| 1 | # Plan 14 Part 3 overlay (with E3/E4 under the narrowed scope). RULED by the Plan 14 controller 2026-10-17 as census-ruling-plan14-part3: every row marked PROPOSED is ACCEPTED as written. That rests on the Part 3 authority reviews (checkpoints 1, 3) and whole-branch reviews 1-5, ending 'MERGE: approve' at 43ff0259, with all P3-R corrections applied. The marker text is kept because frozen and restated rows fingerprint their basis. |
| 2 | # Earlier overlays and frozen legacy fingerprints are unchanged. |
| 3 | internal/console/boxselect.go Server.selectMoveBoxes authority F,J4 rev3=PROPOSED-p3;identity=carlos console serve, console.service uid carlos-console;basis=applies accepted/generation refusal only to advertised root-floor participants; legacy selection retains main exactly 8502ba7b90b7e94ef716c0aaa802aba0dbf14768cda9b9ff1094de29fbd06e19 |
| 4 | internal/console/seedfloor.go Server.seedRegionReady authority F,J4 rev3=PROPOSED-p3;identity=carlos console serve uid carlos-console;basis=requires accepted seeds generation only from root-floor participants; mixed fleet nonparticipants retain exact legacy readiness d116ff2f72a1386a3a4120c69fea671cd3d43af264a20a1b8e98b5c61f11efb2 |
| 5 | internal/host/claimconstruction.go OpenProductionClaimAssembly authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained file:Read@10604,file:Read@4684,file:ReadFile@4228,registry:Host@10631,whole:Route@10719,whole:Route@11468 1e572a7ebaad420e9ac5bd7d5af2bb5b6e300362c909a1965beaf5bbbd17142f |
| 6 | internal/host/claimjournal_migration.go RunSystemJournalMigrate authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup 4f204d8a97620bfb22430a94e236d6c5b14a5265b35f68e21fb2ad34903ae0f3 |
| 7 | internal/host/claimjournal_migration.go migrateClaimJournalsWith authority G,J4 rev3=PROPOSED-p3;run=13;identity=offline migration uid 0;basis=checks canonical cohort eligibility before opening migration owners and journals b66afddd13e0f346ddecb481e88e58d3ad4a40b703f9f8199bdb6641fda6f54e |
| 8 | internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=PROPOSED-p3;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main file:OpenFile@565,file:ReadFile@1142,file:ReadFile@1756,file:ReadFile@5797,file:ReadFile@865,file:Stat@3448 3eb11b09adc3b122f555513cc35aac8124f89149e72db995351cde384b2cf809 |
| 9 | internal/host/guardexec.go RunSystemGuardExec authority F,J4 rev3=PROPOSED-p3;run=13;identity=root apply/recover uid 0; edge uid carlos; console service identity;basis=keeps main remote policy checks for no-census recovery; only census recovery is network-free; edge never opens root state file:Exec@2093,file:Exec@2246,file:Stat@1109 7b0dc632eeb11e793d3262c010f6fe8deab057be431c0783e696529afd643bb4 |
| 10 | internal/host/guardtransaction.go systemApplier.guardRun authority F,J4 rev3=PROPOSED-p3;run=13;identity=root system update/recovery uid 0;basis=checks signed image and bound, permits certified current/guard helpers and reauthorized previous repair images below a raised bound, and refuses below-bound replacement candidates 12c0d6c2d9cdbe8ec95d8128aaff90aab410af511033a693a29eb655f2faa541 |
| 11 | internal/host/movesfloor.go rootJudgeMovesPrevWithSource authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt refreshes root floor only for census participants; legacy registry judgement otherwise unchanged file:Stat@289,file:Stat@490 fa942c1c4b8af2d2930be427e303f3b9838c0fce33f1b3f8e63e17093b638269 |
| 12 | internal/host/movesfloor.go rootJudgePrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=normal adopt combines moves and seeds verdict errors; unpublished seeds remain inert; raised bounds never block recording signed prev 8b5ecf5a0f33ee58d603f308302bcc8e68678da6b1e6ee7ed03845c35747f8c6 |
| 13 | internal/host/movesfloor.go rootJudgePrevWithSource authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, uid 0;basis=normal adopt path refreshes and judges both independent protocol floors only on census boxes 8d25e75b26a43b93f4c635b5d3a9d25bf41f60a02face307dc11034c706dd916 |
| 14 | internal/host/movesfloor.go withMovesFields authority F,J4 rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent uses root-owned public projection when participating and its original writable mirror otherwise file:Lstat@238,file:Stat@697 3e615afa769bb64bcb0ffdc1ad7b85b67883a34cd6afd83ce7da74a1f4218983 |
| 15 | internal/host/movesfloorgate.go floorGateMain authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=dispatches explicit root previous gate; legacy argument shape preserved 6123e52c08365414c1135aef0fbcdbadcd68b38596cc81d8d9ace482eb555949 |
| 16 | internal/host/rootmigration.go rootMigration.census authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=writes through Ledger.MigrationCensus under transaction.lock and preserves revisions on completed replay 2546029e65b24f525e2c4e4717db320555976aaae917a41cf080e4d341b398a4 |
| 17 | internal/host/rootmigration.go rootMigration.run authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=offline guarded migration reobserves changed claims, retains union of session tuples, publishes only durable completion and verifies completed replay without rewriting census file:Read@508 5d110d3e531052516a19afc5877aa9e2e481d9bbf3305036421aad822699223e |
| 18 | internal/host/rootmigration.go rootMigration.write authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=serializes migration phase records through checked private store durability 25c2c65aaae5b4ca1761fe0e3c456fbcd29d8dc58e5bdd40f94bf2ffe855ca7d |
| 19 | internal/host/rootmigration.go rootMigrationSnapshot.fingerprint authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=binds exclusion and membership across observations/restart while allowing boot metadata and independently recovered payload revision 115b07f84d5aa210cd35d70e2ba4b53ff4deb0e4636a737a5dc144bf34a9473c |
| 20 | internal/host/rootmigration.go rootMigrationSnapshot.preflight authority G,J4 rev3=PROPOSED-p3;run=13;identity=offline root migration uid 0;basis=rechecks the independently pinned canonical records for local named installations before creating migration census 4ceedefec737b0e91de75d9aee0422e585ededb335dc3d26f8c97a1445394e2b |
| 21 | internal/host/rootmigration_census.go rootMigrationCollector.collect authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only file:Exec@4684,file:Read@2868,file:Read@689 6cfe43917f24a6dd6c7e3eee503f84897c944ec0c251ddfc64c16884f5090438 |
| 22 | internal/host/rootmigration_evidence.go readMigrationStop authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=revalidates enrolled immutable stop signature and exact launch inventory journal tuple; preserves original bytes and evidence time file:Read@592 ee9a331a4c022d045acff9eca5003f4df79f9f872ca132b1fa37b150d16338d9 |
| 23 | internal/host/rootmigration_production_linux.go migrationExecutionEmpty authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=any retained execution entry other than census/locks refuses migration; conservative settled-record limitation remains c17efaf8e7191cf0cd36d0ee462793c78094e40aef46567a446e503aee494641 |
| 24 | internal/host/rootmigration_production_linux.go publishMigrationReceipt authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reconstructs immutable key/digest from original signed receipt bytes without changing evidence time db91dbe64b57fe10aa1635fb46938e2ccb585afb6aa138800507acac6a83c377 |
| 25 | internal/host/rootmigration_production_linux.go randomMigrationID authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=cryptographic nonce identifies newly collected stop evidence, never authorizes a stop file:Read@64 c2779c80b5628eca7d484ffba0b289c1068317b1f474c06e1ee5b39c3f769196 |
| 26 | internal/host/rootmigration_production_linux.go rootMigrationLegacySuspects authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=agent-writable hostguard filenames only identify unexplained hosts to refuse, never authorize inventory file:Readdirnames@277 6bfa73d903baa8a028abb007a7ec1da0066dbcda966e92e29b50a2b56fda10ab |
| 27 | internal/host/rootmigration_production_other.go migrateRootClaimAuthority authority G,J4 rev3=PROPOSED-p3;run=15;identity=non-Linux offline root migration;basis=unsupported-platform stub refuses only; performs no locking, opening or publication 327e0adfe387eac7bc74b87258efc9831f5a35ee9c9c9e71640d4e6b54853aae |
| 28 | internal/host/rootmigration_startup.go var openRootMigrationParticipation authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=fixed production participation opener remains rootparticipation.OpenForUpdate; package tests substitute explicit no-census fixtures without accessing the machine store 53a17d908b433d98cdb817ab72543bd53788962625ccc9cfa0e48f829bbc1aa3 |
| 29 | internal/host/rootmigration_startup.go verifyRootMigrationFloors authority G,F,J4 rev3=PROPOSED-p3;run=13;identity=root startup/migration uid 0;basis=requires certified current and guard repair executors and readable local bounds; a bound above installed executors emits the existing alert rather than blocking repair construction 7e558cfe3164a5a2d25a88dad074b85e1a23325ae98e777dac6c6c3543bc1228 |
| 30 | internal/host/rootmigration_startup.go verifyRootMigrationRetained authority G,F,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=requires each migrated installation to retain its old-session deny, exact stopped predecessor receipt and complete root inventory f2dc230494f4659e6d4bf71961d617854454bd8f713585a1cd4489414c288cb1 |
| 31 | internal/host/rootmigration_startup.go verifyRootMigrationStartup authority G,F,J4 rev3=PROPOSED-p3;run=15;identity=root instance-control startup and recovery uid 0;basis=validates retained recovery census and migration identity, including pending acquisition, then complete installation inventory and repair floors; execution admission remains behind verified broker settlement and complete census file:Open@345 6508eb50ecb7cc517041c7f5eb431a597c282274945c0dab2542e6416b3edc9e |
| 32 | internal/host/rootmigration_startup.go verifyRootMigrationState authority G,F,J4 rev3=PROPOSED-p3;run=13;identity=root startup/recovery uid 0;basis=validates retained migration header then complete installations after pending recovery has settled 531c7d47066a7dfad787aed67f08ba6078091c7b9426d8f685872c4948c2d2ba |
| 33 | internal/host/rootmigration_stopped_linux.go verifyMigrationStopped authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline operator uid 0;basis=root checks real proc/cgroup mounts, closed writer journal and absence of cgroups and held inventory descriptors; all observations can only refuse recovery file:ReadFile@588 06b82196857608ace8bfaa8ce7108caad961868b530a0d9cb152326a1aaf6819 |
| 34 | internal/host/rootmovesfloor.go openRootMovesFloors authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed moves namespace then delegates checked root store opening 4af0bda66779af3474e64fda54015763761d058feead1b8a2ebf0c2478a05a3d |
| 35 | internal/host/rootmovesfloor.go openRootProtocolFloors authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=checked root ancestry and leaf ownership for separate moves or seeds public/private stores file:Open@170,file:Open@258 a3b589e05e8cdc1062162562006ef7f93cc3159f2f24a10a155c038ce7e3ca28 |
| 36 | internal/host/rootmovesfloor.go rootMovesFloors.localBound authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=retains every readable independent deny; missing or corrupt history adds no invented refusal or acceptance file:Read@583 cc70feddffa2f611e9de3250d42b84a506f3d5ee688921c551125c4df60ac43a |
| 37 | internal/host/rootmovesfloor.go rootMovesFloors.persist authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=writes quarantine before selector and deny ratchet, then accepted state, then synced public acknowledgement 2c1e0843c5865a31c0fab011d7d4825963bbb5a301727f37f3b1b6c3519eba5e |
| 38 | internal/host/rootmovesfloor.go rootMovesFloors.projection authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=matches public acceptance to private generation, identity and retained componentwise maximum file:Read@109 6b0ed0053db247385ccbabfd95a738fd48a8d27b14882b5e73b4e5a82eda26b6 |
| 39 | internal/host/rootmovesfloor.go rootMovesFloors.reconstruct authority F,J4 rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires private root-issued box/generation/nonce token and refuses weakening; no production caller installed 1a6b2923d55208b8a53cfd17d3cf84f01087485f7b5cadc9012cb1b123120038 |
| 40 | internal/host/rootmovesfloor.go rootMovesFloors.record authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=bounded strict private JSON read requires matching deployment, box and enrollment file:Read@108 2e2bc3e9e915e4a0a70c40933de3928284bbdab25ee223e4cf05500a12913b83 |
| 41 | internal/host/rootmovesfloor.go rootMovesFloors.refresh authority F,J4 rev3=PROPOSED-p3;run=15;identity=normal root adopt/update refresh uid 0;basis=normal refresh ratchets accepted history; unknown history persists only observed denies and never advertises accepted cb70a1eefbb4f8f243090270f23141c9c9a773ee278af002c79a6c3ef6b7c3b7 |
| 42 | internal/host/rootmovesfloor.go rootMovesFloors.selector authority F,J4 rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=strict bounded canonical protocol/release line supplies independent crash-surviving deny file:Read@73 5c46438590323610c67dc5bbfaa191fc5ba23e3b280b6063dbd48e48e7ce3927 |
| 43 | internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizeReconstruction authority F,J4 rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=issues private nonce capability for this root identity and next generation under stable lock; no production caller file:Read@426 a5235f6aab5714cee3e3e41604eed5b1eff7aa4355f9444f44c4811f7dfbbc08 |
| 44 | internal/host/rootmovesfloor_authorization.go rootMovesFloors.authorizedReconstruction authority F,J4 rev3=PROPOSED-p3;identity=offline root reconstruction capability, uid 0; no production caller installed;basis=requires exact private persisted nonce, box identity and next generation; caller strings cannot authorize file:Read@249 c449d7087a6cbcdf4388b7945e84045a0b895349b1bc14347aca7040c822391c |
| 45 | internal/host/rootmovesfloor_boot.go rootFloorAllowsPrev authority F,J4 rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=signed prev identity satisfies local moves and published seeds bounds, relaxed only when no certified build meets bound; caller checks participation separately 61dd5d5f0604f4f4d2bd4a396678a20f4b48e91b952882a94873b2f733ebe560 |
| 46 | internal/host/rootmovesfloor_boot.go rootFloorBootCandidate authority F,J4 rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=selects signed prev under unknown history with no known refusal; always retains certified current executor even when bound exceeds every available build 8f78cd43bb047e128145147cd32d58b445e50aaacf4403946219b663eabac926 |
| 47 | internal/host/rootmovesfloor_boot.go rootFloorJournalPresent authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt, systemd root units or offline CLI, uid 0;basis=checked authority-file presence selects recovery without opening a deployment store b189d04dc579f4825f5668efd1f93f178acca738bb2ed886a14f3b5321d7755b |
| 48 | internal/host/rootmovesfloor_boot.go rootFloorPrevVerdict authority F,J4 rev3=PROPOSED-p3;run=13;identity=root boot/recovery selector uid 0;basis=reauthorizes previous bytes against signed root identities and accepted verdict; boot-local device and inode numbers cannot reject unchanged signed repair bytes file:Read@436 ad5acd71daa00ffbe34fe9b3cb7224b4d6ef1d9b21d1f3e6b2d1d213c88e2e4e |
| 49 | internal/host/rootmovesfloor_boot.go withRootFloorGuardCandidate authority F,J4 rev3=PROPOSED-p3;identity=carlos system guard-exec apply/recover, systemd root units uid 0;basis=release then previous-binary exclusion; participation check precedes moves and seeds locks; certified current remains executor fallback file:Open@218 74d00903cf028a74237153d25879f768a3bd8546cb107d85b4d11feb7f77e04c |
| 50 | internal/host/rootmovesfloor_identity.go rememberRootFloorSystemIdentity authority F,J4 rev3=PROPOSED-p3;run=15;identity=normal root apply pointer verification uid 0;basis=called from apply pointer verification; re-fetches signed pointer equality before retaining executable identity; never recovery or adopt file:Open@543 b4e56a0637c28e5fb65d3a33b7dfd1fea8bed55acbf5231bf26e0011168141fe |
| 51 | internal/host/rootmovesfloor_refresh.go readRootFloorBinary authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=verifies checked executable and signed system manifest; reads signed moves and seeds protocol numbers rather than version sidecar file:Open@684,file:Read@941,file:Stat@276 2a23dd9c46c6fa56476ecfa4061712f05c6f1a1a098295e14f395def2d24324a |
| 52 | internal/host/rootmovesfloor_refresh.go rootFloorAdvertisementFor authority F,J4 rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent reports accepted only for matching generation with signed compatible current and previous verdict file:Read@203 4e464b6add24a06b1c3d7a5859be7a1055750bc25f27c8ca641241be3baa2ef8 |
| 53 | internal/host/rootmovesfloor_refresh.go rootFloorBinary.supports authority F,J4 rev3=PROPOSED-p3;identity=root apply/recover/adopt units uid 0 and agent edges publisher carlos-edge.service uid carlos;basis=signed digest/release are required; protocol minimum applies only when a retained floor exists, preserving unknown-history permission 7a6eaf5432f2668aa47f24d9c667355a985f83eadb8c4619a704168288b16fbf |
| 54 | internal/host/rootmovesfloor_refresh.go rootFloorDowngradeIdle authority D,E2,F,J4 rev3=PROPOSED-p3;identity=root adopt, guard boot selector and system apply/recover uid 0;basis=uses E network-free retained generation obligations and kernel census under participation before floor; borrowed transaction matches the original root store; no deployment provider read file:Open@171,file:Open@612 d49e47d72f752d492a4c56ed73d4af53ffaacd5e95cbc147998e173fcadf2793 |
| 55 | internal/host/rootmovesfloor_refresh.go rootFloorJudge.judge authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt normal refresh and carlos system apply notePrev, uid 0;basis=observes participation before floor lock; writes identity-bound current/prev verdict even under unknown history without blocking repair executor 95062652c0403183b18c074da17d7e4c504f7fd6deab7148668a2dea03711e9c |
| 56 | internal/host/rootmovesfloor_refresh.go rootFloorJudge.refresh authority F,J4 rev3=PROPOSED-p3;run=15;identity=normal root adopt/update refresh uid 0;basis=refreshes retained floor before signed current/previous judgement, even when previous is absent 362798a60b4e3d6fc798db52bfc204979f724efe33a858f3d7ca2c1ca12f6eaa |
| 57 | internal/host/rootmovesfloor_refresh.go rootRefreshAndJudgeMovesPrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt root pass, root unit uid 0;basis=adopt opens deployment store then refreshes floor before any no-prev return 2d4d1ce1d6143555f3b94b19359c014ffb20272f41f756f7c02bbf6ff29a70a9 |
| 58 | internal/host/rootmovesfloor_refresh.go withRootMovesFields authority F,J4 rev3=PROPOSED-p3;identity=carlos agent edgesFileLoop, carlos-edge.service uid carlos;basis=agent publishes only checked root public verdict and explicitly quarantines unreadable participant state file:Open@405 29fb652e22df888f18c691b91db6b83b9781d89d005a2fae431d8102e77b2f88 |
| 59 | internal/host/rootmovesfloor_source.go readEffectiveMovesFloor authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census chooses local root protocol bound; no census chooses existing legacy reader a6420f9074a459fa5107cbd60ca18828f0dec132eb53add849152db2a9b0f62a |
| 60 | internal/host/rootmovesfloor_source.go readRootFloorProjection authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=selects moves public root projection for checked advertisement reader 572e2d0d6a783e823c3c76ca08c38fd86abc5265486c246bb1b123d834fea485 |
| 61 | internal/host/rootmovesfloor_source.go readRootLegacyProtocolJSON authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded descriptor read of optional legacy moves or seeds mirror; shape validation and caller denial-only merge prevent acceptance file:ReadAll@441,file:Stat@278 835f913509edbe65d72986bb23e7af580aaf2d4cc222e87064e29d0d16e61103 |
| 62 | internal/host/rootmovesfloor_source.go readRootProtocolBound authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=reads local root accepted and retained deny state; public-only deny survives missing private history; missing unknown history is not acceptance file:Open@187 2e35ae8bdee1433877d928f22b4a3315dfd2027378a71124ca361284323c22b2 |
| 63 | internal/host/rootmovesfloor_source.go readRootProtocolProjection authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=checked public root projection must agree with selector and directory sync before advertising acceptance file:Open@86,file:Read@232 36f45f87d3cabebaaf759e2cd2b3c4397a5247247e329a0fd71de291ad1a2bf0 |
| 64 | internal/host/rootmovesfloor_source.go refreshRootMovesFloor authority F,J4 rev3=PROPOSED-p3;run=15;identity=normal root adopt/update refresh uid 0;basis=normal adopt/update combines remote object with independent deny-only legacy evidence under root floor lock a41df2c69e7d869b5232d545440b8135e8c7124d490965e641b8d1fba83cb490 |
| 65 | internal/host/rootmovesfloor_source.go rootFloorLegacy authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=selects existing moves mirror paths for denial-only generic legacy reader e5dacb9fa26be5f5f961e99909624f38643f93c43432ff3dce1cff552f7e486a |
| 66 | internal/host/rootmovesfloor_source.go rootMovesFloorIdentity authority F,J4 rev3=PROPOSED-p3;run=15;identity=root update/recovery/guard uid 0;basis=identifies root deployment and enrollment from retained RecoveryCensus even during pending acquisition; identifies floor authority without granting execution admission 440cbd8eb3dd525bf55eb0bdd131825565ef5c15003326399e83f84747033f7c |
| 67 | internal/host/rootmovesfloor_source.go rootProtocolLegacy authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=bounded agent-writable JSON and line mirrors contribute only increasing denies; neither can establish accepted state file:ReadAll@729,file:Stat@537 0b62a121d683312c34a5c7af486d60d496482ef25502e8e2ef0ef18b5e7c6fd6 |
| 68 | internal/host/rootmovesfloor_source.go withEffectiveMovesFloorLock authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover final activation, uid 0;basis=locks moves then seeds private root stores across final activation; no census uses unchanged legacy lock 752817cc4fc1110aa055324bedb2b9e2b7da7f87445b48c8290ebb53ea3d85d7 |
| 69 | internal/host/rootseedsfloor.go judgeRootSeedsPrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=evaluates signed current and prev seeds support under shared durable floor judge and independent downgrade completeness 79ac6f71f9588f9f7757663ca7a9bc2d014253ff93153949ec30fd17d3cbc9d4 |
