree.

Both hibernate verification and ordinary restore verification set CacheDirectory=carlos-verify, TMPDIR=%C/carlos-verify and User=carlos. This creates a host directory at /var/cache/carlos-verify, owned by the same uid as every isolated tenant. PrivateTmp=yes isolates /tmp and /var/tmp; it does not hide that cache directory. systemd execution semantics.

The hibernate drill creates its temporary directory there, then restores each sibling’s database into verify-<host>.db. A tenant can enumerate and read those files while verification runs. Mode 0700 does not separate identical uids, and the tenant’s read-only view still permits reading. The ordinary drill exposes its restored database set through the same directory.

The §8.5 probe can pass throughout: it checks /data and /run/carlos, while these copies live under /var/cache.

Correction: hide the verifier workspace from every tenant role, retaining disk-backed restores. Add both verification units to §9’s isolation audit and test sibling-database unreadability while a restore drill holds a restored copy.

Verdict: request changes.