| 1 | | Prior finding | Disposition at `d76f5364` | |
| 2 | |---|---| |
| 3 | | R8-1 | **Resolved at spec level.** Wake refreshes the committed row before `Acquire`; migration reloads routing before releasing admission (§§6.8, 8.2). | |
| 4 | | R5-2 | **Resolved.** Downgrade checks every row’s paths regardless of flags; unflagging nested rows is refused (§8.2). | |
| 5 | | R5-3 | **Resolved.** Unit and socket names use the bounded `InstanceID` (§§3.1, 5.3). | |
| 6 | | R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain identity and results through capture (§§4.2, 5.3). | |
| 7 | | R2-5 | **Resolved.** Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease (§§6.3, 6.5). | |
| 8 | | R2-7 | **Resolved.** Recovery derives both endpoints from journal direction, completes that transaction, then converges to current intent (§8.2). | |
| 9 | | R2-9 | **Resolved.** Flat minting, explicit reversal and downgrade guards cover the reported failures (§§8.1–8.2). | |
| 10 | | R2-14 | **Resolved at spec level.** The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). | |
| 11 | | R1-4 | **Resolved.** Completion is independent of log EOF; blocking observations remain outside the activator mutex (§§6.4–6.7). | |
| 12 | | R1-5 | **Resolved.** Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). | |
| 13 | | R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). | |
| 14 | | R1-12 | **Resolved.** Consumer fences and bidirectional recovery cover interrupted migration (§8.2). | |
| 15 | | R1-13 | **Resolved.** Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). | |
| 16 | | R1-15 | **Resolved for the reported PID/IMDS defects.** No unsafe fallback remains; the behavioural gate is specified (§8.5). | |
| 17 | | R1-18 | **Resolved under the recorded ruling.** Remote operations and reporting are specified; the `foreign` repair residual remains explicitly accepted (§§8.3–8.4). | |
| 18 | |
| 19 | **R9-1 — P1 — §§5.4, 4.1, 6.6: A tenant can stop the agent without using the authenticated channel.** |
| 20 | |
| 21 | Retain §5.4’s process-authenticated control service. The namespace leaves a separate process-control path available. |
| 22 | |
| 23 | The [template’s hardening block](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:608) omits `ProtectControlGroups=`. `ProtectSystem=strict` excludes kernel API filesystems, and systemd explicitly leaves `/sys/fs/cgroup` writable under `ProtectKernelTunables=yes` unless control-group protection is enabled. [systemd namespace implementation](https://raw.githubusercontent.com/systemd/systemd/v257/src/core/namespace.c). |
| 24 | |
| 25 | Section 6.6 retains the delegation machinery for this release. That machinery [creates `supervise/` as `carlos` and moves the agent into it](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/cgroup/cgroup.go:172). Linux creates its control files with the creator’s ownership and owner-write permission. Consequently, the specified tenant can write `1` to: |
| 26 | |
| 27 | ```text |
| 28 | /sys/fs/cgroup/carlos.slice/carlos-edge.service/supervise/cgroup.kill |
| 29 | ``` |
| 30 | |
| 31 | That kills the agent; writing to the adjacent `cgroup.freeze` freezes it. These operations require no visible target PID and no connection to the control service. PID isolation therefore does not prevent them. [Linux ownership and kill implementation](https://raw.githubusercontent.com/torvalds/linux/v6.12/kernel/cgroup/cgroup.c), [cgroup control semantics](https://docs.kernel.org/6.12/admin-guide/cgroup-v2.html). |
| 32 | |
| 33 | **Correction:** add `ProtectControlGroups=yes` to all three tenant templates and the probe, preserving the agent’s delegation separately. Require a behavioural check that a tenant cannot write the agent’s delegated cgroup controls. |
| 34 | |
| 35 | **R9-2 — P1 — §§4.1, 8.5, 9: Restore drills expose sibling databases outside the hidden data tree.** |
| 36 | |
| 37 | Both [hibernate verification](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/units/carlos-hibernate-verify.service:38) and [ordinary restore verification](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/units/carlos-restore-verify.service:35) set `CacheDirectory=carlos-verify`, `TMPDIR=%C/carlos-verify` and `User=carlos`. This creates a host directory at `/var/cache/carlos-verify`, owned by the same uid as every isolated tenant. `PrivateTmp=yes` isolates `/tmp` and `/var/tmp`; it does not hide that cache directory. [systemd execution semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml). |
| 38 | |
| 39 | The [hibernate drill creates its temporary directory there](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/ops/ops.go:274), then [restores each sibling’s database into `verify-<host>.db`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/lease/check.go:79). A tenant can enumerate and read those files while verification runs. Mode 0700 does not separate identical uids, and the tenant’s read-only view still permits reading. The ordinary drill exposes its restored database set through the same directory. |
| 40 | |
| 41 | The §8.5 probe can pass throughout: it checks `/data` and `/run/carlos`, while these copies live under `/var/cache`. |
| 42 | |
| 43 | **Correction:** hide the verifier workspace from every tenant role, retaining disk-backed restores. Add both verification units to §9’s isolation audit and test sibling-database unreadability while a restore drill holds a restored copy. |
| 44 | |
| 45 | **Verdict: request changes.** |
amadan