| 70 | internal/host/rootseedsfloor.go readEffectiveSeedsFloor authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=census selects verified signed publication plus capped retained deny; unpublished seeds impose no bound; no census retains legacy reader 442d96d3a887c3c039dcedd847bf93be17ad08500399a3350d4f0bf8bac593e4 |
| 71 | internal/host/rootseedsfloor.go readRootSeedsBinary authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt seeds judgement and root system apply/recover candidate checks, uid 0;basis=delegates checked signed executable read then selects seeds protocol 8b34c01e9a76ddd185202ea9c8542ed0a1c1aca196e26e129507fa03e9610a89 |
| 72 | internal/host/rootseedsfloor.go refreshRootSeedsFloor authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=merges authoritative store floor with denial-only legacy seeds maxima into durable independent root state 71dba1c8ba30ea5bc00dbe03860b20b90f6882e58d0b09be478f170990a7c975 |
| 73 | internal/host/rootseedsfloor.go rootFloorBinary.forSeeds authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover and root adopt uid 0;basis=projects signed SeedsProtocol (zero when absent); comparisons are gated by verified signed publication and available certified builds b84949e21b9955da9d37594e604f5a4340b5f2bb073866d77feb5b901d3a7de8 |
| 74 | internal/host/rootseedsfloor.go rootRefreshAndJudgeSeedsPrev authority F,J4 rev3=PROPOSED-p3;identity=carlos adopt and system apply refresh, uid 0; no recovery or boot-selector call;basis=normal adopt/update refreshes root seeds state under prev exclusion; recovery never calls this remote path d65b77431479fa0989ed6f7a486406f8ba176b6035868e4738b1e14e29ba9782 |
| 75 | internal/host/rootseedsfloor.go rootSeedsAllowsBinary authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=compares signed seeds protocol to published root bound only while a certified current, prev or staged candidate meets it; no remote reads 3ad939d98ed7cf0fc5b96e9a762ede3caa69637ae45aed0aacf46eb1d4881a1d |
| 76 | internal/host/rootseedsfloor.go rootSeedsFloorDir authority F,J4 rev3=PROPOSED-p3;identity=root adopt refresh, root system update/recovery and root guard floor readers, uid 0;basis=selects fixed seeds namespace separate from moves retained floor a4971110cfd11c46b8fec4f21e36101bce537014b52a5cd60acce87204fc8f26 |
| 77 | internal/host/rootseedsfloor.go systemApplier.rootProtocolAllowsBinary authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=final installation restore or forward-completion checks signed image against both local root bounds while activation locks are held 9e0321c02fe9ea45685804b9435f340f75117d9e444c98b794676ea66103955e |
| 78 | internal/host/rootseedsfloor.go systemApplier.seedsActivationRefusal authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=refuses activation below selected local seeds release bound; missing unknown history grants no acceptance projection abc430ca5063fde4bcfdd0a795c1f593324c0dce6f6d9330abbb519917e07aa7 |
| 79 | internal/host/rootseedsfloor.go withRootSeedsFields authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=advertises only checked synced root seeds projection matching deployment and box; no valid projection stays quarantined file:Open@413,file:Read@531 f53f45621ab1e7bba07315980de981b321826b5985350489ee686d952480bc13 |
| 80 | internal/host/seedsfloor.go systemApplier.armSeedsFloor authority F,J4 rev3=PROPOSED-p3;run=15;identity=normal root apply uid 0;basis=normal apply refreshes root seeds history on census participants; nonparticipants retain legacy sync; never called by recovery or boot ace92bbe72e79e998daeebfe5fc2380ce6174cc0241b60a26e0093bea614bce1 |
| 81 | internal/host/seedsfloor.go withSeedsFields authority F,J4 rev3=PROPOSED-p3;identity=carlos agent in carlos-edge.service uid carlos;basis=root participation selects checked root projection; legacy agent mirror remains unchanged for nonparticipants file:Lstat@84 57febc09559f80119ba36ca13188febf0ceb27bcdc29d829403798aba1cb6f1d |
| 82 | internal/host/systemapply.go RunSystemApply authority D,F,J4 rev3=PROPOSED-p3;run=15;identity=root apply/recovery uid 0;basis=registers local verifier and invokes census-gated release wrapper; absent census executes main apply directly even with leftover release state 9111d10530cef84980095152bb1a8be5c3299c6fcdc2c0a50b3055957541f0d8 |
| 83 | internal/host/systemapply.go systemApplier.activationGuard authority D,F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover root units and offline root CLI uid 0;basis=release exclusion then scoped participation transaction then effective moves/seeds floor and registry; signed candidate checks remain inside guard; nested journal close reuses live exclusion whole:Route@1315 9d8cb52184b6fd2c4a071962515b0162a99af758954c18b72384e8e9c29fd7c8 |
| 84 | internal/host/systemapply.go systemApplier.activationRule authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=preliminary activation refuses against both local protocol bounds before existing hold checks whole:Route@1036,whole:Route@827,whole:Route@834 d7a045107010e06f1b93f2920b42d0b464c6a0a71ed5cad0d15c2473fd81c191 |
| 85 | internal/host/systemapply.go systemApplier.armFloor authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=normal update refreshes root moves and seeds histories in census mode; unknown history remains unacknowledged; no recovery or boot refresh d7e16eaaa3994896bf9acd763777cc4d8998056dfa2d492c5320395102009a16 |
| 86 | internal/host/systemapply.go systemApplier.floorAllowsForward authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free forward recovery checks both locally retained protocol release minima 895c51429034ebfbbabdf78005c91199570eb050b09e37a1a9927fcafcb12f3b |
| 87 | internal/host/systemapply.go systemApplier.floorArmed authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=dormancy decision includes unreadable or present moves and seeds floors from selected authority 13a51640e1a6855a4c5b96bee413c73a68f362591e889ed9d3730ac41151456b |
| 88 | internal/host/systemapply.go systemApplier.install authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=root verifies staged signature and final locked bounds before rename, then records root accepted floor history only after health succeeds 6906a6aab336744abc1e7827a23271419aed28bb94d75e6c124f04daed4807ec |
| 89 | internal/host/systemapply.go systemApplier.layoutReversalReasons authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=root participation and retained floor contribute refusal reasons before layout reversal ee4e5ee2961e86b6d2e700601d57bb605c3c945515ffc678d35919d70dc2b0af |
| 90 | internal/host/systemapply.go systemApplier.notePrev authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=writes prev then judges both signed protocol identities under root floor authority on census boxes 2642cc413f5eb6a3f5661eff6452798c296c1199037f4699d5fff0fa00ca6335 |
| 91 | internal/host/systemapply.go systemApplier.recoverIfNeeded authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=network-free recovery uses local root floors and rechecks signed image at final forward-completion boundary 0c6ee48144a35e6b5dd5ced22a6696499af569309005e1499fabb18ec00b5d31 |
| 92 | internal/host/systemapply.go systemApplier.restoreFiles authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=selects signed prev identity and checks staged restore against both root bounds before rename; version sidecar cannot authorize file:Stat@226 e8da90cfbc93a5a66155603c602d95d1a0e9ad4fd4993dc978bca8eef3337d17 |
| 93 | internal/host/systemapply.go systemApplier.restoreVersion authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=census rollback and recovery completion use signed previous executable identity; legacy sidecar remains only without census 57cf91fc81568e5b1ce05428ed928242c825c6847bb193333137845c7190d6c4 |
| 94 | internal/host/systemapply.go systemApplier.verifyPointer authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=signed pointer verified and independently cached for census target execution before earlier history exists 50961a77b1c9b4e915302c6b95cd57d9f0bbc238e7bd00b94f06a5960ab541c1 |
| 95 | internal/host/units/carlos-system-recover.service external authority F,J4 rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor file:external@0 f16b260868c4b258c804b3a4720e17f02f6c020eda9dcc2a67d2ca032a077b45 |
| 96 | internal/host/units/carlos-system-update.service external authority F,J4 rev3=PROPOSED-p3;identity=systemd update/recover oneshot shell uid 0;basis=guard branch is conditional on executable presence; unarmed units retain main selector; installed guard selects from root local floor file:external@0 cfcaeea6308021ce5a7cb088464e8df3abc6b03ffaa0c7a0153c6d91bf1e3fd6 |
| 97 | internal/hostbox/migration_census_linux.go CheckMigrationRoots authority G,J4 rev3=PROPOSED-p3;run=18;identity=offline root migration uid 0;basis=accounts for trusted vendor systemd links separately from retained installation artifacts without exempting unknown files or CARLOS unit aliases file:Lstat@932,file:WalkDir@1202 a1d328f353b814f6f26b5e71f749e1cc3ca10a02bfe7c9ae8833da0ebd755d77 |
| 98 | internal/hostguard/guard.go record.admits authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root admission retains migration denial until the exact predecessor session has a completed retained receipt 5864d1fa79a66ca6f69057416079b46524ed4bfdf1ce1de88124b5a24a428418 |
| 99 | internal/hostguard/root.go Guard.CommitRootInventoryArtifacts authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=root inventory commit admits a newer migration writer only after its exact predecessor completed; old sessions stay denied 08e42f8810e2645a875b5177fc9e104ed4b307c7d80dc77d204e2516b1bd66de |
| 100 | internal/hostguard/root.go RootAuthority.read authority C,G,J4 rev3=PROPOSED-p3;run=15;identity=root control/startup/generation uid 0;basis=validates active stamp equality; inactive identity is the exact last root-retained retired tuple, including repair of older records with cleared installation stamp file:Read@175 5c2c9ab014458e086f6df9255e1d967a96fd78cd1e599b891d8369c8506421f8 |
| 101 | internal/hostguard/root.go RootAuthority.write authority C,G,J4 rev3=PROPOSED-p3;run=15;identity=root control uid 0;basis=persists inactive state while retaining historical installation stamp, registration and artifacts; only a nonzero active stamp replaces the retained stamp 5f6db65d9de7b98b119f5f124189e0322336835c9c80fb6c253bb828cfc9e9d2 |
| 102 | internal/hostguard/rootmigration.go RootAuthority.RetainMigrationDeny authority C,G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=root retains old incarnation/stamp/session denial under stable per-host lock; grants no launch authority fb821d19b6ca6e1454d025013d27ef8a856a684262421d3ee76804723e875c37 |
| 103 | internal/hostguard/rootmigration.go migrationAdmissionDenied authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=old migrated sessions remain denied; a newer same-installation session requires completed receipt for every retained migration predecessor c7312f5e0e67b2b69bbea1b8f432dd48ba06f0b4a26ebf349b6724769651631e |
| 104 | internal/hostguard/rootmigration.go migrationDenied authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=old sessions at/below retained captured stamp refuse root and agent admission 6ccf5c00e33d880aa50ea15d2bce22a3cce14455d5cc7f05197e42f789da8805 |
| 105 | internal/hostguard/rootmigration_inventory.go RootAuthority.MigrationInstallations authority C,G,J4 rev3=PROPOSED-p3;run=15;identity=root migration/startup uid 0;basis=enumerates active and retired installations from preserved root installation identity; incomplete inventory remains visible, pending transactions must settle before complete enumeration 8c4dee4b5af31ce13c581b20c5cde79f1917720b80e558dda6766cf8548f2a02 |
| 106 | internal/hostguard/rootview.go FenceView.admit authority G,J4 rev3=PROPOSED-p3;identity=root claim controller construction uid 0;basis=read-only root view applies same predecessor-completion requirement as locked admission 5bcc6b69bb3e98a1bda6ace2b0b2a147f8c39b61601c609c30e3fb806231efae |
| 107 | internal/hostguard/rootview.go Guard.fenceLocked authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root-only migration denials into agent admission snapshot without trusting local hostguard records 290295ed69e06548a41e101317098ae2d6aac10c41b260e120af55860686a96d |
| 108 | internal/hostguard/rootview.go RootAuthority.viewLocked authority C,G,J4 rev3=PROPOSED-p3;identity=carlos instance-control, root control service uid 0; denial views also consumed by carlos agent uid carlos;basis=projects root migration denials together with canonical installation and existing fences 5db6824b38f6ad3e4072008ffa3ff9fab98db6a5d40ecba59ca30900e331a46f |
| 109 | internal/rootstate/fault_rootrunner_linux.go WithWriteFault diagnostic A,F rev3=PROPOSED-p3;identity=rootrunner test binary uid 0 only;basis=rootrunner-only wrapper injects failures into the same validated production write steps; absent from shipped binary 31c00dbe4dd1441867d2a1184598be8a8fc5aa743e6f4227968b3b7f50d9c11d |
| 110 | internal/rootstate/fault_rootrunner_linux.go faultStore.Write diagnostic A,F rev3=PROPOSED-p3;identity=rootrunner test binary uid 0 only;basis=rootrunner-only descriptor-backed fault wrapper, never a production authority source 353d08820be5e4ecf0076826fc5e46b00ce7bbb5a8f831e05e7e50225a72aded |
| 111 | internal/rootstate/state.go Sync authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=syncs an existing checked root descriptor before acknowledgement 2e5d0a1411eff4cfb942f20517ecc2653a05ae3e4d586c14092d65de48ceff02 |
| 112 | internal/rootstate/state_linux.go directory.Sync authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks private descriptor identity then fsyncs directory durability b932169c2132a038eb12459c8537f0f308d4ba5987d5d3f296f2bd435f598fe3 |
| 113 | internal/rootstate/state_linux.go directory.Write authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=delegates to shared validated durable-write implementation; production syscall behavior unchanged 3d117162b0a08938a6a1f83fa57dadcb0abda157565feb96159063db4505c67a |
| 114 | internal/rootstate/state_linux.go directory.write authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=rechecks descriptor and uses same validated durable write for production and privileged fault wrapper file:Read@289 87c8f8ba3b34012a0bafb198116719039215ac34b0d09d0ff705a5eb22cb2f35 |
| 115 | internal/safefile/fault_rootrunner_linux.go WriteAtFault diagnostic A,F rev3=PROPOSED-p3;identity=rootrunner test binary uid 0 only;basis=rootrunner-only seam runs actual safefile operations before/after chosen interruption dff2fd53a3561df3aa04b6f7462ab62c4cc32c826d152464989b6a399d83056c |
| 116 | internal/safefile/file_linux.go writeAt authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=production wrapper always invokes each real syscall operation eadb1d4dd961ebc7dc7ba8a469669003695d618d6c0dc13794763c7fa881d22c |
| 117 | internal/safefile/file_linux.go writeAtSteps authority A,F,G rev3=PROPOSED-p3;identity=checked filesystem callers including root control/apply/migration uid 0;basis=checked staged file write, chmod, sync, close, rename and parent sync propagate interruptions before acknowledgement file:Fstat@1116,file:Fstat@700,file:Openat@522,file:Openat@875,file:Read@277 865b847b97df6753e1abd16a00d018d27cdabdd23c96d42a97b381103d088d21 |
| 118 | internal/host/rootmigration_collect_linux.go migrationStopKernel.RecoverStopped authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=requires dead controller or changed boot plus closed settled root writers; observes real proc descriptors and exact cgroups; compares typed inventory and journal on both sides; records current evidence time downstream file:Read@327 75895f820e1bc7ad3ce1c6dd501655617967ab06631e0e4962e23c54a54ae8d8 |
| 119 | internal/host/rootmigration_collect_linux.go recoverMigrationStop authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=preserves exact signed or retained receipt; absent signed evidence selects fresh collection only from previously authenticated root journals; begins root fence before observation 4649b2f1a9ee44d7509e57a9fad03e880c19075dbc34141a9a5ce3ad17c6414e |
| 120 | internal/host/rootmigration_collect_linux.go type migrationStopKernel authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate uid 0;basis=root-only offline collector owns checked root journals and managed roots; no legacy candidate can supply inventory authority 09680751d01d45098f9f98b672ec8db92ef0fc55bee36fae45dfd79981456f70 |
| 121 | internal/hostbox/journalnamespace_linux.go prepareJournalDirectory authority C,G,J4 rev3=PROPOSED-p3;run=19;identity=root journal startup uid 0;basis=also permits exact private root-owned unit-bindings and unit-materializations directories created by production startup; ownership, mode, type, symlink and unknown-directory refusals remain file:Fstat@1026,file:Fstat@436,file:Fstatat@1357,file:Open@177,file:Openat@585,file:Openat@843,file:ReadDir@1242 71cbb78f96ab5d846f1d4b54f299ad4b70fc5c6067ed9ea5b40d77f746b40628 |
| 122 | internal/host/rootfloor_available.go rootFloorAvailable authority F,J4 rev3=PROPOSED-p3;identity=root system apply/recover candidate checks and carlos.prev floor-allows-prev via seeds gate, uid 0;basis=checks signed current, retained prev and fixed staged candidate; a floor constrains replacement only if a qualifying certified copy is available ebd8e7e71f9b8fd6ae3fdffc069f33edcc8495a9b07f50e599ec909d708a1af2 |
| 123 | internal/host/rootfloor_available.go systemApplier.activationFloor authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply/recover, root systemd units or offline root CLI, uid 0;basis=keeps no-census main behavior; logs once and permits repair when no available signed copy supports the bound 63bcfdafa93a5091ee4316949a370998684c4e50903453f44436e6cd42a8ac37 |
| 124 | internal/host/rootfloor_healthy.go rootMovesFloors.acceptHealthy authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply after successful root health gate, uid 0;basis=after successful root health gate, retains highest accepted build and publishes accepted floor only when that build supports it 3acf2e05253de53bccc1065ded12cdd58be324147ec3f3e21ad99eb145a121d5 |
| 125 | internal/host/rootfloor_healthy.go rootMovesFloors.capLegacy authority F,J4 rev3=PROPOSED-p3;identity=root normal adopt/apply refresh and local seeds-bound readers in apply/recover/guard, uid 0;basis=caps service-written protocol and release minima by highest root-observed healthy build; absent observation supplies no bound e0bae88798131dab8e4a1bdc36e70f734d832d11913d3357d2620e609c49c0ee |
| 126 | internal/host/rootfloor_healthy.go rootMovesFloors.healthy authority F,J4 rev3=PROPOSED-p3;identity=root health acceptance, normal floor refresh and local seeds-bound readers, uid 0;basis=reads bounded private root health record; missing or malformed record supplies no legacy cap file:Read@76 a8602fda732b5512a518682c1684669e6f720316cb688826288ba37f6cf9abc0 |
| 127 | internal/host/rootfloor_healthy.go systemApplier.acceptRootFloorHealthy authority F,J4 rev3=PROPOSED-p3;identity=carlos system apply, root update unit or offline root CLI, uid 0;basis=reads signed installed bytes after the system health gate; writes independent moves and published-seeds root observations 3d5e545620a844ef8ba3ef051c4d01e90a610ea5dfed729d6d1ccb13ad9fc0a9 |
| 128 | internal/host/rootfloor_healthy.go type rootFloorHealthy authority F,J4 rev3=PROPOSED-p3;identity=root system apply/adopt health or floor decision uid 0; recovery readers uid 0;basis=binds a root health observation to deployment, box, enrollment and signed binary identity b030521054f1abd3f283dad5e07d82404c8711e403dd35e27f894da50cedcc1e |
| 129 | internal/host/rootmovesfloor_boot.go rootFloorAllowsPrevIdentity authority F,J4 rev3=PROPOSED-p3;identity=carlos.prev system floor-allows-prev --root, invoked by root guard selector, uid 0;basis=checks local signed prev and independent moves/seeds bounds using root census identity; no remote reads 7ed04451ef25a56b8856f348b06a20689d4d3a286163c1bb03715ca1d97a7039 |
| 130 | internal/host/rootmovesfloor_boot.go rootFloorJudge.permits authority F,J4 rev3=PROPOSED-p3;identity=root guard-exec apply/recover selection and carlos.prev floor-allows-prev, uid 0;basis=signed current, retained prev and fixed staged candidate determine whether a below-bound candidate must be refused; no available qualifying build preserves recovery d844f06e9efb1fff3fccb8ce9c3ffa46d11f36a7a6da7ba048126962564496ba |
| 131 | internal/host/rootseedsfloor_publication.go acceptRootSeedsPublication authority F,J4 rev3=PROPOSED-p3;identity=normal carlos adopt and system apply remote floor refresh, uid 0;basis=under stable floor lock, retains only verified nonregressing signed seeds publication; no publisher or activation switch added file:Read@299 c767add885a3f0665589918fd62ff1ed05780c583217d6b3debca84f4e2dee87 |
| 132 | internal/host/rootseedsfloor_publication.go readRootSeedsBound authority F,J4 rev3=PROPOSED-p3;identity=root normal adopt/apply refresh, system apply/recover and guard floor readers, uid 0;basis=unpublished seeds supplies no bound; verified retained publication and root-capped denies determine the bound file:Read@277 df752a44139e605ee13dc0103d8e2b25111bad6758aaaf31cb392312903bd7b5 |
| 133 | internal/host/rootseedsfloor_publication.go type rootSeedsPublication authority F,J4 rev3=PROPOSED-p3;identity=root normal adopt/apply floor refresh uid 0; local bound readers uid 0;basis=domain-separated signed seeds publication binds deployment and protocol object purpose a69c991db71defd5ca0f512c07327df6bfc25ada992b8f7affd5b560cb930de8 |
| 134 | internal/host/rootseedsfloor_publication.go verifyRootSeedsPublication authority F,J4 rev3=PROPOSED-p3;identity=root protocol readers uid 0; edge advertisements from public root projection uid carlos;basis=verifies canonical root signature, deployment, purpose, schema and protocol minimum; unsigned source cannot arm seeds 7c992d8e3374bb183942c3fc6ff666b342b0506319e6989258d365857099ec74 |
| 135 | internal/rootparticipation/migration.go Ledger.MigrationCensus authority G,J4 rev3=PROPOSED-p3;identity=carlos system journal-migrate offline uid 0;basis=under participation transaction exclusion, preserves completed census revisions, refuses foreign pending state, and revokes failed completion file:Read@207 6a572bf17012a7ff51b4e70401e40abeca593fcc760f76a5354e60a3e06c6b41 |
| 136 | internal/rootparticipation/ledger.go Ledger.Acquire authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Clear pending acquisition on a returned commit failure while preserving durable record-based exclusion. file:Read@330 9737daf352e7e7e850c7dea8b1176d689624093cc91c2d869bf9052ca8782773 |
