| 1 | # Census overlay claim-empty-cohort-fix2 (fix round 2 for claim-empty-cohort-done: Astra's re-review finding on the floor repair, as ruled by the controller), loaded LAST, after claim-empty-cohort-fix1. RULED (platform-1e, 2026-10-20): accepted as proposed; the proposal is docs/superpowers/notes/census-proposal-claim-step8-readiness.md, section "Fix round 2". |
| 2 | # consoleDir's descriptor walk is factored out, unchanged, into walkNoFollowDir (new), and repairRootFloorDir now walks with it, checking every ancestor before it makes or changes anything; the pathname Lstat and mkdirAllExact are gone from the floor repair. consoleDir keeps its class and task exactly; walkNoFollowDir takes the class both its callers have. It adds no accepted-legacy row, so the seal stands. |
| 3 | @coverage internal/host 4b1e0c8679f254b618c81c495c9af1aa3ec55d3f6a72ccc1a47b60850515333a |
| 4 | internal/host/activation_artifacts_linux.go consoleDir authority G,J4 rev3=census-ruling-claim-empty-cohort-fix2;identity=explicit box installer uid 0 (claims install-console);basis=walks from / by no-follow descriptors; every component root-owned, not group or other writable and other-searchable; creates missing components 0755 and fsyncs the parent; the protected directory must be exactly 0755 root:root. Fix round 2: the walk itself (the open of /, each O_NOFOLLOW Openat, Mkdirat and Fchmodat beneath a checked parent, the parent fsync and the reopen) moved unchanged into walkNoFollowDir; consoleDir keeps its own checks, its Fstat of every component, and passes create for every component, so its behaviour is the same file:Fstat@259 689a231d7b7dc9cd8db1adc7a250947ad9a1646a7549119034a69d13761ae7a8 |
| 5 | internal/host/nofollowdir_linux.go walkNoFollowDir authority G,J4 rev3=census-ruling-claim-empty-cohort-fix2;identity=uid 0 callers only: consoleDir (claims install-console) and repairRootFloorDir (carlos system journal-migrate, offline); basis=new, consoleDir's walk factored out unchanged: opens the caller's base (/ in production) then each name beneath it with O_RDONLY, O_DIRECTORY, O_NOFOLLOW and O_CLOEXEC; the caller's check sees every directory before anything beneath it is opened or made, and the final directory once open; a missing name is made only where the caller allows (Mkdirat 0755 then Fchmodat 0755 beneath the checked parent, the parent fsynced, the name reopened with O_NOFOLLOW); it reads no file content and returns the checked final descriptor file:Open@193,file:Openat@449,file:Openat@768 f9107577a7dbf5bf17472506903419e304e4f0300698f2e9b0e927f5bfd148d6 |
| 6 | internal/host/rootmigration_production_linux.go repairRootFloorDir authority G,J4 rev3=census-ruling-claim-empty-cohort-fix2;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=as ruled under census-ruling-claim-empty-cohort-fix1, repairs one of the two fixed floor directories (guard/moves, guard/seeds) to 0755 only when it is a directory owned by root:root. Fix round 2: no pathname Lstat or mkdirAllExact any more; it walks from / with walkNoFollowDir and Fstats every directory on the way, refusing unless each from / to guard/ is a real directory, not a symlink, owned by root and not writable by group or others, before anything is made; only then is a missing floor directory made by Mkdirat beneath the checked guard/, opened with O_NOFOLLOW, Fstatted (a directory owned by root:root) and Fchmodded to 0755, with one more Fstat to confirm; a symlink or a missing directory on the way, an untrusted ancestor, or a floor directory that is a symlink, a file or another owner's refuses with nothing made or changed; no file content is read file:Fstat@1124,file:Fstat@539,file:Fstat@952 d5937bfe755c2b86b38756a3016d56cf89a635b3bf0ff2869dc19d22a35622cb |
| 7 | |
amadan