| 137 | internal/rootparticipation/ledger.go Ledger.BeginUpdateWith authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@299 93d58cd04c1a44bf0941ae67b79d802824b4b4c18bca7670efa8ec38e5ffe2b1 |
| 138 | internal/rootparticipation/ledger.go Ledger.EndUpdateWith authority D rev3=PROPOSED-p3;identity=root system apply/recover and root participation callers uid 0;basis=retains existing census authority and same-ledger transaction exclusion; nested activation journal completion reuses live root-held context; Root census and transaction lock exclude acquisition and update; interrupted intents clear only after positive launch completeness. file:Read@232 617e3c537aa3d14e2bdca861e2fc4383440d480039d0f9a5d71f0df55ecff959 |
| 139 | internal/rootparticipation/transaction.go Ledger.WithTransaction authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=takes participation before the effective floor and registry; releases on every return and invalidates the scoped token bc8987eb815fa2f5ac71eef1778f04879c3fceab7c4873b515b45d4dd154d485 |
| 140 | internal/rootparticipation/transaction.go Ledger.lockTransaction authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=reuses transaction exclusion only for the identical root store; foreign stores refuse 8954ca0b1bc5ff9a3b9b95a21534b52069d0d1bb1590cdc54fccb8c2f05c234c |
| 141 | internal/rootparticipation/transaction.go TransactionLedger authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=returns only an active root-minted held ledger; stale and cancelled scopes refuse 2046fbd7b7ec9455794dbaf614ea4cb50b9147929004434a172a67656fb7ff63 |
| 142 | internal/rootparticipation/transaction.go type heldTransaction authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=binds transaction reuse to a root-opened ledger and live callback lifetime 4769022372ba86be2255c15a53c5d7acd88bc9e50652391e84284a436ae615c7 |
| 143 | internal/rootparticipation/transaction.go type transactionKey authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover uid 0;basis=unexported key prevents callers from forging the held participation scope c309e812e20a85927d3cc93c8048d811c7187137797ad76646cc12f892d82a63 |
| 144 | internal/host/systemapply.go systemApplier.runWithRelease authority D,F,J4 rev3=PROPOSED-p3;run=15;identity=root update/recovery uid 0;basis=retained floor identity permits restricted acquisition recovery; participating execution holds release exclusion; no-census effect is main Run directly 462d91eb211467885431108bc352b1913ea430fca5602434fc9fd7ef39713efa |
| 145 | internal/hostfloor/disk.go Disk.withParticipation authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=uses a live root-minted scoped ledger only for its original store; otherwise opens the ordinary census; absent census keeps legacy behavior 3bf4a54d1ab3621eee974a797ffa63a988369b9f245ceddde1cb99cc6386ec82 |
| 146 | internal/rootparticipation/ledger.go Ledger.Idle authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=checks settled execution and local launch completeness under participation; nested activation uses only its already-held store e50d8f839d39f771ad4b6018f315cd7002a6e470424df0a46482906c31ef575e |
| 147 | internal/rootparticipation/ledger.go Ledger.RecoverAcquisition authority D,F,J4 rev3=PROPOSED-p3;identity=root system apply/recover or root participation caller uid 0;basis=retains acquisition-recovery checks and census commit under the same participation transaction; no new authority from a missing record d1f44274ba0a53aae7e39ce016da787748123665bda0cdf7a40339a4fc52e9fc |
| 148 | @remove internal/activator/rolelaunch_linux.go RoleLaunch.prepareRoleReservation |
| 149 | @removed internal/activator/rolelaunch_linux.go RoleLaunch.prepareRoleReservation C,J1 census-ruling-J4 |
| 150 | @removed internal/host/claimjournal_migration.go migrateClaimJournals G,J4 census-ruling-J4 |
| 151 | @remove internal/host/claimstate_linux.go prepareClaimDatabaseOwner |
| 152 | @removed internal/host/claimstate_linux.go prepareClaimDatabaseOwner C,G,J4 census-ruling-J4 |
| 153 | @remove internal/host/movesfloor.go rootJudgeMovesPrev |
| 154 | @removed internal/host/movesfloor.go rootJudgeMovesPrev F,J4 census-ruling-J4 |
| 155 | @remove internal/host/proofnamed.go proofBindingSource.capturedVersion |
| 156 | @removed internal/host/proofnamed.go proofBindingSource.capturedVersion B3,J1 census-ruling-J4 |
| 157 | @remove internal/host/proofnamed.go proofBindingSource.installedConsoleVersion |
| 158 | @removed internal/host/proofnamed.go proofBindingSource.installedConsoleVersion B3,J1 census-ruling-J4 |
| 159 | @remove internal/host/proofobserve.go recordSettled |
| 160 | @removed internal/host/proofobserve.go recordSettled B3,J1,J4 census-ruling-J4 |
| 161 | @remove internal/host/rootgeneration_kernel_linux.go generationMajor |
| 162 | @removed internal/host/rootgeneration_kernel_linux.go generationMajor E2 census-ruling-J4 |
| 163 | @remove internal/host/rootgeneration_kernel_linux.go generationMinor |
| 164 | @removed internal/host/rootgeneration_kernel_linux.go generationMinor E2 census-ruling-J4 |
| 165 | @removed internal/host/rootmovesfloor_source.go readRootLegacyFloorJSON F,J4 census-ruling-J4 |
| 166 | @remove internal/host/rootrestart.go rootRestartRoute |
| 167 | @removed internal/host/rootrestart.go rootRestartRoute B3,J1 census-ruling-J4 |
| 168 | @remove internal/hostbox/hold.go ChangeHold |
| 169 | @removed internal/hostbox/hold.go ChangeHold C,J2,J4 census-ruling-J4 |
| 170 | @remove internal/hostbox/stopinventory_db.go OpenStopInventoryDB |
| 171 | @removed internal/hostbox/stopinventory_db.go OpenStopInventoryDB C,J2,J4 census-ruling-J4 |
| 172 | @remove internal/hostfloor/participation.go CheckParticipation |
| 173 | @removed internal/hostfloor/participation.go CheckParticipation D census-ruling-J4 |
| 174 | @remove internal/hostguard/root.go Guard.CommitRootInventory |
| 175 | @removed internal/hostguard/root.go Guard.CommitRootInventory E2 census-ruling-J4 |
| 176 | @remove internal/release/materializeheld.go PublishHeld |
| 177 | @removed internal/release/materializeheld.go PublishHeld C,E1,J1 census-ruling-J4 |
| 178 | @remove internal/release/materializeheld.go ServeHeldStageRequests |
| 179 | @removed internal/release/materializeheld.go ServeHeldStageRequests E2 census-ruling-J4 |
| 180 | @remove internal/release/materializeheld.go StageHeld |
| 181 | @removed internal/release/materializeheld.go StageHeld C,E1,J1 census-ruling-J4 |
| 182 | @remove internal/release/roothistory_delivery.go PublishHistoryReconstruction |
| 183 | @removed internal/release/roothistory_delivery.go PublishHistoryReconstruction E1 census-ruling-J4 |
| 184 | @remove internal/release/roothistory_delivery.go PublishHistoryRecoveryRetirement |
| 185 | @removed internal/release/roothistory_delivery.go PublishHistoryRecoveryRetirement E1 census-ruling-J4 |
| 186 | @remove internal/rootparticipation/ledger.go Ledger.EndUpdate |
| 187 | @removed internal/rootparticipation/ledger.go Ledger.EndUpdate D census-ruling-J4 |
| 188 | @remove internal/rootparticipation/production.go ActivationReady |
| 189 | @removed internal/rootparticipation/production.go ActivationReady D,G census-ruling-J4 |
| 190 | internal/historyreadback/readback.go RequestStatus diagnostic E1 rev3=PROPOSED-p3;identity=diagnostic request library, no production caller;basis=P3-R8 #2; signed readback request only; no reconstruction or retirement d89052b0cdd12c8c8dcbc353e9ae995005caeb88d8e4c70974cb9e6f4bfd46d7 |
| 191 | internal/hostbox/migration_census_other.go CheckMigrationRoots hint G,J4 rev3=PROPOSED-p3;identity=non-Linux offline migration caller;basis=P3-R8 #17; unsupported platform refusal only 594ecda260fcf80baf5a2709c9cc5a04e91c655c8bd2f7ac307eef44216eb9c8 |
| 192 | internal/host/rootmigration_production_linux.go migrateRootClaimAuthority authority G,J4,E3 rev3=PROPOSED-p3;run=15;identity=offline root migration uid 0;basis=requires masked inactive root mutator units and no running legacy root command under mandatory release exclusion; ordinary nonparticipants acquire no migration lock file:Open@1769,file:Open@374,file:Open@615,file:Open@7063,file:Open@739,file:Read@2721,file:ReadFile@1571,whole:Route@3034 9be47c70f4fb2a1d3c280814525085b261e9514e79df6f8918a0e67f9e6724d8 |
| 193 | internal/host/rootmigration_timers.go rootMigrationTimers.adopt authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=offline migration binds the exact observed pre-claim registrations to root retained stop evidence and denies; durable intention precedes conditional registry adoption and root inventory completion registry:ClaimOwner@1997,registry:ClaimOwner@2135,registry:ClaimOwnership@1860,registry:ClaimOwnership@1914,registry:ClaimOwnership@4009,registry:ClaimOwnership@4202,registry:ClaimOwnership@4314,registry:Host@1836,registry:Host@4107,registry:Name@1677,registry:Name@4122,registry:Registration@1153,registry:Registration@1785,registry:Registration@1810,registry:Registration@1962,registry:Registration@2117,registry:Registration@4046,whole:ClaimOwnership@1864,whole:ClaimOwnership@1918,whole:ClaimOwnership@1936,whole:ClaimOwnership@4015,whole:ClaimOwnership@4211,whole:ClaimOwnership@4320,whole:Route@2456,whole:Timer@1067,whole:Timer@1073,whole:Timer@1101,whole:Timer@1663,whole:Timer@2304,whole:Timer@3896,whole:Timer@3911,whole:Timer@3980,whole:Timer@3998,whole:Timer@4179,whole:Timer@4190,whole:Timer@4304,whole:Timer@4383,whole:Timer@4394 35914f3267326de830fb7c149bf330638cb49794a3e8c6f41445078a92669a04 |
| 194 | internal/host/rootmigration_timers.go rootMigrationTimers.load authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=reads only the root-private saved adoption intention, requiring the same host, incarnation, stamp, session and enrolled box; preserves exact registration IDs on retry file:Read@145,registry:Registration@844,whole:Timer@668,whole:Timer@846 f58c918185b3c382e5c1545f441cb589157b0c6cf60bb54322ca7edf40f1c1c9 |
| 195 | internal/host/rootmigration_timers.go rootMigrationTimers.key authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=scopes the durable timer adoption intention to the root-observed installation and denied session 76a349236e49d55a5b9866b86ea60aa56a7a5b179b7b77b82d87535f0a305f0c |
| 196 | internal/host/rootmigration_timers.go rootMigrationTimers.owner authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=derives installation ownership from root-observed host, incarnation, stamp and box, never a service row owner a9dda27d00a9505d75099c75964643d20219dc8b1a0bfa64d3f1060ef85c111f |
| 197 | internal/host/rootmigration_timers.go type rootMigrationTimerRecord authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=retains original stopped inventory, exact observed timer contents and registrations, successor inventory and root revision through interrupted migration 653d1a8f608c1bb1965881928b652dffe419db0697bd2b3ce09ac40c7f59af34 |
| 198 | internal/host/rootmigration_timers.go type rootMigrationTimers authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=holds root-private migration state, root inventory, root fence authority and isolated registry interface under offline exclusion dc83f25eaae718327601d7d19c2c93f56e589cc176405c6249e9ea4e3c864c34 |
| 199 | internal/hostguard/rootmigration.go RootAuthority.CompleteMigrationInventory authority G,J4 rev3=PROPOSED-p3;identity=offline migration root uid 0;basis=root fence completion binds the migration inventory revision; timer adoption permits only its exact previous revision plus one and recommits visible failed writes 2cae20b131f8095abb56be863ed457b0cb22c42d28d486488edc83ba9d519986 |
| 200 | @coverage . 2145f21807743eb683387a61738d6bb16d9c41d7d69a9071dbac765ccd9ec2d6 |
| 201 | @coverage internal/activator 6c7d3e5f221891dde6ea156c12c8d04fd5a13e377cedb660eca0ccb7f67ff693 |
| 202 | @coverage internal/console 7702e7033dee36caa5129394955cb70d09ed5b3fd81dbf752ff37fdf2ed4edef |
| 203 | @coverage internal/edgesfile e0a7dd2795beedde4d17389b96b562f3f9438ad8505ea19a62d1e9c4b921aefb |
| 204 | @coverage internal/host/units bf6ae516012701e0ca41908167e4efd60dd3c2c24e9af1555dec077e8be44461 |
| 205 | @coverage internal/hostfloor 696e5ea4fa37b924b68e8e262235b99298ee19342d875213ba8209e5287dd3c6 |
| 206 | @coverage internal/release 3ce49ae65713e165924e659dbe17f3c2263583b1db7a80754a07748c12ecf8f6 |
| 207 | @coverage internal/rootparticipation 7798d05a815af052b9b40d4ff381834a58b2740082e8f673c173e34cb3ce4f22 |
| 208 | @coverage internal/rootstate 65d82ca158604732171c8f7b46546f7e4d8d0a925e2608d20289e77fe4ea3725 |
| 209 | @coverage internal/safefile 7030f312f7a60487381f0dbae2cdecaaa83625b639b6af15104f912592550816 |
| 210 | internal/host/rootgeneration_kernel_linux.go generationKernel.absent authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=bounded task and persistent generation inspection retains boot and process start checks; refusal diagnostics identify the failing task file:Readlink@312 9aee837e918fbc1cc6f16bbf8e6b5652a700cf0c767d99150cac3e87bb03d2a3 |
| 211 | internal/host/rootgenerations_launch.go productionRootGenerations authority E2,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=connects the census root generation source to independent runtime failure and served settlement;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Open@386 e5a3f19159348abed074b2e2c01f9e611e47783395e5f3d063b7c1a657145a92 |
| 212 | internal/host/rootgenerations_launch.go rootGenerationSource.resolve authority E2 E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.;rev3=PROPOSED-p3;run=8;identity=root claim launch uid 0;basis=captures persistent executable and tree proofs only after canonical installation and signed artifact verification under exclusion;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Open@2501 3cd7c8132e9c451c983392f4d1cc676ddc14b761c90dec3e631d54ae800f9951 |
| 213 | internal/host/rootgenerations_launch.go type rootGenerationSource authority E2,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=binds production runtime authority and persistent file capture to the root launch source;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures f291da85d463e50322a32fed1208629c6bf991112c4e8f614d9bf30bdb0338f5 |
| 214 | internal/host/rootupdates.go initializeMigrationFailures authority G,E3 rev3=PROPOSED-p3;run=8;identity=offline journal-migrate uid 0;basis=requires complete root census before creating migration-bound root failure book; missing legacy history supplies no known refusal file:Open@254 5f7f652988f3def733e1b525260a52fac3568242960468e5457975ced1cd41d8 |
| 215 | internal/host/rootupdates.go productionRootUpdates authority E3 rev3=PROPOSED-p3;run=20;identity=root update/adopt uid 0;basis=ordinary callers retain independent host locking through the shared opener b75a0937953dae3f2bbe1f9d9b7598eca6aa3add1f9c70d564a21f5412217f8d |
| 216 | internal/host/rootupdates.go rootFailureLegacy authority E3 rev3=PROPOSED-p3;run=10;identity=root adoption and offline migration uid 0;basis=bounded nonblocking regular-file read supplies optional exact retry mirror identity or one-time migration deny evidence; refuses symlinks and special files file:OpenFile@65,file:ReadAll@265 efae62d1b996f14baa592e39e0cc22e0f5c8cde5cd94f429498d41039f5a70e4 |
| 217 | internal/host/rootupdates.go rootUpdateSource.resolve authority E3 rev3=PROPOSED-p3;run=20;identity=root launch/update uid 0;basis=launch uses exact retained installation and census validation without reacquiring its held host lock; ordinary updates still lock independently; existing settings and failure authority retained file:Read@1537,file:Read@1610,registry:Account@2138,registry:Account@3023,registry:App@2176,registry:App@3068,registry:BuildState@1372,registry:GoodDemand@1338,registry:GoodDigest@1323,registry:GoodVersion@1307,registry:Host@2110,registry:Host@2988,registry:ServingVersion@1353,registry:Unit@2719,whole:Route@2116,whole:Route@2144,whole:Route@2182,whole:Route@2351,whole:Route@2358,whole:Route@2778,whole:Route@3001,whole:Route@3036,whole:Route@3081,whole:Route@3849,whole:Route@3857,whole:Route@5485,whole:Route@5492 6c5c447d2abd518a941979dcd1748ee028f3b555ce077fad849c02be0c77c2fa |
| 218 | internal/host/updatesroot.go updatesPassOption authority E3 rev3=PROPOSED-p3;run=8;identity=root adopt uid 0; unchanged agent opener uid carlos;basis=installs census-only root input provider while preserving the legacy failure-book opener for nonparticipating passes 4f66774059952bda531435d68487fa032a95b8d1c8ca33ec8b71b6639fa117e3 |
| 219 | internal/release/adopt.go PassFilter authority B3,E3,J1,E1,E2 Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=resolves protected route inputs before filters, recovery and dispatch on census boxes and bypasses service-owned failure opener only there registry:App@26795,registry:App@29252,registry:App@29744,registry:App@29981,registry:App@31388,registry:App@6590,registry:App@9615,registry:App@9756,registry:Hibernate@29627,registry:Host@1061,registry:Host@1426,registry:Host@29797,registry:Host@30713,registry:Host@31441,registry:Host@3263,registry:Host@3330,registry:Host@3426,registry:Host@3461,registry:UpdateSettings@9493,whole:Route@1046,whole:Route@1164,whole:Route@1188,whole:Route@1461,whole:Route@1622,whole:Route@26790,whole:Route@2726,whole:Route@2768,whole:Route@2877,whole:Route@2901,whole:Route@29247,whole:Route@2932,whole:Route@29505,whole:Route@29527,whole:Route@29574,whole:Route@29592,whole:Route@29602,whole:Route@29645,whole:Route@29666,whole:Route@29679,whole:Route@29739,whole:Route@29765,whole:Route@29839,whole:Route@29878,whole:Route@2989,whole:Route@29894,whole:Route@29922,whole:Route@29976,whole:Route@30002,whole:Route@3075,whole:Route@30755,whole:Route@30809,whole:Route@30825,whole:Route@3097,whole:Route@31332,whole:Route@31383,whole:Route@31409,whole:Route@31483,whole:Route@31518,whole:Route@31534,whole:Route@3197,whole:Route@4280,whole:Route@4927,whole:Route@6512,whole:Route@6534,whole:Route@6585,whole:Route@6611,whole:Route@761,whole:Route@803,whole:Route@9444,whole:Route@950,whole:Route@9558,whole:Route@9603,whole:Route@9751,whole:Route@988 270763804170539d06afd58252d86e1a8ff692ab4d9355be3a2127e9efc9d4a2 |
| 220 | internal/release/adopt.go adoptHost authority B3,E1,E2,E3,E4,J1 E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=applies root settings to canonically resolved routes including named units while legacy settings eligibility remains unchanged;rev3=PROPOSED-p3;run=16;basis=P3-R11 approved punctuation edit only; authority and reads unchanged registry:App@10936,registry:App@11096,registry:App@12125,registry:App@13051,registry:App@14630,registry:App@19789,registry:App@25265,registry:App@3144,registry:App@33024,registry:App@6758,registry:App@8059,registry:App@8253,registry:Hibernate@33885,registry:Host@10816,registry:Host@10849,registry:Host@10949,registry:Host@11109,registry:Host@11211,registry:Host@11243,registry:Host@11308,registry:Host@11758,registry:Host@11891,registry:Host@12338,registry:Host@12447,registry:Host@12649,registry:Host@13141,registry:Host@13927,registry:Host@14402,registry:Host@14616,registry:Host@14958,registry:Host@15548,registry:Host@19279,registry:Host@19387,registry:Host@19757,registry:Host@20577,registry:Host@20735,registry:Host@2105,registry:Host@21197,registry:Host@21249,registry:Host@21396,registry:Host@21483,registry:Host@22589,registry:Host@22833,registry:Host@2294,registry:Host@23493,registry:Host@2375,registry:Host@23878,registry:Host@24019,registry:Host@25233,registry:Host@25360,registry:Host@26702,registry:Host@27352,registry:Host@30585,registry:Host@31203,registry:Host@31528,registry:Host@3157,registry:Host@31602,registry:Host@31849,registry:Host@32000,registry:Host@33196,registry:Host@33363,registry:Host@33470,registry:Host@33698,registry:Host@33841,registry:Host@34586,registry:Host@34712,registry:Host@34800,registry:Host@4469,registry:Host@4583,registry:Host@5546,registry:Host@5651,registry:Host@6870,registry:Host@6918,registry:Host@7035,registry:Host@7067,registry:Host@7945,registry:Host@8113,registry:Host@8239,registry:Host@8358,registry:Host@8836,registry:Host@9223,registry:Host@9449,registry:Host@9545,registry:Host@9636,registry:Kind@554,registry:Unit@31748,registry:Unit@579,whole:Route@10073,whole:Route@10931,whole:Route@11091,whole:Route@12115,whole:Route@13041,whole:Route@14598,whole:Route@15163,whole:Route@15524,whole:Route@16747,whole:Route@17050,whole:Route@17206,whole:Route@19536,whole:Route@19680,whole:Route@19779,whole:Route@2206,whole:Route@22318,whole:Route@22717,whole:Route@25255,whole:Route@30156,whole:Route@3139,whole:Route@33172,whole:Route@3595,whole:Route@4347,whole:Route@6753 2b2c351c0ecc567e5eaf4146cf036ee073b47e2d6ae123198f4d970d0e4ccb96 |
| 221 | internal/release/adopt.go settingsTarget authority E3 Settings target rejects foreign consumed decisions and forces root-owned settings rebind to the canonical tenant.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=census branch delegates target selection to root inputs before any legacy consumed, good-version or build-state read registry:App@2977,registry:App@3077,registry:App@3362,registry:BuildState@2680,registry:GoodVersion@3387,registry:Host@1313,registry:Host@1723,registry:Host@2241,registry:Host@2488,registry:Host@2777,registry:Host@3373,registry:Host@3785,registry:Host@429,registry:Host@4440,registry:Host@4628,registry:Host@702,registry:UpdateSettings@556,whole:Route@1187,whole:Route@2277,whole:Route@2284,whole:Route@2842,whole:Route@2849,whole:Route@301,whole:Route@495,whole:Route@513,whole:Route@658 420982c2cbde642ae3008b61f93dc514defb527c05b20203864de8d052621599 |
| 222 | internal/release/adopt.go type passConfig authority E2,E3 E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=stores the typed census-only root update provider and per-pass resolved input authority 7a405d8b9a24ccb4c9f09f91ca468f74a1e9b4a8b960b430dc3a6290a6b310cd |
| 223 | internal/release/rootgenerationpins.go RootGenerationPins.StagedPins authority E2 rev3=PROPOSED-p3;identity=root release retention and adoption uid 0;basis=checks the recorded boot before any legacy file identity comparison; cross-boot release pins require persistent executable and tree evidence;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures 0bcf3e831097fd3d1e2f3a58fd1e0707f98e04dc058fbea1f923b073c3691d50 |
| 224 | internal/release/rootgenerationpins.go generationFileIdentity authority E2 rev3=PROPOSED-p3;run=25;identity=root generation activation, retirement and release readers uid 0;basis=both generation consumers require the same persistent filesystem/handle/inode/type/owner/mode and filesystem-relative source path across private and host mount layouts; same-boot device stays exact; root-owned ancestry remains independently checked by each opener file:Lstat@681,file:Open@807 fb5a8d7a801a2451e108d8f16933e3e17693989665345596c7c21ae082d3047d |
| 225 | internal/release/rootgenerations.go type GenerationBinding authority E2 E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.;rev3=PROPOSED-p3;run=8;identity=root generation journal uid 0;basis=additive persistent executable and tree fields preserve historical device and inode records;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures fffc440df59bd9833eaaaaa609db352eb99f15f2938e36228ef78c78c91b8fe7 |
| 226 | internal/release/rootupdates.go RootUpdateInputs.routes authority E3,J1 rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=uses registry hostname only as selector and replaces protected dispatch fields with independently resolved root inputs registry:Host@308,registry:Host@365,registry:Host@382,registry:Host@481,whole:Route@244,whole:Route@273,whole:Route@368,whole:Route@499,whole:Route@512,whole:Route@520,whole:Route@538 c75f2735786a9185baf8c54ea14a6c2adbe387a84cfec92585faba2163d95a67 |
| 227 | internal/release/rootupdates.go RootUpdateInputs.target authority E3 rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=re-resolves canonical route before selection and persists root request decision before permitting adoption registry:Account@747,registry:Account@857,registry:App@759,registry:App@872,registry:Channel@767,registry:Host@248,registry:Host@341,registry:UpdateSettings@467,whole:Route@364,whole:Route@382,whole:Route@470,whole:Route@571,whole:Route@581 cb946ee06c8c53e26c13bb910f9a6d9c526b593a8b0d4fed7be1f42275faa727 |
| 228 | internal/rollout/failures.go FailureBook.saveLocked authority E3 rev3=PROPOSED-p3;run=8;identity=root adoption uid 0 or legacy rollout uid carlos;basis=root instance uses checked store writer; legacy instances retain the original atomic file writer and epoch semantics 83b3b6847b3d5573946f635c5c8f006e96648da5dd592cd65987a16f24c0e0c2 |
| 229 | internal/rollout/rootfailures.go InitializeRootFailures authority E3,G rev3=PROPOSED-p3;run=8;identity=offline root migration uid 0;basis=creates a new random root book only under explicit migration authority, preserving bounded legacy denies without legacy clears 603064dc39f5c7d7c4cce90ab9a90ab4c4d6ec8dd9e6c4ca5b6bfc072979a644 |
| 230 | internal/rollout/rootfailures.go OpenRootFailures authority E3 rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0;basis=requires exact root migration marker and durable book; rewrites visible state before exposing any retry or failure permission file:Read@165 2f586cb1812ded0911e0353658660403caa8e0427fdb7684ed63cc016fac01b4 |
| 231 | internal/rollout/rootfailures.go RootFailures.ImportLegacy authority E3 rev3=PROPOSED-p3;run=8;identity=root adoption and migration uid 0;basis=imports bounded negative tuples, hold markers and unresolved intents once; ignores legacy epochs and retries and durably retains import fingerprints 11f48c92fc6399ce6a748153fd20630b4a16378741b4f3ecdd34e9dd7b2b87f3 |
| 232 | internal/rollout/rootfailures.go RootFailures.VerifiedRetry authority E3 rev3=PROPOSED-p3;run=8;identity=root adoption uid 0;basis=verifies deployment-root signature, tuple, freshness and exact root book epoch before existing durable retry transition f4ab9edee069dedf8748055ee612a6ef8905b9770718c82378cfc15b0316810e |
| 233 | internal/rollout/rootfailures.go rootFailureWriter authority E3 rev3=PROPOSED-p3;run=8;identity=root adoption and migration uid 0;basis=writes migration identity, failure epochs and import fingerprints atomically through checked private root store e32ffb3459fe2b13e0ecbe7b364bd405ef25325ed8cbd685b9ac1e076a8c197a |
| 234 | @coverage internal/rollout 56efcb8c1d7231a7f43d0464d97345930c83c2baf864762c1faa7a004286e984 |
| 235 | internal/host/agent.go runAdoptUnderRootRelease authority B3,E1,E2,E3 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=selects census participation before adding root history or named recovery; absent census uses main pass options with no recovery pre-list or per-host lookup; trace covers either flag and empty, non-adoptable and ordinary routes whole:Route@11104,whole:Route@18400,whole:Route@18436,whole:Route@8406 3031d8ce5a8d23390dee282dd299856f2c837b7bf1fb15599e4cd74692535294 |
| 236 | internal/host/agent.go runAdoptWithEnsureSystemUnits authority B3,C,D,E1,E2,E3,E4,F,J1 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=supplies the census probe to root exclusion and adoption; runAdoptUnderRootRelease chooses participation before root history and named recovery options; no census retains main pass configuration file:Open@176 13c055021f5e0453138bf773673521b86851eb16d567f6ccf968f5b7bc4f9199 |
| 237 | internal/host/claimassembly.go NewProductionRootClaimStop authority C,E2 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=installs root filesystem identity capture in the production inventory handler;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures a55fcaa85155e2376d5f680ca8f86de6b579072e6a5c3ad47e1329b354311a00 |
| 238 | internal/host/claimlaunch_root.go ClaimLaunchRoot.startRecorded authority E1,E2,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=persists the root failure intent before launch and independently revalidates readiness and the exact unit invocation before served/request completion;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=retains P3 runtime settlement and E host-aware readiness validation under the generation reservation and host guard file:Read@4103 b19cb431a122d33703a83b39cb9a19786b7f509eba22961ec1e86d95f618e909 |
| 239 | internal/host/claimretire_transport.go ClaimRootHTTP.retire authority C,G,J1 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=requires persistent root-captured artifact evidence when constructing the protected retirement parker;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures registry:ClaimOwnership@1081,registry:Host@1062,registry:Host@792,whole:ClaimOwnership@1085,whole:ClaimOwnership@894,whole:Route@2018,whole:Route@854 a60c74d0e0461e0a432f9a338aa25799cc0cd9d163c7b6eb803cfb33d55d7c2a |
| 240 | internal/host/claimretire_transport.go type ClaimRootHTTP authority E1 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=binds the production inventory identity capturer to the root request handler; the agent cannot choose the capture implementation;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures dee282541c5597b1af69dbd986817936dcdbb80e53471db215df9f8b1318b7da |
| 241 | internal/host/claimroleassembly_linux.go ClaimRoleAssembly.Launch authority C,J1 rev3=PROPOSED-p3;identity=carlos agent claim lifecycle uid carlos; final authorization remains in root;basis=checks retained state directory identity using persistent root evidence across boots before preparing the claimed launch;rev3=PROPOSED-p3;run=11;identity=carlos agent uid carlos; root validates final inventory and launch;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Command@5889,file:EvalSymlinks@5438,file:Fstat@3521,file:Lstat@2269,file:OpenFile@3111,file:OpenFile@3298,file:Read@711 ff3c65c83908a6803f53b0f61eedf9840eba50c109429bbb2c3620e9154bf689 |
| 242 | internal/host/claimroleassembly_linux.go ClaimRoleAssembly.PrepareState authority C,J1 rev3=PROPOSED-p3;identity=carlos agent claim lifecycle uid carlos; final authorization remains in root;basis=reuses state directories using root-captured persistent identity when present; legacy local inventories retain the prior same-device comparison;rev3=PROPOSED-p3;run=11;identity=carlos agent uid carlos; root validates final inventory and launch;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Fstatat@2113,file:Fstatat@3196,file:Open@1597,file:Openat@1884 c610385f0932f8aa5e1b79ad34ad7b10f654e03016d8cae453ebe0aa25769f65 |
| 243 | internal/host/claimstop_writers_linux.go installationCoverage authority C,G,J4 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=validates stopped-installation data roots against persistent filesystem identity before treating descriptors as covered;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Lstat@820,file:ReadDir@1171 5b17c0581b7010785b8ee5f1b591c41863eebf19defde576ea7b8dc11ab429c6 |
| 244 | internal/host/proofbinding.go productionProofBindingSource authority B3 rev3=PROPOSED-p3;run=16;identity=root adopt/update/control uid 0;basis=enables signed recovery lookups and persistent executable identity only after a successful participating census check; absent census keeps legacy observation store reads file:Open@209,file:Open@379,file:Read@1107 6312660ec9d139e25a408543b56372b428144ea6538add20963a6ccc10f91fbf |
| 245 | internal/host/proofbinding.go proofBindingSource.binding authority B3,J1 rev3=PROPOSED-p3;run=16;identity=root adopt/update/control uid 0;basis=binds canonical unit, executable and healthy history; signed manifest recovery lookup runs only for participating sources, never absent-census observation file:EvalSymlinks@1220,file:EvalSymlinks@1529,file:EvalSymlinks@562,file:EvalSymlinks@801,registry:Unit@3225,whole:Route@265,whole:Route@3722,whole:Route@3729 20ed721cbcaccb6ab813a0d317542a43fe057544811920ba43ac6431c3e73000 |
| 246 | internal/host/proofbinding.go proofBindingSource.unitBinding authority B3,J1,E1 rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=hashes persistent file identity into the canonical unit binding while preserving exact legacy source hashes without census registry:Unit@508,registry:Unit@609,registry:Unit@800,whole:Route@2878,whole:Route@2885 82e214d1cf66d29d0900f5c1ce9cfe0a2f31c070da4bf1497ef3fd5273c09aad |
| 247 | internal/host/prooffile.go proofFileSource authority B3 rev3=PROPOSED-p3;run=28;identity=root adoption and rollback proof binder uid 0;basis=canonical proof hashes exclude boot-local device mount namespace and kernel unique IDs; persistent filesystem handle inode owner mode and mount topology remain bound; sameProofFiles separately refuses same-boot mount replacement;test=TestPlan14ProofFileSourceBootEvidence 1f27b56d784c3767d92841c51055d8f6a621ad97f13f5acb780d40e3d89b4647 |
| 248 | internal/host/prooffile.go sameProofFiles authority B3 rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=compares retained and current proof files using persistent evidence, refusing an implicit upgrade of old unproven files e531e1eac189f957d9cc0151319093e0b2ab0fcd80412abc0d2f3fefcfc3421a |
| 249 | internal/host/proofnamed.go proofBindingSource.record authority B3 rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=binds named-unit provenance to boot-stable file evidence and preserves the original no-census hash shape 97f1501b9543e36c6a231170425c5c79c7c22489500aadf119e064abc1abde93 |
| 250 | internal/host/proofnamed.go proofBindingSource.trustedBytes authority B3,J1 rev3=PROPOSED-p3;identity=root adoption and rollback proof binder uid 0;basis=captures persistent evidence from the checked root-owned unit file descriptor alongside its bytes file:ReadAll@422 aa6e98efc7a57b01ed38cd051642d8d2f0b6abf2d527d5f70533e7365746096e |
| 251 | internal/host/rootgeneration_kernel_linux.go generationGroupGone authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=checks absence of the exact recorded containment, or a different current containment independently bound to a live root reservation; neither pathname reuse nor population alone proves replacement; original process death remains mandatory file:Lstat@194 ff5cfdde7ebfda21069cd204cb52dab21cd1885d84658ea7e8bef5de445f68c1 |
| 252 | internal/host/rootgeneration_parked.go generationRetirements authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner e7fb5fc50073e49b5e8f1c0d9a09e9e3cc8da8f96902229d2af4d2c7df8fb20e |
| 253 | internal/host/rootgeneration_payload_linux.go generationPayloadFiles authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=verifies exact retained persistent file identity; on a cross-boot ancestry refusal permits only the configured carlos owner at the managed root itself, retaining root-owned protected ancestors and refusing writable roots 58e62ff06eba73b12b0e892d862a338dafb62170a47a0abc7e92989f5f11b0d7 |
| 254 | internal/host/rootgenerations_launch.go rootGenerationSource.reserve authority E2,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=writes root runtime intent after the generation reservation and before launch under release and host exclusion b09d7390279bcb302d83c282a517680f43c44013e07fc490f37bc798fd1703ba |
| 255 | internal/host/rootgenerations_launch.go type generationLaunchPermit authority E2,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=retains the root runtime completion and close callbacks for the reserved launch 964b8f1ea86c1a85f8a60d5d87168d71375e9c835e2c64859267dc822265c135 |
| 256 | internal/host/rootinventory.go ClaimRootHTTP.commitRootInventoryPending authority E2 rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=new-host empty census classifies sibling state only by exact root installation and payload revision with persistent identity, and sibling live links only by matching root generation reservation; unknown and selected-host artifacts refuse file:Read@1454,file:Read@3494,registry:Account@4858,registry:Account@4873,registry:App@4894,registry:App@4905,registry:ClaimIncarnation@4364,registry:ClaimOwner@4414,registry:ClaimOwner@5544,registry:ClaimOwnership@4956,registry:ClaimOwnership@4978,registry:ClaimOwnership@5860,registry:ClaimOwnership@8063,registry:ClaimRowID@4578,registry:ClaimRowID@4655,registry:ClaimStamp@4392,registry:DBPath@4922,registry:DBPath@4936,registry:Host@4828,registry:Host@4840,registry:Host@8527,registry:Name@8550,whole:ClaimOwnership@4960,whole:ClaimOwnership@4988,whole:ClaimOwnership@5870,whole:ClaimOwnership@8074,whole:Route@10317,whole:Route@3686,whole:Route@4069,whole:Route@4085,whole:Route@4140,whole:Route@4791,whole:Route@4804,whole:Route@4813,whole:Route@5051,whole:Route@5283,whole:Route@6117,whole:Route@6253,whole:Route@6477,whole:Route@7919,whole:Route@9582,whole:Route@9643,whole:Timer@8535,whole:Timer@8558 b00707c1c5a3b1f3b51fd573fbb09a176bda8a055e64232b9044b7c78640ba51 |
| 257 | internal/host/rootinventory.go ClaimRootHTTP.verifyInventoryPath authority C,J1 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=uses checked persistent evidence for protected installation entries; explicit legacy fixtures preserve their same-boot check;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Lstat@315 2ee5519ed6e8ff27bcfdb5db7748a71f4f331a271d84d7688835798792824a78 |
| 258 | internal/host/rootinventory_identity.go ClaimRootHTTP.bindInventoryPaths authority C,E2,J1 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=discards all caller-supplied persistent evidence and captures or revalidates it independently against the retained root inventory;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=discards caller proof, captures new objects independently, retains immutable prior proof, and verifies cross-boot ancestry through the shared inventory verifier;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=requires the proposed boot to equal the independently observed boot for new materialization, discards caller filesystem proof, captures new objects independently, retains immutable prior proof, and verifies cross-boot ancestry through the shared inventory verifier 73c94e6482dafa576ac607ba4a54a83921febf0f2092361e88a259a884db75d7 |
| 259 | internal/host/rootinventory_state_linux.go ClaimRoleAssembly.prepareStateInventory authority C,J1 rev3=PROPOSED-p3;run=28;identity=carlos agent claim lifecycle uid carlos; root independently validates every effect;basis=existing-state preparation only reads the root-recorded object through its private systemd view; same-boot namespace projection preserves filesystem handle inode owner mode and exact child mount layers; no root authority recapture or mutation file:Fstatat@1313,file:Fstatat@2300,file:Open@799,file:Openat@1086 43e8584ce50d540f9275e6d906d4a34dfbe7c68164ad0cfd8ab8286a24467913 |
| 260 | internal/host/rootupdates_runtime.go beginRootGenerationUpdate authority E2,E3 rev3=PROPOSED-p3;run=20;identity=root launch uid 0;basis=passes already reserved generation binding to settings resolver while holding release and host exclusion; avoids recursive host lock acquisition c67ae6552b1232728d3cdcbef857b19ff81bce04bd05e79b8a65b11c67efc7c8 |
| 261 | internal/host/rootupdates_runtime.go publishRootRetry authority E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=writes root-owned public retry status only from the independently verified root book file:Open@84 e3c680d5a7d3c423dc183319bb3d0518bbea6cdc752c7bd6b540d57f884b414e |
| 262 | internal/host/rootupdates_runtime.go rootRetryStatus hint E3 rev3=PROPOSED-p3;identity=carlos agent status probe uid carlos;basis=agent reads root-owned public retry status; an exact legacy-book acknowledgement may clear only the corresponding local mirror, never root authority file:Lstat@89,file:Open@183,file:Read@721 7db6b16062bd095634a03c58cfdcd3dde2d49c990a34fe37d260d0908a16aa5f |
| 263 | internal/host/rootupdates_runtime.go rootUpdateReady authority E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=probes the canonical deployment endpoint before root records runtime served/request success whole:Route@95 fe93218ee43c1346b148e4c9f6f55731d8865acde4f72ec85f60c5732a6a7d76 |
| 264 | internal/host/rootupdates_runtime.go rootUpdateSource.beginRuntime authority E3 rev3=PROPOSED-p3;run=10;identity=root claim controller uid 0;basis=retains durable attribution readiness and exact process settlement; diagnostic retry delivery cannot hold a successful launch while sticky enforcement is disabled file:Exec@1480,registry:Account@1228,registry:Account@1439,registry:Account@1882,registry:Account@533,registry:App@1245,registry:App@1456,registry:App@1894,registry:App@550,registry:Host@1069,registry:Host@1259,registry:Host@1328,registry:Host@1405,registry:Host@1594,registry:Host@1911,registry:Host@2334,registry:Host@500,whole:Route@180,whole:Route@891 ea1cb8473da2d46ca21be5c3cc5c1a8108d88b7934427574ea4af55d5d0bfc67 |
| 265 | internal/host/rootupdates_runtime.go rootUpdateSource.publishRetry authority E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=projects the root book identity and epoch and includes a mirror acknowledgement only after the root denial is durably cleared registry:Account@284,registry:Account@378,registry:App@305,registry:App@399,registry:Host@333,registry:Host@427,registry:Host@490,whole:Route@290,whole:Route@311,whole:Route@339,whole:Route@384,whole:Route@405,whole:Route@433,whole:Route@496 d18d5c78c905754df748c0bf887a7170f6378a6da76df196af7508f28372be28 |
| 266 | internal/host/rootupdates_runtime.go rootUpdateSource.retryStatus authority E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=derives retry identity and restrictions from root-held failures and epoch-bound served observations registry:Account@154,registry:Account@380,registry:Account@518,registry:Account@586,registry:Account@644,registry:Account@795,registry:Account@888,registry:App@171,registry:App@403,registry:App@530,registry:App@598,registry:App@656,registry:App@807,registry:App@900,registry:Host@351,registry:Host@544,registry:Host@612,registry:Host@670,registry:Host@821,registry:Host@914,whole:Route@112 a3eafae0a95559cfb0c7677215d89dbf353e44150453f252fed0e56b575e1f11 |
| 267 | internal/hostbox/coldhandover.go ColdHandover.Run authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=carries persistent identity into root-guarded cold retirement without treating old device numbers as filesystem identity;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Exec@1027,file:Lstat@10796,file:OpenRoot@10718,file:Read@1379,registry:Addr@3654,registry:Addrs@3672,registry:Backing@3691,registry:Canary@3748,registry:ClaimIncarnation@3532,registry:ClaimIncarnation@4034,registry:ClaimOwner@11546,registry:ClaimOwner@4116,registry:ClaimOwner@4136,registry:ClaimOwner@6011,registry:ClaimOwner@7103,registry:ClaimOwner@8357,registry:ClaimOwnership@11138,registry:ClaimOwnership@3502,registry:ClaimOwnership@4480,registry:ClaimOwnership@4698,registry:ClaimOwnership@4731,registry:ClaimRowID@11436,registry:ClaimRowID@11517,registry:ClaimRowID@4154,registry:ClaimRowID@4762,registry:ClaimRowID@7062,registry:ClaimRowID@8382,registry:ClaimStamp@3577,registry:ClaimStamp@4081,registry:Host@6939,registry:Host@8319,registry:Kind@3610,registry:Name@4816,registry:Name@6954,registry:Name@8338,registry:Platform@3732,registry:Registration@4180,registry:Registration@7019,registry:Registration@8407,registry:Replica@3762,registry:Route@11138,registry:Route@4480,registry:Route@4731,registry:Route@5262,registry:Route@6011,registry:Timers@4679,registry:Timers@4698,registry:Timers@4762,registry:Timers@4816,registry:Timers@6891,registry:Timers@8194,registry:Tunnel@3712,registry:Unit@3636,whole:ClaimOwnership@11152,whole:ClaimOwnership@3506,whole:ClaimOwnership@4492,whole:ClaimOwnership@4714,whole:ClaimOwnership@4743,whole:ColdRows@11140,whole:ColdRows@12252,whole:ColdRows@12262,whole:ColdRows@4977,whole:ColdRows@4985,whole:ColdRows@4993,whole:ColdRows@5000,whole:ColdRows@5264,whole:ColdRows@6013,whole:ColdRows@6893,whole:ColdRows@8196,whole:Route@11146,whole:Route@3487,whole:Route@3847,whole:Route@4279,whole:Route@4287,whole:Route@4338,whole:Route@4346,whole:Route@4486,whole:Route@4737,whole:Route@5271,whole:Route@6020,whole:Timer@4018,whole:Timer@4292,whole:Timer@4300,whole:Timer@4351,whole:Timer@4389,whole:Timer@4685,whole:Timer@4704,whole:Timer@4768,whole:Timer@4822,whole:Timer@6900,whole:Timer@8203 63533f0956c007cc4ef676c2f9b3264c0235fda43adcf7f39f8387bb2e83773b |
| 268 | internal/hostbox/coldhandover.go ColdHandover.retireIntended authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=captures persistent identity for root-guarded empty directories before identity-conditional retirement file:Lstat@2251,registry:ClaimOwner@840,registry:Route@840,whole:ColdRows@842,whole:Route@849 85c7d0d2933bbd80f10690cddca7efa8920e789e35daeaa7e950dc78a352d71a |
| 269 | internal/hostbox/inventory_identity.go OpenInventoryFile authority C,E2,G rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=opens inventory paths through no-follow checked directory and file descriptors for persistent identity verification file:OpenFile@116 07d0ccdc38099b5aec202a1e69332820897442ed8a803a8af679d4fb2e4d9e49 |
| 270 | internal/hostbox/inventory_identity.go VerifyInventoryFile authority C,E2,G rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires persistent root evidence and compares filesystem handle, ownership and stable mount attachment across boots;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Stat@81 965a8506c8255b8961a316c80f8fac4014933125e1507fa6e42121e9d3b3bb1b |
| 271 | internal/hostbox/reconcile_adapter.go ReconcileAdapter.Retire authority C,E2 rev3=PROPOSED-p3;run=13;identity=agent uid carlos; final retirement effects uid 0;basis=agent initiates retirement through root; root revalidates exact retained installation and persistent artifacts before destructive effects registry:ClaimIncarnation@1309,registry:ClaimIncarnation@322,registry:ClaimIncarnation@3614,registry:ClaimIncarnation@3636,registry:ClaimOwner@1366,registry:ClaimOwner@1434,registry:ClaimOwner@2387,registry:ClaimOwner@2793,registry:ClaimOwner@3694,registry:ClaimOwner@3710,registry:ClaimOwner@3948,registry:ClaimOwnership@147,registry:ClaimRowID@3728,registry:ClaimRowID@3971,registry:ClaimStamp@1338,registry:ClaimStamp@362,registry:ClaimStamp@3660,registry:ClaimStamp@3676,registry:Host@1257,registry:Host@2292,registry:Host@2838,registry:Host@288,registry:Host@2895,registry:Host@3533,registry:Host@3916,registry:Name@3933,registry:Registration@3750,registry:Registration@3992,whole:ClaimOwnership@151,whole:Route@1069,whole:Route@1152,whole:Route@231,whole:Timer@3599 161f3654abb12c42f016704228b550d132c4e9da3d29906db4f908dc40994e4d |
| 272 | internal/hostbox/typedpark_linux.go TypedParker.CaptureArtifact authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=captures filesystem handle, ownership and stable mount attachment when the root caller requests protected artifact capture;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Fstatat@440 8388e25cc65bd51896aef372e76dd9dd66947b3e67bbca0b76461b10742e17a2 |
| 273 | internal/hostbox/typedpark_linux.go TypedParker.Park authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires persistent evidence for root-protected retirement and verifies source or replay destination before rename;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures;rev3=PROPOSED-p3;run=21;basis=exact root-recorded artifact parking and replay remain in the recorded nested mount; persistent identity and no-replace retained;rev3=PROPOSED-p3;run=21;basis=shared recorded-mount location for typed retirement and generation pin verification; root inventory and completed receipt required file:Fstat@1186,file:Fstat@1255,file:Fstatat@587 ef55e912ee35ffd8d87e193e45fba6a98264d3090c221b697d34b2448e652d12 |
| 274 | internal/hostbox/typedpark_linux.go TypedParker.VerifyEmptyDirectory authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=requires protected persistent identity before using emptiness to retire an intended directory;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Fstat@661,file:Openat@439,file:Readdirnames@840 959832873e4daf74fbfa86d6e8139cc94d506545b59ef2dd1fa5059ac3c2374b |
| 275 | internal/hostbox/typedpark_linux.go TypedParker.verifyDestination authority C,J2,J4 rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=checks parked artifact replay using persistent evidence under descriptor-held ancestry;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures;rev3=PROPOSED-p3;run=21;basis=exact root-recorded artifact parking and replay remain in the recorded nested mount; persistent identity and no-replace retained;rev3=PROPOSED-p3;run=21;basis=shared recorded-mount location for typed retirement and generation pin verification; root inventory and completed receipt required file:Fstatat@374 25463df3cfe25c33a211327ce452b63501ae9230701b6790cb70d083a185a4fc |
| 276 | internal/hostbox/typedpark_linux.go sameArtifactAt authority C,E2,G rev3=PROPOSED-p3;identity=root claim retirement or offline migration uid 0; shared helpers also run for legacy agent requests without root authority;basis=verifies retained typed artifacts through descriptor-relative opens and persistent identity before any retirement effect;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures a0e3b899df85823cc4549d49f6577a7eff1549b7a0e4f1b53f4a23573ee4b948 |
| 277 | internal/rollout/rootfailures.go LegacyRetryIdentity hint E3 rev3=PROPOSED-p3;identity=root adoption retry verifier uid 0, reading service-owned deny-only bytes;basis=extracts only the old service book identity and epoch for a local mirror acknowledgement; it cannot grant a root retry c3a6b3d17bbab8b0070ebf317fc54c96f6e781aba9eba97c38c81d06c6f9430d |
| 278 | internal/host/claimstop_kernel_linux.go LinuxStopKernel.recoverAfterReboot authority C,J4 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=rechecks the persisted inventory filesystem before rebasing deny-only descriptor identities into the current boot; old process and cgroup identities remain boot-scoped file:ReadFile@833 57ca5033f471f8390813576f7159f5b5188c613d4df91fb1779322710f1832e7 |
| 279 | internal/host/rootstop_reboot_linux.go LinuxStopKernel.rebootStopFiles authority C,J4 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=maps old journal descriptor devices only through root-retained filesystem and directory-handle evidence; ambiguous or unknown filesystems refuse, and the resulting inode set only adds denies;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=verifies the opened descriptor and checked ancestry against retained inventory before rebasing deny-only stop descriptor devices; ambiguity or substitution refuses;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=verifies the opened descriptor and checked ancestry against retained inventory before rebasing deny-only stop descriptor devices; ambiguity or substitution refuses 59412264f991074b3db78e3054b1e82922cbd6d1f500a23fe312cc06981b21c5 |
| 280 | internal/host/restartscope.go applyRetries authority E1,E3,J1,J4 rev3=PROPOSED-p3;identity=carlos agent retry consumer uid carlos;basis=preserves legacy local retry behavior and relays independently verified root-book retry requests to the existing root adoption marker whole:Route@121 9d3c9301860d8ae533066f05d943b86cd30571482999c120053283db6dec7497 |
| 281 | internal/host/rootupdates_runtime.go relayRootRetry hint E3 rev3=PROPOSED-p3;identity=carlos agent retry consumer uid carlos;basis=agent checks the root-owned public projection and signature before requesting root adoption; it neither changes root failure state nor reports a clear file:Open@82,file:Read@200 9ab15e088beaca6ead893b4e83d1671ea0c72bc5a3714a5518900a26dee7dd7c |
| 282 | internal/host/claimstop_writers_linux.go rootInstallationCoverage authority C,G,J4 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=captures current checked descriptor identity for the extra state directory root derives from the canonical host; this ephemeral directory only expands the stop scan denial set;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=merges E FileIdentity callers and P3 authority effects; retains the recorded family checks and both tracks behavioral fixtures file:Lstat@545 73c8f9b564a42be1fe3b98ec4a2efcfdaac38b5aa7c86d7c5cc7f61e8b6a0fa3 |
| 283 | internal/host/claimunit.go claimUnitContent authority E1,E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=adds write permission for exactly the public retry directory only when the root settings reader has verified a complete census and prepared that directory 3082c34490fbf6f95ebace69d97161993635c9cc1fee346641fdc61cb1f2e43f |
| 284 | internal/host/claimunit.go readClaimUnitSettings authority C,E3,G,J4 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=retains exact no-census unit settings; a claims-enabled complete census prepares the root-owned retry directory before the hardened controller starts data-literal@123,data-literal@1708,data-literal@1793 bb6950ff1fff6355dde999d17330e9cd29b49ce051b66bfe2c8d5bc05424d6a5 |
| 285 | internal/host/rootupdates_runtime.go prepareRootRetryUnitDirectory authority E3 rev3=PROPOSED-p3;identity=root claim/adoption controller uid 0;basis=root unit installer requires an independently opened complete census before creating the public retry directory or enabling its controller write path file:Lstat@67,file:Open@603 3be70325e77de790f369531610c5889da7af25a185fdde6062c49356ca1a9335 |
| 286 | internal/caps/converge.go type Ops diagnostic H3 rev3=PROPOSED-p3;run=10;identity=compile-time capability operation shape;basis=adds root authorization callback shared by converge restore and restart;rev3=PROPOSED-p3;run=11;identity=compile-time operation shape; no runtime grant;basis=retains P3 census-wide mutation refusal and E per-host bound-unit refusal in the shared operation; no-census legacy path remains unchanged file:Query@347 9336d819ed8ab77a2716fa56538bffed55b3bba6f2a07c624965be493db6c15f |
| 287 | internal/caps/converge.go Converge authority E4,J4 rev3=PROPOSED-p3;run=10;identity=root adopt uid 0;basis=checks root authorization before any capability file or systemd effect; no-census legacy behavior retained;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=retains P3 census-wide mutation refusal and E per-host bound-unit refusal in the shared operation; no-census legacy path remains unchanged 30fc6af73046bfd8a30fd8097573a5e774b3fe987ec1ee49d3b08e20bdc23761 |
| 288 | internal/caps/converge.go Restore authority E4,J4 rev3=PROPOSED-p3;run=10;identity=root adopt uid 0;basis=checks root authorization before rollback writes or unit verbs;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=retains P3 census-wide mutation refusal and E per-host bound-unit refusal in the shared operation; no-census legacy path remains unchanged a01809a6dd4215271e7ceda81618aa01f8d58d13f84b670b9e366f34a410f99c |
| 289 | internal/caps/converge.go Restart authority E4,J4 rev3=PROPOSED-p3;run=10;identity=root adopt uid 0;basis=checks root authorization before daemon restart;rev3=PROPOSED-p3;run=11;identity=root claim, migration or adoption controller uid 0;basis=retains P3 census-wide mutation refusal and E per-host bound-unit refusal in the shared operation; no-census legacy path remains unchanged 3d9f360b51a05bf6a0525edb5afc747c6b7cc8d6c34b59638914237e488c998e |
| 290 | @coverage internal/caps 0502b0ee74b47a1a7b37e538e1c1c0ff30b50d08b5ec7e780b7429bf094c5eb6 |
| 291 | internal/caps/rootauthority.go Ops.authorizeMutation authority E4,J4 rev3=PROPOSED-p3;run=10;identity=root adopt uid 0;basis=refuses legacy unit capability mutation on any retained census or unreadable census; root configuration stays fixed; absence preserves legacy operations file:Lstat@55 5549b2317e66dda41d73b23216bfca7b18ab1814607140794eb40124feae3618 |
| 292 | internal/host/claimactivation_preflight.go claimActivationPreflight authority G,J4 rev3=PROPOSED-p3;run=13;identity=agent uid carlos; root migration/adopt/control uid 0;basis=service-owned registry contributes refusal only; claimActivationVerified separately checks canonical records and root retained unit state registry:Backing@280,registry:Unit@260,whole:Route@246 e5713a34359330ef311f31c47e0342f8322471243a7aba61fdecc751a53f34b4 |
| 293 | internal/host/rootgeneration_kernel_linux.go generationCurrentFiles authority E2 rev3=PROPOSED-p3;run=25;identity=root retirement and activation readers uid 0;basis=private controller and host mounts may expose the same canonical generation path; require equal filesystem-relative source path plus persistent filesystem/handle/inode/type/owner/mode and same-boot device, never a pathname alone file:Open@219 93510e08a5530962857316b1024a169891d2406c29a80df9b8e45d2c0785c9a6 |
| 294 | internal/rootstate/state.go FileIdentity.Same authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=requires persistent filesystem handle inode ownership mode and ordered topology; same-boot unique namespace and mount evidence refuses replacement; old numeric mount and namespace names are not authority; reboot keeps persistent evidence mandatory 0fcbabb15c7cd01f1aca9346bd4ea18295dbf81e9631c406af33a185c8c9a29a |
| 295 | @removed internal/host/rootgeneration_kernel_linux.go generationCurrentBinding A,E2,G census-ruling-J4 |
| 296 | @remove internal/host/rootgeneration_kernel_linux.go generationRetainedFiles |
| 297 | @removed internal/host/rootgeneration_kernel_linux.go generationRetainedFiles A,E2,G census-ruling-J4 |
| 298 | @removed internal/hostbox/inventory_identity.go VerifyInventoryPath A,E2,G census-ruling-J4 |
| 299 | @removed internal/rootstate/persistent.go PersistentIdentity.Same A,E2,G census-ruling-J4 |
| 300 | @removed internal/rootstate/persistent_linux.go Persistent A,E2,G census-ruling-J4 |
| 301 | |
| 302 | internal/host/claimwakeassembly.go type ClaimLaunchInputs authority C,J4 rev3=PROPOSED-p3;run=12;basis=agent launch selection; preserves E named-unit inputs and seed own-write CAS callback together f64420b0bc9f2479961d965b297b86274ef69b31894b0dbe056e19850eb5c3b8 |
| 303 | internal/host/movesfiles.go movesFiles.Establish authority C,J4 rev3=PROPOSED-p3;run=12;basis=agent files preparation; retains seed admitted-writer and ordinary origin proof with one C8 commit; H3 is inventory bookkeeping, C owns the enabled effect 172fe8888da88c249b7990bd9fb4bd2821bd402fb96ab52af13c58500f31d50f |
| 304 | internal/hostbox/servinghandover.go ServingHandover.Run authority C,J4 rev3=PROPOSED-p3;run=12;identity=root handover controller uid 0;basis=preserves seed fresh boot-aware directory verification and persists its checked full filesystem identity in successor inventory only; immutable predecessor retained registry:Account@2154,registry:Addr@2373,registry:Addrs@2391,registry:App@2198,registry:Backing@2410,registry:Canary@2467,registry:ClaimOwner@5643,registry:ClaimOwnership@2841,registry:ClaimOwnership@3057,registry:ClaimOwnership@3090,registry:ClaimRowID@3120,registry:ClaimRowID@5714,registry:ClaimRowID@5888,registry:DBPath@2286,registry:Kind@2128,registry:Name@3174,registry:Name@5853,registry:Platform@2451,registry:Replica@2481,registry:Route@2841,registry:Route@3090,registry:Route@5643,registry:Route@5714,registry:Socket@2234,registry:Timers@3039,registry:Timers@3057,registry:Timers@3120,registry:Timers@3174,registry:Timers@5796,registry:Tunnel@2431,registry:Unit@2355,whole:ClaimOwnership@2853,whole:ClaimOwnership@3073,whole:ClaimOwnership@3102,whole:ColdRows@3514,whole:ColdRows@3522,whole:ColdRows@3530,whole:ColdRows@3537,whole:ColdRows@5645,whole:ColdRows@5716,whole:ColdRows@5798,whole:ColdRows@6379,whole:ColdRows@6389,whole:Route@2114,whole:Route@2643,whole:Route@2651,whole:Route@2701,whole:Route@2709,whole:Route@2847,whole:Route@3096,whole:Route@5651,whole:Route@5722,whole:Timer@2656,whole:Timer@2664,whole:Timer@2714,whole:Timer@2752,whole:Timer@3045,whole:Timer@3063,whole:Timer@3126,whole:Timer@3180,whole:Timer@5804 c1367b936e3e0caa9e2bbd0da117a9b89ce3b7b7d4f518069e7d265a48b89a04 |
| 305 | internal/host/claimactivation_preflight.go claimActivationVerified authority G rev3=PROPOSED-p3;run=15;identity=agent uid carlos; root migration/adopt/control uid 0;basis=canonical records, installed local units and retained root bindings independently refuse incomplete named-unit activation before claim state 8420c4b5b416bfb653788d69fbdf0f2c3acaad739c85be8bb2c1462f2ad56474 |
| 306 | internal/host/claimactivation_preflight.go var openClaimActivationState authority G rev3=PROPOSED-p3;run=13;identity=root migration/adopt/control uid 0;basis=opens retained root unit namespaces read-only without creating claim state file:Open@31 9b4c4aeddcc3756f3c7fbb267096147f5670511fc4fda809d88d98540ad685f6 |
| 307 | internal/host/claimstop_run.go RunInstanceControl authority C,D,G rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=production root startup builds authenticated execution and launch handlers then uses activateClaimRoot for recovery, the registered census launch verifier and lifecycle start 645d4c7ce78d43fb73ae0b7bf9eff60ed1b1361e0a5b1a7df2083e2e05ec82f8 |
| 308 | internal/host/claimstop_run.go claimRecoveryReady authority C,G rev3=PROPOSED-p3;run=13;identity=instance-control uid 0;basis=requires valid retained recovery census but defers complete launch inventory until restricted recovery has settled 627ab800a8f5772b81c3a893cf546438d7f76ae30ed29949ae6af52b5c2a9a7b |
| 309 | internal/host/claimunit_binding.go claimUnitBindings.establish authority E2 rev3=PROPOSED-p3;run=13;identity=root unit controller uid 0;basis=production admission refuses binding while named-unit 4a is incomplete, including backing=unit ef56f2db27a3d4a95803407a4b389b402592ed5b450bb6723aeffac42a041cab |
| 310 | internal/host/claimunit_dispatch.go claimUnitDispatch.forStart authority E2 rev3=PROPOSED-p3;run=13;identity=root launch controller uid 0;basis=verifies effective ordinary templates as well as retained named bindings before start and at the reservation permit recheck 3d358cb14cd248cea66750f64a4ea49be91eddb563e6ca389c12c7664f6c6706 |
| 311 | internal/host/claimunit_dropin_linux.go openClaimUnitDropin authority E2 rev3=PROPOSED-p3;run=13;identity=root launch controller uid 0;basis=opens only the exact reservation drop-in under checked root ancestry for valid named or ordinary run units file:Fstat@694,file:Fstat@984,file:Open@290,file:Openat@496 f9a9915d67e7f8e4a540a484a7c978bf2d22eb803c04564349f9db5df119de6b |
| 312 | internal/host/claimunit_dropin_other.go openClaimUnitDropin authority E2 rev3=PROPOSED-p3;run=15;identity=non-Linux root launch controller;basis=unsupported-platform stub refuses only; performs no locking, opening or publication bb3a29d1ad8840139f7236971ecb2bae93e6323007f2fdd625114bb3ff105397 |
| 313 | internal/host/claimunit_effective.go claimEffectiveUnit authority E2 rev3=PROPOSED-p3;run=13;identity=root launch controller uid 0;basis=ordinary launches require exact embedded template bytes, only the reservation drop-in and checked effective systemd identity, capabilities and containment; bound launches retain definition checks file:ReadAll@3614,file:ReadAll@643,file:ReadFile@457 7f02ae5a7047e09fffb5ad8dd8fd5e4336236f5f5128b77d41bef043171b66eb |
| 314 | internal/host/claimunit_effective.go claimReservedDropin authority E2 rev3=PROPOSED-p3;run=13;identity=root launch controller uid 0;basis=derives exact host reservation mounts and trampoline arguments; ordinary units retain systemd instance expansion data-literal@382 bf9e5d43b589d965ee9d9af968610bab7342e274eba33dcea3a1f76c3bda50d3 |
| 315 | internal/host/claimunit_files_linux.go projectClaimBoundSocket authority E2 rev3=PROPOSED-p3;run=13;identity=root unit materializer uid 0;basis=selects and publishes the root-bound socket symlink and synchronizes its parent; this is publication authority file:Readlinkat@433 4f3c8daab1f68102e7be9511d1ec29d89c584c99aed79641f2b740031e503ab4 |
| 316 | internal/host/claimunit_files_other.go projectClaimBoundSocket authority E2 rev3=PROPOSED-p3;run=15;identity=non-Linux root unit materializer;basis=unsupported-platform stub refuses only; performs no locking, opening or publication 3f72016917b749fed665db738fbb54d90b40f59eec09aa3751b6abbb2f14319a |
| 317 | internal/host/claimunit_materialize.go claimUnitMaterializer.install authority E2 rev3=PROPOSED-p3;run=13;identity=root unit controller uid 0;basis=production admission refuses materialization while named-unit 4a is incomplete, including backing=unit ed99fda682170367aee0a3d6270153b7051ae03849aa93dc24ecca60eb7afec4 |
| 318 | internal/host/claimunit_production.go bindProductionClaimUnits authority E2 rev3=PROPOSED-p3;run=13;identity=root control startup uid 0;basis=installs effective verification for ordinary and bound starts; incomplete 4a refuses production binding and materialization for named and backing units file:Read@1275 e4b9166fe33bcbafe91efb09d99d139d1f697df35dd7cff6765c9e483972d4c5 |
| 319 | internal/host/proofroot.go configureRootProof authority E1,B3 rev3=PROPOSED-p3;run=13;identity=root adopt uid 0;basis=checks participation before opening history or installing root proof policy; errors deny minting without falling back 322c7da5d034cd1cc870e748c499864796fa8bc11e4bbed6f96f7312d004dbd1 |
| 320 | internal/host/proofroot.go proofRoot.mintAndLog authority E1 rev3=PROPOSED-p3;run=13;identity=root adopt uid 0;basis=retains main minting only when no root policy callbacks are installed; partial census policy without a probe refuses, and a complete policy independently checks participation file:Stat@2049,registry:App@1052,registry:App@1190,registry:App@893,registry:Host@1107,registry:Host@810,registry:Host@931,registry:Unit@763,registry:Unit@780,whole:Route@1000,whole:Route@723,whole:Route@756,whole:Route@868,whole:Route@965 faf5c143825d0f2d263c27d0722fba407b387f0a814b0e8a7212a82e813e240a |
| 321 | internal/host/roothistory_creation.go productionCreationHistory authority E1 rev3=PROPOSED-p3;run=13;identity=root controller uid 0;basis=reuses the production release-exclusion token during recovery before recording independently checked installation creation file:Open@297 495a357c0a2a1354d5c5510744f9bf0778034bd6d7b0d68fa1881791e997634f |
| 322 | internal/host/rootinventory_startup.go recoverRootInventoryStartup authority C,G rev3=PROPOSED-p3;run=13;identity=root control startup and system recovery uid 0;basis=validates retained migration identity before constructing a restricted inventory-only recovery handler; replays root-retained intents and refuses construction until no pending intent remains file:Open@449 fd85ecea2daed0933d8facd17eefed2a0d811c2d50cf6a1bd8dfcfa95c8ba8ec |
| 323 | internal/host/rootmigration_production_linux.go quiesceLegacyRootMutators authority G rev3=PROPOSED-p3;run=13;identity=offline migration uid 0;basis=under mandatory release exclusion scans root process command lines and refuses already-running legacy adopt/apply/guard-arm before census creation file:ReadDir@77,file:ReadFile@537,file:Stat@381 5b8d7964c595634d80699448aa5f052fc2e8c215e3c9bd8549378d37ce25d2ca |
| 324 | internal/host/rootmigration_startup.go readRootMigrationState authority G rev3=PROPOSED-p3;run=13;identity=root startup/recovery uid 0;basis=validates retained census box/enrollment/generation and complete migration record before restricted recovery; grants no launch file:Read@425 9a8ddf2b605833b7fa4c0908ade98a6fc2efbe87c26e92ede289bbcc1d05beec |
| 325 | internal/host/rootmovesfloor_boot.go sameRootFloorImage authority F rev3=PROPOSED-p3;run=13;identity=root boot/recovery uid 0;basis=compares freshly verified signed digest, release and protocols, not saved boot-local file numbers 532078238827331f9282d85d1e17e146ed4842a215db057238aa5f6cb40ba137 |
| 326 | internal/host/rootreleaselock.go withClaimReleaseCensus authority E2 rev3=PROPOSED-p3;run=15;identity=root adopt/guard uid 0;basis=no census invokes main effect directly without opening release state, creating a file or waiting on any migration lock; participating effects retain release exclusion 35bcc5e18e89f9755cf1f749bbaa4cbf493380b75500183687476abd71c946b6 |
| 327 | internal/host/claimactivation_preflight.go claimActivationLocalUnits authority G rev3=PROPOSED-p3;run=22;identity=agent uid carlos; root migration/adopt/control uid 0;basis=refusal-only local named-unit inventory; agent skips only ordinary claim runtime drop-in directories under /run/systemd/system, whose private contents root still inventories and verifies before launch; legacy and named units remain checked file:ReadDir@215,file:ReadFile@1484,file:ReadFile@1567,file:WalkDir@603 6d7e6a2228a88e7058e70a0d1cd04606eb75f52e008e5fd20efb7563335f4258 |
| 328 | internal/host/claimassembly.go ClaimAssembly.Build authority C,G rev3=PROPOSED-p3;run=18;identity=agent uid carlos; root instance-control uid 0;basis=captures provisioning only after participation hooks are bound; settles the previous operation before inventory activation and checks again before selected writes file:Prepare@3817,file:Prepare@3850,file:Prepare@3866,file:Prepare@3883,file:Prepare@4632,file:Read@4562,whole:Timer@2044 f75fa7f91404c318a30755cd7935e7e404bbe8f41b9cfd71184cd12518f15e0e |
| 329 | internal/host/rootgeneration_inventory.go readProductionGenerationInventory authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner 8810b61878f66ec0c1e31e13918454e5b696129639b8512091f883a038c940fd |
| 330 | internal/host/rootmigration_production_linux.go verifyOfflineRootMigration authority G rev3=PROPOSED-p3;run=15;identity=offline root migration uid 0;basis=requires offline masked inactive adopt, stage, config-sync, restart, update and recovery services and absence of concurrent legacy root mutators before creating census state 300a81411020b33318dd8e15418acc95654c3980eb03c8581276d40a951a1a15 |
| 331 | internal/host/systemparticipation.go systemApplier.checkUnarmedParticipationRecovery authority G,F rev3=PROPOSED-p3;run=15;identity=root system update/recovery uid 0;basis=pending acquisition triggers production controller settlement even without an update journal; normal ledger admission stays refused until verified recovery clears the marker 4360d1c0c50c554afc06b3a9ad216acc646728f97750e00ca1fe038b1bccce51 |
| 332 | internal/hostguard/generationinventory.go RootAuthority.generationInstallation authority E2 rev3=PROPOSED-p3;run=15;identity=root generation verification uid 0;basis=enumerates using preserved installation stamp including exact retired tuples; resyncs retained authority without admitting inactive installations or dropping payload obligations fc5ef57b638ee0eba8ae49b724ef9397b2a3ae097d1e892cab888880480eacd2 |
| 333 | internal/host/rootgeneration_inventory.go generationReconciler.reconcile authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks matched root installations, payloads and launch reservations before and after kernel observation; a route-only installation without a launch requires the exact unlaunched identity derived by the independent reader from root creation evidence da4df99dcbcec0cd62025c8c50e8f6be19e64ac990034002bcad1a6b8332bcb6 |
| 334 | internal/host/rootgeneration_requirements.go generationRequiredInventory authority E2 rev3=PROPOSED-p3;run=16;identity=root adopt/update/control uid 0;basis=active installations require canonical deployment records; retired exact root tuples use retained artifacts and verified completed retirement journals without requiring deleted remote records; local obligations and pins remain 3c0eb88abc5680c67191d1e848e93ba528c66e81bcd521577098ce761fb827e0 |
| 335 | internal/host/rootgeneration_retirement.go generationRetirement.closure authority E2 rev3=PROPOSED-p3;run=16;identity=root adopt/update/control uid 0;basis=root installation and exact controller identity bind retirement; pre-intention cancellation requires no process and irreversible writer closure, followed by the existing independent kernel verifier and durable close/retirement writes 1035a55fba521c7c81631d14084684e2dd4cb94703a7604d982be880bcea0cdf |
| 336 | internal/host/rootgeneration_inventory.go type generationInventory authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=carries retained handovers, retirement journals, census, installations, launches, payloads, canonical records and independently derived unlaunched identities for generation reconciliation 979381265f27bb0dad39d184aa1f1e1aa22fd72268a688c99cadbaca6c9938f6 |
| 337 | internal/host/rootgeneration_parked.go generationPhysicalPayloads authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner;rev3=PROPOSED-p3;run=21;basis=shared recorded-mount location for typed retirement and generation pin verification; root inventory and completed receipt required;basis=recorded mount relocation only for CapturePersistent root-protected artifacts; legacy destinations unchanged 67aca6be358b8f87a98c72e03a65d2dcd240cface604b17a058d7360a883e382 |
| 338 | internal/host/rootgeneration_parked.go generationRetirementRecords authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=enumerates and decodes retained retirement journals while excluding the serving-handover directory; generationPhysicalPayloads and its consumers perform subsequent receipt and artifact verification file:Read@728 65cc967484b693f71e4f78c418b85dcef801e82d0eed1ffd2cdda21c8ba163ef |
| 339 | internal/host/rootgeneration_rows.go generationRegistryInventory authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner registry:ClaimOwnership@2394,registry:ClaimOwnership@2773,registry:ClaimRowID@2826,registry:Host@2372,registry:Host@2751,registry:Name@2692,registry:Registration@2804,whole:ClaimOwnership@1625,whole:ClaimOwnership@1734,whole:ClaimOwnership@1748,whole:ClaimOwnership@1762,whole:ClaimOwnership@2271,whole:ClaimOwnership@2400,whole:ClaimOwnership@2418,whole:ClaimOwnership@2473,whole:ClaimOwnership@2722,whole:ClaimOwnership@2779,whole:ClaimOwnership@2797,whole:ClaimOwnership@2892,whole:ClaimOwnership@2920,whole:Route@2289,whole:Timer@2578,whole:Timer@2656 4d4e526c596c7a7fe36a071ca2452acc63f4941b225d389971fb718f4c39dd33 |
| 340 | internal/host/rootgeneration_handover.go generationReadHandovers authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner file:Read@453 226a4fbdb227eed6993a4d94c380e8aef8f681c6ad4b56abed2a30acee10e12a |
| 341 | internal/host/rootgeneration_handover.go generationTransfers authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner registry:ClaimOwner@2754,registry:ClaimOwner@2802,registry:ClaimRowID@2936,registry:ClaimRowID@2986,registry:ClaimRowID@3574,registry:ClaimRowID@3615,registry:Name@3541,registry:Route@2754,registry:Route@2802,registry:Route@2936,registry:Route@2986,registry:Timers@3483,registry:Timers@3615,whole:ColdRows@2756,whole:ColdRows@2804,whole:ColdRows@2938,whole:ColdRows@2988,whole:ColdRows@3485,whole:ColdRows@3617,whole:Route@2763,whole:Route@2810,whole:Route@2945,whole:Route@2994,whole:Timer@3492,whole:Timer@3623 c0c0d2d05d6945560ee7170e6953ad3e603b5054b8f256ee49d93e36a1ad1fe9 |
| 342 | internal/host/rootgeneration_handover.go productionGenerationHandovers authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner file:Open@172,file:Open@422 a5f5ce3ccf3f0a068b049e29bc804ced7c942d25080038942041f399e86be743 |
| 343 | internal/hostbox/generationhandover.go DecodeGenerationHandover authority E2 rev3=PROPOSED-p3;run=16;identity=root claim/adoption controller uid 0;basis=verifies retained completed serving-handover journals against both root payloads, retired predecessor, exact stop receipt, ownership and persistent path identity; follows transfers through terminal retirement without removing launch reservations; TestPlan14ServingHandoverPins and TestPlan14ServingHandoverPinsRootRunner registry:ClaimOwnership@1383,registry:ClaimOwnership@1588,registry:ClaimOwnership@1621,registry:ClaimRowID@1650,registry:Name@1704,registry:Route@1383,registry:Route@1621,registry:Timers@1255,registry:Timers@1300,registry:Timers@1571,registry:Timers@1588,registry:Timers@1650,registry:Timers@1704,whole:ClaimOwnership@1395,whole:ClaimOwnership@1604,whole:ClaimOwnership@1633,whole:ColdRows@1247,whole:ColdRows@1302,whole:ColdRows@1752,whole:ColdRows@1761,whole:Route@1389,whole:Route@1627,whole:Timer@1261,whole:Timer@1309,whole:Timer@1577,whole:Timer@1594,whole:Timer@1656,whole:Timer@1710 3992c3f45d4688db1d1ad88106f535ed3d510046fbd93aa80eccf6b82fd1063c |
| 344 | internal/host/claimparticipation.go productionClaimLocal.participateHost authority D rev3=PROPOSED-p3;run=18;identity=agent uid carlos;basis=opens and verifies root participation, then publishes the exact active lease acknowledgement for ordinary create/delete/purge; legacy participation remains unchanged file:Read@121 ef3af30f918a0c15a7e97caa00013851fd7b749e1faf3459db977dc0db78f0dd |
| 345 | internal/host/claimtoken_directory.go ensureClaimLaunchToken authority E2 rev3=PROPOSED-p3;run=18;identity=agent uid carlos;basis=creates only the classified nested instance directory inside the existing claim authorization callback, using no-symlink descriptor operations and parent sync before token initialization; main legacy initializer unchanged registry:Host@519,whole:Route@231,whole:Route@289,whole:Route@426 2feb82aacf5b5f2557e3c00e5d2f17efd72b9863faee71cb353de4e54b48fabc |
| 346 | internal/host/rootexecution_client.go productionClaimLocal.acknowledgeOperation authority C rev3=PROPOSED-p3;run=18;identity=agent uid carlos;basis=publishes only the required participant own active root-client tuple under claim CAS; checks host incarnation operation box enrollment and leaves existing acknowledgement immutable 12c251703e5b06937af6c993068b45dd41dd8304a2b1d543eaa213dc56cfb4d9 |
| 347 | internal/hostbox/census_vendor_linux.go censusVendorUnitLink authority G,C rev3=PROPOSED-p3;run=18;identity=root migration/control uid 0; agent census uid carlos;basis=classifies only root-owned trusted systemd links to checked regular vendor units; rejects CARLOS names, untrusted ancestry, foreign targets and nested link paths; non-Linux stub only refuses file:EvalSymlinks@867 c4d781b5c4ed60bd16e7d20db119ba6029c039fe60bbacba0219c407deb3ee0d |
| 348 | internal/hostbox/census_vendor_other.go censusVendorUnitLink authority G,C rev3=PROPOSED-p3;run=18;identity=root migration/control uid 0; agent census uid carlos;basis=classifies only root-owned trusted systemd links to checked regular vendor units; rejects CARLOS names, untrusted ancestry, foreign targets and nested link paths; non-Linux stub only refuses 0b72813762dc54469d67e63f8e9f7e29fd2dec51855cbdbf82899a340ad6b275 |
| 349 | internal/hostbox/empty_census.go EmptyInstallationCensus.checkLocal authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0; agent fallback uid carlos remains strict;basis=new-host empty census classifies sibling state only by exact root installation and payload revision with persistent identity, and sibling live links only by matching root generation reservation; unknown and selected-host artifacts refuse file:Exec@1153,file:Lstat@2914,file:WalkDir@3161,registry:ClaimOwnership@2173,registry:Host@2120,whole:ClaimOwnership@2177,whole:ClaimOwnership@2195,whole:Route@2108,whole:Timer@2337 13faf3934b6e2a1f843fc96bc2f62de779e88ca1dc93e07b2a02354c5c76eab8 |
| 350 | internal/hostbox/reconcile.go Reconciler.installWithWork authority C rev3=PROPOSED-p3;run=18;identity=agent uid carlos;basis=settles participation before activation and inventory creation; existing selected write checks still revalidate before each materialization file:Exec@1240,file:Prepare@1679,file:Prepare@1710,file:Read@392 d0ef9a8b5e5231acd18599287b4a44c0c934f8f9df68e6b799e3dbbadab5133d |
| 351 | internal/hostbox/reconcile.go type Reconciler authority C rev3=PROPOSED-p3;run=18;identity=agent uid carlos;basis=production preparation callback receives the observed claim before inventory activation; it grants no write by itself and failures stop installation file:Prepare@109 03c51a76fcfea2c8aef269488a9f69096713723a5c79fc96ceb813a9cafd8e0e |
| 352 | internal/hostexec/participation.go PreinstallationParticipant authority D rev3=PROPOSED-p3;run=18;identity=root execution authorizer uid 0;basis=admits participation only for the exact sole selected creating executor with zero stamp/session and no writer; does not grant installation or launch authority file:Exec@1412,file:Exec@1684,file:Exec@276,file:Exec@507 2107f8a06975dfaccb7b6f1395dee2db670a5895532e8f01988b0b7ce2036a97 |
| 353 | internal/rootparticipation/request.go ExecutionRequest.Valid authority C rev3=PROPOSED-p3;run=18;identity=root execution transport uid 0; agent client uid carlos;basis=allows zero stamp only with zero session and a valid operation identity; independent root authorizer requires exact creating claim and empty local census 475acbb541b9f57ba848faa89903eac1bf20949dc5a8c3a431551641917bc2d6 |
| 354 | internal/rootstate/link_linux.go directory.readLink authority A,E1 rev3=PROPOSED-p3;run=18;identity=root consumers uid 0; agent census uid carlos;basis=trusted symlink reads allow the systemd template character at-sign while retaining descriptor pinning, owner, single-link and path-component checks; authority record names unchanged file:Fstat@386,file:Openat@213,file:Readlinkat@584 93b98a8fb45fd101920c3c3a01f90600711d54e0910f523fdc2c6a8774feb4fa |
| 355 | internal/rootstate/state_linux.go descendSync authority A rev3=PROPOSED-p3;run=18;identity=root consumers uid 0; agent census uid carlos;basis=permits template directory names only for public noncreating traversal; retains root ownership, no writable ancestry, no symlink traversal and all creation restrictions file:Fstat@1101,file:Fstat@1570,file:Openat@597,file:Openat@845 8b6d2741139b1c9d81e5c8104eafcea3e93467399534f868f349d0d11754053b |
| 356 | @coverage internal/hostexec fc41c1b20daf2f36d30932e6851faeac4b632b53c6c532d46ab8e870ccde916c |
| 357 | internal/host/claimproduction.go claimServingLaunchSource authority E2 rev3=PROPOSED-p3;run=19;identity=agent uid carlos;basis=before credential writes, registers nested state through root inventory intent and verified materialization; read-only snapshots with existing credentials do not reacquire a fenced predecessor registry:Host@858,whole:Route@1302,whole:Route@328,whole:Route@457,whole:Route@614,whole:Route@707,whole:Route@786,whole:Route@984 8ed2d728c47535d9ddf2f8c81ccf3cd4f74e94b594044c0ce8a9448916f652ed |
| 358 | internal/host/claimtoken_inventory_linux.go claimAdminTokens.prepareState authority C rev3=PROPOSED-p3;run=19;identity=agent uid carlos, independently validated by root journal uid 0;basis=uses current claim, exact installation and deployment-record expectation, root fence view, and the existing two-phase state-directory inventory registration before credential minting file:Read@376,registry:DBPath@753,registry:DBPath@94,registry:Host@150,registry:Host@406,registry:Host@714 e5e33367df92021bf920625050d828016c078a525b6deb5f28163f37d51f762a |
| 359 | internal/host/claimtoken_inventory_other.go claimAdminTokens.prepareState authority C rev3=PROPOSED-p3;run=19;identity=non-Linux caller;basis=refusal-only stub; cannot register state or mint authority candidate:Route@56 73d3f3886940f05753d25b761d2274b6b953dce650f34795ad03a1d12af77c26 |
| 360 | internal/hostbox/servinghandover.go ServingHandover.validate authority C,J4 rev3=PROPOSED-p3;run=19;identity=root instance-control uid 0;basis=allows route-only initial handover only from verified session zero; later sessions still require exactly one verified state-directory entry; all receipt, inventory and claim checks remain file:Exec@258,registry:ClaimIncarnation@1906,registry:ClaimOwner@1379,registry:ClaimOwner@1980,registry:ClaimOwnership@1874,registry:ClaimRowID@2015,registry:ClaimStamp@1949,registry:Name@1860,registry:Registration@2052,registry:Route@1033,registry:Route@1379,registry:Timers@1806,registry:Timers@2282,whole:ClaimOwnership@1880,whole:ColdRows@1035,whole:ColdRows@1381,whole:ColdRows@1808,whole:ColdRows@2284,whole:Route@1042,whole:Route@1388,whole:Timer@1815,whole:Timer@2291 d8015871bf0cdfb7dfb9715510d1cd649d05aeed8ecded9c8cfb2fae0d6fc946 |
| 361 | internal/host/claimowners.go claimServingOwners.EmptyAuthority authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained 4167cdb7b73f4d9fea5ae9dbb23b8885f9c6f254c8344332b056ef0b63fb2811 |
| 362 | internal/host/claimstop_recovery.go ClaimStopHTTP.RecoverPending authority C,J4 rev3=PROPOSED-p3;run=19;identity=root instance-control;basis=recovers only pending stop fences; persisted handover barriers remain for the handover journal recovery 0376cfcfebdebf8a689d264c47b559a6e5e8deef64768d4e75bebef909be19a1 |
| 363 | internal/hostguard/recoveryfence.go Guard.PendingFences authority C,J2,J4,J1 rev3=PROPOSED-p3;run=19;identity=root;basis=retains complete pending-fence enumeration including handover barriers bc4b4a5d58f470fd0e7b641acc61f2ac4082c021e729534ec4dd00ae423cd03c |
| 364 | internal/hostguard/recoveryfence.go Guard.PendingStopFences authority C,J4 rev3=PROPOSED-p3;run=19;identity=root;basis=stop-specific enumeration excludes only an exact barrier persisted in the root record f48f8b28b289556e3be77fb76a485f0d4c0a013ec12cb90197071cd2f5ddb87b |
| 365 | internal/hostguard/recoveryfence.go Guard.pendingFences authority C,J2,J4,J1 rev3=PROPOSED-p3;run=19;identity=root;basis=reads root-owned records under host lock and keeps exact barrier classification separate from ordinary stop recovery; legacy behavior retained 20be9535fd54587a54e3027f5388581ae5a64e5fcfced5a6031ffc9a4fc76a3b |
| 366 | internal/host/claimroleassembly_linux.go verifiedClaimExecutable authority C,G,J4 rev3=PROPOSED-p3;run=19;identity=agent uid carlos;basis=pins root-owned executable bytes and keeps the verified descriptor while supplying its absolute path to the root launcher file:Fstat@1122,file:Fstat@579,file:OpenFile@376,file:Read@949 7a7e9af520e4157e60ae93d12c3268a629a9b0bd1e83b263cdd27103cf2e227c |
| 367 | internal/host/claimroleassembly_linux.go claimExecutableName authority C,G,J4 rev3=PROPOSED-p3;run=19;identity=agent uid carlos;basis=duplicates the existing descriptor with CLOEXEC and its validated absolute name; never reopens a potentially replaced path e887880731a16c9e7934aef33a08169b34e7236f6d3b85a195602d35f8b69107 |
| 368 | @coverage internal/host 6673bed5fb74d6225f52a97683e7efd7cb13f97f032490c940c0cc258b1565d9 |
| 369 | @coverage internal/hostbox 0b6ddb07bc7ef62f23e402757155825e8d098eb47ec9288c09b8754bb1632e56 |
| 370 | @coverage internal/hostguard ca664497969680d692172abda403b6a5d6664f8d7c8bc16a6440f02dd8426be6 |
| 371 | internal/host/claimstop.go ClaimStopCoordinator.FenceAndStop authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=authenticated session stop retains root fence before independent unjournaled absence check; proves no journaled installation, containment or open files before bypassing nonexistent writer closure; normal drain remains for recorded launches; no-census unchanged file:Read@1610 58147f3abbf278037fc660392aeec0b6e76b667e3fe8435845ebaedc62d2ead1 |
| 372 | internal/host/claimstop_recovery.go ClaimStopCoordinator.RecoverStopped authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=pending exact root fence and exact installation inventory permit recovery through independent absence verification when no launch journal was created a91b528d9f9259612c767bf0a94e0ff7664294668f29f584a681a1a0f656ad90 |
| 373 | internal/host/claimstop_recovery.go ClaimStopCoordinator.verifyUnjournaled authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=requires root authority, exact resumed fence and sql.ErrNoRows before allowing the independent kernel absence witness; no-census unchanged 0fa59df5d2e838b944c0b36ae60598f958b1057b978cb8c123de7edace143d7a |
| 374 | internal/host/claimstop_recovery.go ClaimStopCoordinator.recoverKernel authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=only verified unjournaled absence supplies empty-producer recovery evidence; ordinary journaled recovery unchanged e04ffee4dfcd61ec8066e53d6cdbe51da920af0f1f75db6c23357122278f8c08 |
| 375 | internal/host/claimstop_writers_linux.go verifyNoProcessAt authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=session-zero entry retains its checks and delegates unchanged observation to shared helper 1c404c09d26c9c5afab607984ebf6fc6f4a592eecca4f9dd1e19daeada963802 |
| 376 | internal/host/claimstop_writers_linux.go LinuxStopKernel.VerifyUnjournaled authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=real root proc and cgroup mounts, systemd agent containment and observed boot bind the unjournaled kernel witness; requires nonzero session and durable fence identity file:ReadFile@510 1c136916f6179bab634f671036718d919fff64c447032717dedf53427ec442e4 |
| 377 | internal/host/claimstop_writers_linux.go verifyNoLaunchAt authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=rejects any root launch history for the installation; scans prior and proposed delegated containment, isolated host slice and root-derived installation descriptors; repeats journal and containment observation c51e82ce02eb33c8c209803db655bff4a2e819a24c04787cadd9303f8075fd67 |
| 378 | internal/host/claimlaunch_root.go claimUnitStopKernel.VerifyUnjournaled authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=forwards the non-destructive absence check to the real kernel without trying to settle nonexistent unit reservations 01aad0207c58d2e2ed50ed726fee6a33f5f1136c3fe15615a778a4e3b731988b |
| 379 | internal/host/claimstop_kernel_linux.go newProductionStopKernel authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=root authority selects recovery-capable systemd containment reader; nonparticipants keep exact previous reader 3f98eed355fb9818a0f2f33ad588f0473315d80c322be568465aafdcdc50dfee |
| 380 | internal/host/claimstop_kernel_other.go newProductionStopKernel authority C,J4 rev3=PROPOSED-p3;run=20;identity=non-Linux root caller;basis=unsupported platform stub returns no verifier 76915e738b8b76c59407623ffdb19872452f2c93e840c033abceec635973b167 |
| 381 | internal/host/claimstop_production.go NewProductionClaimStopHandler authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=root authority selects stopped-agent containment observation without changing peer authentication or nonparticipating construction file:CommandContext@1106,file:Read@786 44cc78066b3cfd94821fa7f2ff80e47c851c0b83f57ffd97eca94f81d49c9ed6 |
| 382 | internal/host/claimstop_writers_linux.go rootStopAgentCgroup authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=reads systemd unit identity, active state, slice and cgroup to observe recorded containment even after the edge unit stopped file:CommandContext@149 ca8dcb4f62ccd2f0a96bf9b53350f4e32836fd71352d33a7427defe12e171174 |
| 383 | internal/host/claimstop_writers_linux.go rootStopAgentGroup authority C,J4 rev3=PROPOSED-p3;run=20;identity=root instance-control uid 0;basis=requires exact edge unit and either a valid live cgroup or a stopped/failed unit with a valid root-configured slice; rejects ambiguous fields and traversal f75315926ad8c4c58ef36986b75f6b0cc646b53dca9f53e41ee680ce5a94990b |
| 384 | internal/host/rootupdates.go productionRootUpdatesHeld authority E3 rev3=PROPOSED-p3;run=20;identity=root launch/update uid 0;basis=constructs canonical update inputs; only the launch path supplies its exact root generation binding under existing release and host exclusion file:Open@1161,file:Open@802,file:Read@1484,whole:Route@1797,whole:Route@2118 5f3cbf8f79715e44257e1539658c25c50a6596a64a6b8916dd38f776f2faa2b6 |
| 385 | internal/host/rootupdates.go type rootUpdateSource authority E3 rev3=PROPOSED-p3;run=20;identity=root launch/update uid 0;basis=carries optional exact generation binding solely for launch settings resolution under host exclusion c098d3dee0212a06536177561d3bd72c868d762ea88c99be99e42aa9d2751727 |
| 386 | internal/host/rootrestart_requests_source.go rootRestartRequestSource.installation authority E1 rev3=PROPOSED-p3;run=20;identity=root update/restart uid 0;basis=ordinary installation lookup keeps host capture and locked view then common complete-census validation 6ac80df03bfde1f6249ef0197774323def84ae5c0067dad670802eeb9a33eacb |
| 387 | internal/host/rootrestart_requests_source.go rootRestartRequestSource.launchInstallation authority E2,E3 rev3=PROPOSED-p3;run=20;identity=root launch uid 0;basis=under caller-held host lock reads exact root installation and rechecks generation binding host, account, app, record, stamp, box, enrollment and installation hash before census validation 3175a18762e6a1ccf8273bff68b8a73d01390ef5674e5931060aafc24d2250fc |
| 388 | internal/host/rootrestart_requests_source.go rootRestartRequestSource.checkInstallation authority E1,E3 rev3=PROPOSED-p3;run=20;identity=root update/restart/launch uid 0;basis=requires complete nonempty installation with matching box, enrollment, migration and inventory revision in complete census c5b96d796114cf804163ed391957be76fda5dd08b10f2f297ad4d27957e61896 |
| 389 | internal/host/claimempty_recovery.go type claimEmptyRecovery authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained d63aa0641dd723b4f35992d4333a17870f4822cae9851ba89a3049131850c727 |
| 390 | internal/host/claimempty_recovery.go rootEmptyRecovery authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained ba817c5296f8afc18777cde478b1dfb87f84636178df929c6d8a1cf010836f10 |
| 391 | internal/host/claimempty_recovery.go claimServingOwners.emptyBootstrap authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained c9b2eef681d6555bc75a055486f161c3fb3512d2f69963ba6f2afc74c456ab5c |
| 392 | internal/host/claimempty_recovery.go claimServingOwners.emptyLocation authority C,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service using authenticated proof;basis=checks all object versions; only after all admissions have root no-launch proof allows preparatory platform-only files manifests and their named env objects; refuses tenant entries, database objects, unknown objects and deleted file versions fd9212fe323b2ac7f28b5885db65cfed25e6298f8a26699bd555967f5a275382 |
| 393 | internal/host/claimowners.go type claimServingOwners authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained cacabc7b0196545f1cc388c4b4d22c2785c3c3b811a52bd5d7fa89e6af951d05 |
| 394 | internal/host/claimowners.go claimServingOwners.Select authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained registry:DBPath@1081,registry:DBPath@461,registry:Host@424,whole:Route@555 586f62b80a544716c0e8873916457f7d67f02254db659fd8dd053be836e194e3 |
| 395 | internal/host/claimowners.go claimServingOwners.admissionEvidence authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained dd40914d4910247bd6616fd4b9fdfc86011c8df690bd52d5d8537cc2596e5492 |
| 396 | internal/host/movesfiles.go type movesFiles authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained 95045569641618c3acc27ee1d55087bbb9b855dd99147c648bdfd01dc8ff1fee |
| 397 | internal/host/claimfilesseed_guard.go movesFiles.checkServingFilesEvidence authority C,E3,J4 rev3=PROPOSED-p3;run=20;identity=root controller and service UID using authenticated root projection;basis=empty recovery requires retained root unlaunched stop receipts for every prior cold admission of the exact installation and local box; checks all object versions, allowing only lease and preparatory platform files under the root proof; normal baseline and no-census behavior retained whole:Route@265 bafb35881d8da7eef7dfbf97687932bc8b134de21a8d8b6bb3803a07323ac55c |
| 398 | internal/hostguard/coldhandover.go Guard.CompletedColdPredecessor authority C,J4 rev3=PROPOSED-p3;run=20;identity=root and authenticated root-view consumer;basis=selects root current completed fence when multiple controller receipts exist for one session; pending current fence refuses; legacy ambiguity behavior retained 662a4f20ec0bd817b57e256e582f8fee9e3784b1bf9764d111ca509ec596ec90 |
| 399 | internal/hostbox/launchjournal.go type LaunchReservation authority C,J4 rev3=PROPOSED-p3;run=20;identity=root launch journal;basis=additive NeverIntended cancellation evidence is root-owned; all inbound reservation constructors refuse the bit 6706ea23539c9f5c89c66f4656b197689ddbc020c08f04aae652a74ccfc9f9da |
| 400 | internal/hostbox/launchjournal.go LaunchJournal.Reserve authority C,J4 rev3=PROPOSED-p3;run=20;identity=root journal and legacy agent;basis=refuses caller-supplied root cancellation evidence d7360f3407eb6bc302eac0fb27159419e372b38ad02779a7d350b79f8e0f66a7 |
| 401 | internal/hostbox/roleintention.go LaunchJournal.IntendRole authority C,J4 rev3=PROPOSED-p3;run=20;identity=root journal and legacy agent;basis=refuses caller-supplied root cancellation evidence 4499b3ea59f8982c585e3bb46de9766d0ee0926f55843e33ac010b15780b94da |
| 402 | internal/hostbox/rolelaunch.go unitReservationShape authority C,J4 rev3=PROPOSED-p3;run=20;identity=root launch uid 0;basis=refuses caller-supplied NeverIntended evidence on both start and stop b505ac110c9d78f86813a9fb679ea5ec010e228a98ea2f14d5a8ddad2084a00c |
| 403 | internal/hostbox/rolelaunch.go LaunchJournal.TombstoneUnit authority C,J4 rev3=PROPOSED-p3;run=20;identity=root launch uid 0;basis=sets never-intended evidence only when exact reservation is absent and is durably spent before any later start f86a9c0de3d5a5edbd296ff0cbfad4e60d9a997ce4278a826e1ee9717242b7d6 |
| 404 | internal/host/claimstop_kernel_linux.go type LinuxStopKernel authority C,J4 rev3=PROPOSED-p3;run=20;identity=root stop uid 0;basis=rootAuthority restricts added never-intended evidence to root-owned journals ae158c8eede6bc837534f03f89cd00770c910cbe2ebb45ef51fc38bed75f4fde |
| 405 | internal/host/claimstop_kernel_linux.go LinuxStopKernel.VerifyStopped authority C,J4 rev3=PROPOSED-p3;run=20;identity=root stop uid 0;basis=after closure and independent absence checks additionally proves every root launch record for installation had no intended tenant execution 9665066696894745669b778ec525b240771dfdc974cd2e80e76460809a77a9ac |
| 406 | internal/host/claimstop_writers_linux.go stopNeverIntended authority C,J4 rev3=PROPOSED-p3;run=20;identity=root stop uid 0;basis=requires all installation records writer-closed, one parent group, and only root tombstones with no process or unit identity f5165bb027430b7cdac2592b11fbaeffcee008f9e884868d7bc904b25189f38c |
| 407 | internal/host/claimservingretire.go claimServingArtifactRetirement.BeforeLegacyInstall authority C,J4 rev3=PROPOSED-p3;run=20;identity=service caller of root retirement;basis=separates empty database recovery from session-zero predecessor; root still verifies ordinary prior admission stop receipts daf192253b905a23e3f49ced325e9e431edad01676fb22a6577a56dd493010d2 |
| 408 | internal/hostguard/flock_unix.go acquire authority C,J4 rev3=PROPOSED-p3;run=20;identity=root and service host-lock callers;basis=a root census caller creating the shared lock preserves its directory group so service can reopen it after reboot; existing owner validation and no-census path unchanged file:Fstat@1356,file:Fstat@398,file:Fstatat@665,file:Openat@1024,file:Openat@897 a5e19f0fb712194d07aecbfa72f7aa91fe90b7bbc16ea18e33dadd025b5f625f |
| 409 | internal/host/claimservingpark.go servingGenerationParkDisposition authority C,J4 rev3=PROPOSED-p3;run=20;identity=root retirement uid 0;basis=validates every root stop receipt and matches the original launch controller to at least one; root never-intended tombstone with closed writers and absent process identity permits discard; ambiguous intentions refuse c1e013c260fef86a61945f7c38bc1352f339adbd3c8fb8b92b3785ea6b96de59 |
| 410 | internal/host/claimordinaryparks.go productionClaimRegional.ordinaryHome authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=verified home roster, ordinary operation, exact local holder location and box-local admission history; foreign regions and moves refuse file:Exec@842,file:Exec@867 fa96f75f8af5fd1e3ba3dff81e27ac0fb7c6029663472292d698bfddaec99fe8 |
| 411 | internal/host/claimordinaryparks.go productionClaimRegional.ordinaryView authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=request-bound exact-version marker and files manifest reads retain current, unfinished and pinned generations; no move provider or deployment-record lookup 426feefeb9da8c7e2748bfcbacad1eaba561da4a0e29f2422640cb299ab1e06f |
| 412 | internal/host/claimordinaryparks.go productionClaimRegional.VerifyObligation authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=exact current publication obligation and retained root stop receipt bind predecessor generation, installation, box, region and immutable evidence time; missing root authority refuses 09dcc8365f352361ffc3f32bcfc323c25cfcdc0aa4ec3b9e7840e1e2b58e97fd |
| 413 | internal/host/claimproduction.go productionClaimRegional.View authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=ordinary home-region cleanup uses the scoped production view when no move provider is registered; registered moves retain their existing view bcefe9f8fd6420e795ef95a6170fbad1030e29f2261bcc2d677f76b6f6d577ce |
| 414 | internal/host/claimproduction.go productionClaimRegional.Authorize authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=exact predecessor root stop proof or signed operation retirement proof replaces execution permission for cleanup; existing owner and region checks remain file:Prepare@1184 4502c32e2b02fe09123ab4878c741f94a34dd645726b381f8b2455fc40fe09fe |
| 415 | internal/host/claimmoveparks.go productionClaimRegional.VerifyMovesSweep authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=moves-only sweep refuses when the moves provider is absent, including claim-free observations 467b24b7ca60a86caacee31892c6919620be43966fbf31be9ba815487ff9bc5e |
| 416 | internal/host/claimordinaryparks.go productionClaimRegional.authorizeOrdinaryRetirement authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID with authenticated root fence projection;basis=signed operation-bound retirement evidence replaces execution authority after record deletion; only exact holder or empty staging namespace, never move residue d726c4a62a957c92f4743ce791cd05a57cb650a5eae0e03270eff2e0b426b311 |
| 417 | internal/park/sweep.go protected authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID under root stop or signed retirement evidence;basis=ordinary view distinguishes independently retained file versions from database generation pins; only explicit file namespace pins receive per-version protection af0ffc56bb49f87738a94350c4c92305a8b922ede0587bc8fad4bb79b10f20d0 |
| 418 | internal/park/remote.go Engine.selected authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=claim regional worker service UID under root stop or signed retirement evidence;basis=ordinary generation retirement excludes exact live file versions from fresh selection and revalidates on manifest replay; replay selection mismatch refuses deletion 43dd4b71ef97868599cf56560a458026ac77bada65f75b314630c436e57112ca |
| 419 | @coverage internal/park b611c74d7f75c985a1546f0b79b2f7db79312a3d3d2450981c5184c04c8e324e |
| 420 | internal/host/rootexecution_authority.go ClaimRootHTTP.executionAuthority authority C,E2,J4 rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=new-host empty census classifies sibling state only by exact root installation and payload revision with persistent identity, and sibling live links only by matching root generation reservation; unknown and selected-host artifacts refuse file:Exec@1657,file:Read@553 d4c3831803029792b9bdc5d1a98049fe31a4cbca24dc3f09aac768533cd8ffee |
| 421 | internal/host/rootexecution_settle.go ClaimRootHTTP.cleanupExecution authority C,E2,J4 rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=new-host empty census classifies sibling state only by exact root installation and payload revision with persistent identity, and sibling live links only by matching root generation reservation; unknown and selected-host artifacts refuse file:Read@2928,file:Read@4252 2aeade2e9ab8cf2782b5f5c1b054504310e73dc1139747f38539014941fcd9e0 |
| 422 | internal/hostclaim/delete.go ToParking authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=production console or local regional worker using authenticated operation;basis=console ordinary delete transition under claim CAS; sets the previously empty ordinary deletion phase to park so exact root stop tuples can retire it; existing nonempty phases retained 9d5d3cf3fd1255e4a3cda50cedcd65197f65155ea4bfa57d50670ebad0e5492a |
| 423 | internal/hostbox/renewing.go renewingHeld.Release authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=production console or local regional worker using authenticated operation;basis=regional park worker release of held lease; cancels work immediately then issues exact conditional lease deletion under detached request bounded cleanup context; grants no new work 0cfd55e1a0f40851dd27be382187fc01cfab5dc2bca54262966f6a66a2799e39 |
| 424 | @coverage internal/hostclaim 5fc93a54af58686466e4f5f61f42aed8bb3e7d75038ecf48dc5faafa9e3ee83c |
| 425 | internal/host/claimstop_producers.go ClaimProducers.DrainClaim authority C,E2,J4 rev3=PROPOSED-p3;run=21;identity=authenticated local writer controller answering root stop;basis=only a fully joined and compacted drain may acknowledge a new fence for the same exact writer; unfinished drains and foreign tuples refuse; producer admission remains closed a3633b7f153cf84f565d3d6d19db1e38eba5f578de57b9a65900fd74a837c5cf |
| 426 | internal/hostbox/typedpark_path.go TypedParker.ParkedArtifactRoot authority C,J2,J4 rev3=PROPOSED-p3;run=21;identity=root retirement or generation verifier uid 0;basis=only configured root or recorded strict descendant mount containing artifact; malformed or unrelated mount paths refuse;basis=recorded mount relocation only for CapturePersistent root-protected artifacts; legacy destinations unchanged e4fe742ac8e421856f66729d888e81f828f8679fee6df93a310e0948d34cca48 |
| 427 | internal/host/claimparticipation.go productionClaimLocal.cleanup authority C,D rev3=PROPOSED-p3;run=25;identity=agent uid carlos;basis=agent closes admission and consults root launch inventory; with no recorded launch the remote client defers the filesystem census to RootBroker settlement, whose cleanupExecution independently repeats the root census; legacy and local-journal paths retain their original checks 192f8d91f40338dd304cef77e0394d971685e15142917ba1e70d606c28a6d859 |
| 428 | internal/host/claimparticipation_retired.go ClaimAssembly.completedRetirementDischarge authority C,D rev3=PROPOSED-p3;run=22;identity=agent uid carlos;basis=authenticated root fence view and exact canonical retirement receipt bind host incarnation stamp session operation box and enrollment; missing or substituted receipt refuses discharge and root settlement retains kernel checks 75b827cf499f524ead84c6824c328f7ac702854c53a8570dfdc0df0bbc168df8 |
| 429 | internal/hostclaim/delete.go FreeAfterPark authority C rev3=PROPOSED-p3;run=22;identity=authenticated console or lifecycle worker through existing claim CAS;basis=conditional holder removal after all parking obligations finish; preserves native loss evidence atomically before removal and keeps the signed-declaration archive gate 76f88d4f0f3bab8094a9426d8d809d8c8b25d8aede5915aaa43f78b0767eaea7 |
| 430 | internal/hostclaim/retainedloss.go retainNativeAdmissionLosses authority C rev3=PROPOSED-p3;run=22;identity=authenticated console or lifecycle worker through existing claim CAS;basis=copies exact native admission evidence and original holder identity into claim-retained state; does not certify losses or relax signed-declaration archival 278b599c5e822d63a2c50bb2e0ba563371564cbdfb9c05531d7efe223aa26d3f |
| 431 | internal/host/rootexecution_settle.go retiredExecutionLaunch authority C,E2,J4 rev3=PROPOSED-p3;run=22;identity=root execution broker uid 0;basis=exact retired capture and root launch closure only; caller first verifies canonical root receipt and exact inventory; no new stop effect or admission 6ccc8586537ab228f95543307e20caa6023101ffe54e72155e57b36f9d4c3d34 |
| 432 | internal/host/rootgenerationpins.go productionRootGenerationPins authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 under release exclusion;basis=retired ordinary isolated cohort only: canonical root stop receipts, irreversible retired captures, closed journals, exact original process identities gone and all managed instance cgroups empty; live pending named or legacy state retains prior verifier; generic process identity accepts valid Linux zero boot ticks file:Open@195 2cf7afda7ffe06c85030ff80c1d1d44b3f67b1589267ca0c0dfde5c81d4827fc |
| 433 | internal/host/rootgeneration_retirement.go productionRetireGenerations authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=carries the root-owned reservation snapshot under release exclusion into absence checks; closure and retirement receipts remain independently checked file:Open@292 bbbb4a42802b06da0b12d4bb921cb2d3d4b8c53a15af2054d0bdc971f8a3ea83 |
| 434 | internal/host/rootgeneration_kernel_linux.go generationStart authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 under release exclusion;basis=retired ordinary isolated cohort only: canonical root stop receipts, irreversible retired captures, closed journals, exact original process identities gone and all managed instance cgroups empty; live pending named or legacy state retains prior verifier; generic process identity accepts valid Linux zero boot ticks a10512a1faad1675d091227b19feade6f65a0f834c19be472014fd6f77f7f389 |
| 435 | internal/host/rootgeneration_kernel_linux.go productionGenerationAbsence authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks recorded launch targets and controller absence then inspects all tasks with independently verified service classification 03a98919c6c32638e9ec5a2658a68c58d895d931b3186e4968533ad28e57eadc |
| 436 | internal/host/rootgeneration_kernel_linux.go generationRecordedAbsence authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=general absence retains recorded controller death plus exact main/tenant process and containment absence; only retired isolated proofs use the scoped controller reference check c817b4c8ecc0045bde88afe7c07f040e309db684f3a0455908ca61d672f2b9f5 |
| 437 | internal/host/rootgeneration_retired_linux.go isolatedGeneration authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 under release exclusion;basis=retired ordinary isolated cohort only: canonical root stop receipts, irreversible retired captures, closed journals, exact original process identities gone and all managed instance cgroups empty; live pending named or legacy state retains prior verifier; generic process identity accepts valid Linux zero boot ticks 4030cee805e5e3c4b08e9e606548cc7c23c4a13898ecd6bffa43e1dc7cf56cbc |
| 438 | internal/host/rootgeneration_retired_linux.go retiredGenerationReceipt authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 under release exclusion;basis=retired ordinary isolated cohort only: canonical root stop receipts, irreversible retired captures, closed journals, exact original process identities gone and all managed instance cgroups empty; live pending named or legacy state retains prior verifier; generic process identity accepts valid Linux zero boot ticks 258b9f88fe29b944d2dfafebcbb383ac9742b4920909eda57c4588d254939377 |
| 439 | internal/host/rootgeneration_retired_linux.go productionRetiredGenerationAbsence authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=requires isolated reservation and exact root retirement receipt before checking recorded target absence and scoped shared-controller references; generic or named paths retain the stricter verifier 8f95c6232d728233a3a2ea091894308e2c238cfc83ed33812c08b562da814a9b |
| 440 | internal/host/rootgeneration_retired_linux.go retiredGenerationSnapshot authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=proves exact retired installations through receipts and closed matched journals; active isolated siblings remain separately retained and pinned rather than making retirement a whole-box proof a00bec36603a167bbbe9d3d724da30a7db0025f7769801868c8514466644ef21 |
| 441 | internal/host/rootgeneration_retired_linux.go emptyGenerationGroups authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=production wrapper supplies procfs, cgroupfs and the root reservation snapshot to the bounded managed-group inspection 24b4a91713227557ce9d66fff32aaf5ae80c3f532ea8335e1bc132661f4d9bb5 |
| 442 | internal/host/rootgeneration_retired_linux.go productionRetiredGenerationKernelCensus authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks retired installations own recorded groups and controller references; all populated managed groups must match a live root reservation, so active isolated siblings pass but unknown processes refuse 543f196321218063c074314fb9d05e95bc205db553890b127e11f7a8f40815aa |
| 443 | internal/host/rootgeneration_retired_other.go productionRetiredGenerationAbsence authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=non-Linux wrapper delegates to the unsupported generation-absence verifier and grants no retirement authority a281b05dae1d2b65b0fbcffe6b7cb65002da5dabfdc4f2596bd05511594b3546 |
| 444 | internal/host/rootgeneration_retired_other.go productionRetiredGenerationKernelCensus authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=non-Linux wrapper delegates to the refusing kernel census and grants no generation authority f61b35d6064ff8a5a4fa757e229167d1b8e71b0109f8d116e0f288c533552a5c |
| 445 | internal/host/rootgeneration_retirement.go generationRetirement.retire authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 holding release exclusion;basis=read immutable root retirement receipt snapshot before host exclusion; existing exact installation and journal closure checks run under exclusion before and after kernel verification; prevents recursive host locking aad12e0c897c3abab5dd04fc0f9377f56076a6341e42e92a15c4382e3bf22831 |
| 446 | internal/host/rootgeneration_retirement.go type generationRetirement authority E2 rev3=PROPOSED-p3;run=22;identity=root uid 0 under release and host exclusion;basis=retirement verifier carries a separate root-retired proof callback; caller reads canonical receipt before host locking while closure and kernel checks remain inside 132edefce1c8427220dcfee4d8bdcfc8ffa2bd21012cb97b3d330a73af13a93b |
| 447 | internal/host/claimstop_run.go activateClaimRoot authority C,D,E2,G rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=shared production startup recovers pending work, runs claimActivationReady under launch exclusion, then starts the lifecycle; the shipped-unit lifecycle witness uses this same function 32d687b7273cdc1d04ad7542e1a8f9a6bed9a566e581c4c08a12a709135a0f98 |
| 448 | internal/host/rootadoption_options.go rootAdoptionOptions authority B3,E1,E3 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks participation before constructing history or recovery options; missing census returns the original main option slice; census read errors refuse a076d56dfa12b4080a4592aaca3f21be89abb33896718f335ddaf08d8b8f4ccc |
| 449 | internal/host/rootexecution_transport.go ClaimRootHTTP.serveExecution authority D rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=authenticated broker refusal for a retired hostname has a distinct Gone response; other failures retain Conflict; no success capability is published c43b871b9cb5c41035c9d1dbc82e76e8b8cfb7d8fe0a4b8b7dbe864195073a3d |
| 450 | internal/host/rootexecution_transport.go rootExecutionClient authority D rev3=PROPOSED-p3;run=24;identity=service-UID agent and root claim/adopt/update controller uid 0;basis=preserves the root retired-host refusal instead of translating it into ErrLost; success still validates the exact request tuple and serving/token shape 2a3981bb5549db09accdb28bcbb2da93460fb677c8f8ed7652bcdb2dec964a8b |
| 451 | internal/host/rootgeneration_census_linux.go productionGenerationKernelCensus authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks protected staged tree and hardlink policy; actual systemd services pass only through unit, cgroup and executable verification while recorded live tenants use independent containment cc2500efe71568d535f5c2699115f7dc5922836c27977d072a1784fe807666f6 |
| 452 | internal/host/rootgeneration_census_other.go productionGenerationKernelCensus authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=non-Linux implementation returns permission denied; performs no kernel census a1217cf881e9d05336fc16d6050f7f7a1a2184a0c20ff2988d0cf0f9012eaa45 |
| 453 | internal/host/rootgeneration_containment_linux.go generationKernel.containedTask authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=matches only live unclosed containment reservations to current kernel group and process identity; completed historical reservations cannot shadow an active sibling wake 25b3655284fb97a02d0f2e090ec105a18f178669979c147645b5a0f1966c893a |
| 454 | internal/host/rootgeneration_kernel_linux.go generationKernel.task authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=retains the original root-only scan with matching namespaces and strict reference checks when service lookup is unavailable; only independently verified unit, cgroup and executable identity permits nonroot or private-namespace services; every accepted service still has all references and process start rechecked file:Readlink@1197 d75cd84dda21cba70763794bfd3a996f212fc75f6d01e4ce0ffae93959b61bb7 |
| 455 | internal/host/rootgeneration_kernel_linux.go generationMounts authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=rejects target-tree bind mounts and nsfs references; independently verified system services may retain ancestor mounts used by shipped private mount namespaces; unknown tasks retain the strict namespace policy 8bfb9496d7c24fd4bca0f7b84cd0b9cf01a1c116a9112f66738be5dde93b1f75 |
| 456 | internal/host/rootgeneration_kernel_linux.go generationRecordedTargets authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=revalidates persistent executable/tree identity and exact recorded main/tenant process death; a reused group requires independently verified successor containment; shared controller is checked separately by the caller 220fa257f513ea71a6e0b19e4fd5b5ec04c4454d272e09493d9fa1977db70f6d |
| 457 | internal/host/rootgeneration_kernel_linux.go generationTaskFDs authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=holds the inspected descriptor directory open and checks every live descriptor against the retained generation identities; reports the refusing descriptor without weakening namespace checks file:Open@143,file:Readdirnames@367 b8be888cc74e90cc0b0f3a6c4efd320b3edfd6f16a3c08e0ae9ad34549ea00de |
| 458 | internal/host/rootgeneration_kernel_linux.go type generationKernel authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=root kernel generation verifier carries service classification and exact retained containment; all observations are independently checked before certification 3463afcbd055b35fa94988868d8cb721272c2bc066220a0bd59e3529e811131b |
| 459 | internal/host/rootgeneration_kernel_other.go productionGenerationAbsence authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=checks recorded launch targets and controller absence then inspects all tasks with independently verified service classification de47d997019075326e1d5513d7576390d085566fd69edc35efd00f067fb1db24 |
| 460 | internal/host/rootgeneration_retired_linux.go generationRetiredController authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=for an exact retired isolated installation, an old controller may still serve another host only after its boot/start identity and all thread references to this target generation are independently checked 793dfb40f339824ca3aeb9ceecfde69d8b63452eadf1a8abda734722401f1b79 |
| 461 | internal/host/rootgeneration_services_linux.go generationServiceGroup authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=accepts exact systemd cgroup or root-owned non-writable descendants only; delegated service-owned subgroups cannot impersonate platform or system services file:Lstat@281 b82ebaadda3ee8a36a66d69c36dda2551329197b903c09875b41fc0bbff44b38 |
| 462 | internal/host/rootgeneration_services_linux.go generationServiceReader authority E2 rev3=PROPOSED-p3;run=25;identity=root generation kernel reader uid 0;basis=classifies independently verified platform and system services by trusted unit files, systemd main PID, cgroup and protected executable; only edge main threads may use its delegated supervise subgroup; exact guard-exec edge verifies guard and selected current against signed protected identities and matches current to the process; descriptor and generation-reference checks remain file:CommandContext@919,file:EvalSymlinks@1633,file:Readlink@2707 4e631521124d1055e7f2714d476dcc2fb3007a6838be595996af6dc38db1acbb |
| 463 | internal/hostguard/rootretired_host.go RootAuthority.HostRetired authority C rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=refusal-only host-locked read of the exact retained installation, inactive stamp and retired tuple; quarantine, pending installation and barrier refuse; no evidence is rewritten e9e93474a629358ab5dda2d845b2571e913d5a7ec14beb544851f55690b17b1b |
| 464 | internal/host/rootgeneration_services_linux.go generationServiceExecutable authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=opens the kernel-selected process root and checks each executable-path component with descriptor-relative no-symlink traversal, root ownership and no group/world writes; final single-link regular inode must equal the running executable; private controller mounts cannot hide a legitimate host executable file:Fstat@576,file:Open@243,file:Openat@1123 b0380d86d61198c94f826dc48df3d46f1352dd983279b75387dbbe2b51cca59f |
| 465 | internal/host/rootgeneration_payload_other.go generationPayloadFiles authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=non-Linux implementation permits route and timer-only inventories and refuses physical payload entries; performs no persistent-file verification candidate:Kind@183,candidate:Kind@204 182189d8409113d671cdc76fc5d2d73e7056057bca230d546e65300c428b2c18 |
| 466 | internal/hostbox/inventory_identity_linux.go VerifyInventoryIdentity authority E2,J2,J4 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=default verifier retains root-owned ancestry and delegates exact persistent identity checks to the owner-aware verifier 5fc8216d53453a86c90a59e49a31b4e6027772488bae4b7c3068f79409891b18 |
| 467 | internal/hostbox/inventory_identity_linux.go VerifyInventoryIdentityForOwner authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=reopens the exact managed object without symlinks, verifies persistent filesystem, handle, inode, ownership and mount shape; cross-boot ancestry admits only the explicitly selected owner at the final managed root 1d0985ac5f306797f311c60ca582a8323c0194f6c3bfc1785dfe3da9cfa36786 |
| 468 | internal/hostbox/inventory_identity_linux.go checkedInventoryAncestry authority E2,J2,J4 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=default ancestry remains root-owned and protected through the final directory 80004516dfdd0c3dff425853c7f4010813a98068c6a0918e5367c40a575fe569 |
| 469 | internal/hostbox/inventory_identity_linux.go checkedInventoryAncestryOwner authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=descriptor-relative no-symlink walk requires root ownership and no group/world writes for every ancestor; only the final managed directory can have the explicitly selected service owner file:Fstat@649,file:Open@172,file:Openat@456 d4e93ccc1794dfc0854f723a637597ad5d8cc7a7117ada380b6289a2d1c470b1 |
| 470 | internal/hostbox/inventory_identity_other.go VerifyInventoryIdentity authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=non-Linux implementation returns ErrUnsupported; performs no inventory identity verification 2c1db6b94ad3c11b95e6905ff935efe3e13396b6d4febb6d757c1eda38039921 |
| 471 | internal/host/rootgeneration_census_linux.go generationCensusRetry authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=restarts the entire independent kernel census at most three times only when a process disappears; unknown tasks and permission failures refuse immediately, and no partial census is accepted 3cfd54f395ed7e77b15c01b76567de0188573603aafc4e7ec72f0c3cfb9d512f |
| 472 | internal/host/rootgeneration_requirements.go generationLocalObligations authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=requires retained route and state artifacts; a current route-only installation without predecessors or any launch is unlaunched only after exact root FreshInstallation proof and physical state-directory absence, recomputed on every read file:Lstat@3018 1a5c493c0a6383df880d4d6e730f6d01822559cab804b57ac445e36bb4535f3c |
| 473 | internal/host/rootgeneration_requirements.go generationUnlaunched authority E2 rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=requires absence of every root launch for this hostname, selects the earliest retained stamp of this same incarnation, and performs one durable unconsumed-creation read; any read error refuses; empty installations keep their existing path; consumers independently validate transfers and physical state 8041de414e9b90f044066c4cad51e7e8b43dea858a4e2ae6eb6f22418466a720 |
| 474 | internal/host/rootinventory_sibling.go ClaimRootHTTP.rootSiblingPath authority C,G rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=requires exact retained sibling installation and inventory revision; the layout package alone classifies and verifies the private instance alias; public payload identity and generation pin ownership stay mandatory file:Open@1813,file:Readlink@2063 43657b556a4c238a0fae72aad5f89c13d1f4168b7417644934474ea918cf0176 |
| 475 | internal/host/claimservingreboot_binding.go servingParkReadBinding authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes mount-namespace rebinding; same-boot device substitution refuses; original retirement identities stay immutable; preparation is keyed by the observed mount and repeat reads precede each binding write file:Read@111 e15d6fa67724d7dc031c33cd72c0e167d36de7bd78af15954248700b44dcd3cb |
| 476 | internal/host/claimservingreboot_commit_linux.go servingParkLedger.commitRebootLocked authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes private-namespace rebinding; device substitution within a boot refuses; immutable source identities and repeated observations constrain namespace and record commits file:Read@246 0bcb3022797dbc3bbf3330633b55cd2b797a8e02122c7f1abcc287f7234c1922 |
| 477 | internal/host/claimservingreboot_linux.go servingParkFS.observeRebootRecord authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes mount-namespace rebinding; same-boot device substitution refuses; original retirement identities stay immutable; preparation is keyed by the observed mount and repeat reads precede each binding write file:Readdirnames@3147 2f806025a2a308f545188aa2dbc6d8cd2f178d51711ba68beb16ef4da94aa746 |
| 478 | internal/host/claimservingreboot_prepare_linux.go servingParkLedger.prepareRebootLocked authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes private-namespace rebinding; device substitution within a boot refuses; immutable source identities and repeated observations constrain namespace and record commits file:Read@621 ce54be50398b3a3eaede02d240e9a9c58515168f5195bd498b788041658ae6a5 |
| 479 | internal/host/claimservingtopology_linux.go servingParkFS.inspectRebootTopology authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes mount-namespace rebinding; same-boot device substitution refuses; original retirement identities stay immutable; preparation is keyed by the observed mount and repeat reads precede each binding write file:Read@501,file:Read@936 9d4612c414ea82f4f20723bb0e2dbca8963e93ca377b159527a39ea861e59870 |
| 480 | internal/host/claimservingpark_recovery_linux.go servingParkRoot.recoverServingParks authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=persistent filesystem, handle, inode, owner and topology evidence authorizes private-namespace rebinding; device substitution within a boot refuses; immutable source identities and repeated observations constrain namespace and record commits b1a49869990546ea6205c69db52c45d4f35fa747f3a1e1780c9b548c4efdd68f |
| 481 | internal/host/rootinventory_sibling.go ClaimRootHTTP.rootEmptyCensus authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=copies the configured census and adds root-only sibling classification for execution admission, settlement and inventory registration; no agent-owned registry authority ca59fff522b539f198e6aa8c56cac120014c0edfb072bb6d1044760fec13cb47 |
| 482 | internal/host/claimservingreboot_prepare_linux.go servingNamespacePreparationName authority C,G rev3=PROPOSED-p3;run=25;identity=root instance-control uid 0;basis=keys durable preparation by boot and observed mount so repeated same-boot controller namespace recovery cannot collide with a prior preparation; all authority and persistent observations remain checked by the prepare/commit callers 01de715e16cb00830f17999f497b1c85a202f236609f5306aeed5840001a44a0 |
| 483 | internal/host/rootgeneration_kernel_linux.go generationFileProof authority E2,G rev3=PROPOSED-p3;run=25;identity=root generation activation, retirement and release readers uid 0;basis=both generation consumers require the same persistent filesystem/handle/inode/type/owner/mode and filesystem-relative source path across private and host mount layouts; same-boot device stays exact; root-owned ancestry remains independently checked by each opener 5ab08e86bf9dcaef527b0751068dbf838f869115c630ead17c0bc866b47a17d5 |
| 484 | internal/host/rootgeneration_services_linux.go generationServiceSupervisor authority E2,G rev3=PROPOSED-p3;run=25;identity=root generation kernel reader uid 0;basis=systemd main PID and trusted unit/executable identify only the edge main process threads in its exact supervise subgroup; unknown child processes and other services remain refused; does not exempt descriptor or generation-reference checks 62fcbfa690841ecc68ed935cae404a75b0d4f3b533af871af64a9ff19586d85b |
| 485 | internal/release/rootgenerationproof.go GenerationFileProof authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=requires persistent filesystem handle inode ownership mode and exact child layers; normalization may remove recorded outer private mounts only in a different namespace or boot and to a strict ancestor mountpoint with identical filesystem-relative source; added or substituted layers refuse d1a300d3ae711f83fd260fab2592ab18170c6bb5ea0fdb4ebc18559fc265eec2 |
| 486 | internal/release/rootgenerationproof.go generationProofUnescape authority E2 rev3=PROPOSED-p3;run=25;identity=root generation activation, retirement and release readers uid 0;basis=both generation consumers require the same persistent filesystem/handle/inode/type/owner/mode and filesystem-relative source path across private and host mount layouts; same-boot device stays exact; root-owned ancestry remains independently checked by each opener 744d84125ad095053c32cdbfe83632b284d222ada237fa3dca5b5c9f5f307656 |
| 487 | internal/host/rootgeneration_containment_linux.go generationKernel.replacedGroup authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=only a closed isolated predecessor may accept a different ordinary containment at its canonical pathname; requires another root reservation for the same host/account/app, a distinct attempt and invocation, current boot, exact live kernel containment and every occupant independently checked; old process identities are still checked absent by the caller bc1e292d60f204bf470d4805d24b9b11fefe22c792b1dba2a55cfc2675670e03 |
| 488 | internal/host/rootgeneration_retired_linux.go generationKernel.emptyGroups authority E2 rev3=PROPOSED-p3;run=26;identity=root retirement and pin readers uid 0 under release exclusion;basis=bounded cgroup tree inspection rejects symlinks and every task lacking a matching live root reservation with verified process, executable, namespace and containment identity file:ReadFile@492,file:WalkDir@100 3918f75eb9d2a483079dcd05e3c4a8b2be99d6f6a6c1692c45b9255965885723 |
| 489 | internal/rootstate/persistent_linux.go ObjectIdentity authority E2,J2,J4 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=captures filesystem handle inode owner mode boot and the ordered kernel mount-parent lineage; current mount numbers select and connect snapshot entries only, never establish persistent identity file:Fstat@170,file:Fstatfs@235,file:ReadFile@1036,file:ReadFile@936,file:Readlink@1128,file:Statx@302 5bc8caadf2d4b31b3ed2073aeaba0685a2244b8ce1628d7ab557082990be58c8 |
| 490 | internal/rootstate/persistent_linux.go persistentMountLineage authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=retains the ordered kernel mount-parent chain without recyclable identifiers; a parent hidden by chroot must match the independently opened root mount and persistent root proof 4e6c9f22b753680bc422ed905a526f9e5abceef762669814bfcdc062fcf785c1 |
| 491 | internal/layout/census.go InstanceCensusName authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=layout owns exact public and private instance directory classification; classification grants no exclusion without independent sibling authority and physical alias verification f1997087a9be9630ffc0c62ac6ddcfb765b1a4bd7f8a15aa215dd0e44ca7047e |
| 492 | internal/layout/census.go VerifyInstanceCensusAlias authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=layout owns private raw directory reads; descriptor-relative no-symlink identity capture proves the raw path and the verified public sibling share boot device namespace persistent object and exact filesystem-relative source path 86ce305862058b648878f2deed2b1289c8c109b510420e61a13dc376f70300d2 |
| 493 | @coverage internal/layout 60e9c53b973c2af23757fad1f77652f0b5b46cf0857849c295071a2c0bc764d6 |
| 494 | internal/rootstate/state.go sameMountLayers authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=requires identical child mount layers and ordered retained ancestry; only recorded ancestor self-binds proven from their parent filesystem-relative path may disappear across views; added or substituted ancestors refuse even when mount numbers are recycled def1eba64c720215fc294ca409f50bac1658ec638af38d1eaf5e76708487ed67 |
| 495 | internal/rootstate/persistent_linux.go persistentMountBoundary authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=opens the process root descriptor and requires its current mount ID to equal the missing parent; retains filesystem identity handle inode ownership and mode as a boundary proof, refusing unknown or unsupported ancestry file:Fstat@495,file:Fstatfs@560,file:Open@74,file:Statx@228 f0c044e18d350701fc96b2c65e506b687d423ce4ea97d90ec64cbbacbb226b83 |
| 496 | internal/host/rootinventory_state_linux.go verifyPreparedStateIdentity authority C,J1 rev3=PROPOSED-p3;run=28;identity=carlos agent uid carlos;basis=read-only existing-state check; root verifier remains strict; only a same-boot different namespace may add self-bind ancestors around unchanged child mount layers and persistent object identity; changed metadata child mounts filesystem or boot refuse;test=TestPlan14PreparedInventoryPrivateView 58c378288e10f40c5e50595fe54fd992a96b906aea9863491d37947e9450bb8e |
| 497 | internal/rootstate/persistent_linux.go uniqueMountIdentity authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=captures non-reused kernel mount and namespace sequence IDs through STATX_MNT_ID_UNIQUE and NS_GET_MNTNS_ID; missing or unsupported evidence refuses rather than falling back to recyclable numbers file:Open@344,file:Statx@95,file:Syscall@461 54d8759db39bb4e4255c81a56fdbf0ab52883e911a5d189acba7be4d26a7c490 |
| 498 | internal/rootstate/state.go FileIdentity.SameMountNamespace authority E2 rev3=PROPOSED-p3;run=28;identity=root claim generation and inventory readers uid 0;basis=same-boot namespace relation requires nonzero kernel namespace sequence IDs; recyclable proc namespace names never establish this relation 4e4a48f09b5e09d65f6e402eb17426f774e2e46ab6f7ee47406ba7d81334b80e |
| 499 | internal/host/rootgeneration_services_linux.go generationGuardEdgeStart authority E2 rev3=PROPOSED-p3;run=30;identity=root generation verifier uid 0;basis=admits only the exact single systemd guard-exec edge invocation on carlos-edge.service without ignored errors; signed guard and selected executable verification remain in the caller 97a2702e03779010a6f5fc70a572e3da52e61775588d9ea2f14c840e021199e3 |
| 500 | internal/host/claimcensus.go claimUnitCensus authority C,G,J4 rev3=PROPOSED-p3;run=30;identity=root installation admission controller uid 0;basis=classifies the three exact guard-arm platform drop-in files as shared regular files alongside shipped units; unknown drop-ins, per-host artifacts and symlinks remain refused file:ReadFile@771 2c2a0259fab748ce2a5045ca3da814d4d3abbac9e64ad04c3e266e72ed2a91ce |
| 501 | @coverage internal/lease 511d4fb6f91c1b758758a02095047f11e0357ecb50875d7b5af0c390a7aba141 |
| 502 | |
amadan