| 1 | { |
| 2 | "status": "Proposed startup component; no command mounting or database integration", |
| 3 | "parent_contracts": [ |
| 4 | "home-operator-open.md at approved 4770bc6", |
| 5 | "platform maintenance-launch.md at approved 8eb788c9", |
| 6 | "home-provisioner.md at approved 898fe219" |
| 7 | ], |
| 8 | "alignment": "The prior opened-DB contract listed fd0/1/2/3. The reviewed platform launch adds fd4 as a startup-only readonly artifact pin. Home verifies fd4 against /proc/self/exe and closes both executable descriptors with checked errors before any opened-DB baseline. fd4 never becomes an exception in the database descriptor inventory. Consumed fd0/fd3/fd4 are closed by atomic replacement with readonly /dev/null, preserving their reservation and preventing os.Stdin from aliasing a future SQLite file. The private /dev/null source is closed after replacement. Executable descriptors do not enter the regular-file baseline.", |
| 9 | "implementation": "internal/operatorlaunch.ReadOperator checks mutable-v1 metadata using the shared exact-pinned launchctx module. No HTTP or command entrypoint invokes it yet.", |
| 10 | "ordering": [ |
| 11 | "Read only the private FIFO at fd3 under a five-second startup bound and caller cancellation; cap at 8192 plus one byte, require EOF, close with checked error, reject malformed or checker-mode context.", |
| 12 | "Require byte-exact database selector equality. Apply the earlier of startup timeout, caller deadline and context execution deadline.", |
| 13 | "Require fd4 readonly regular identity equal to opened /proc/self/exe, stream the actual executable SHA256 and compare artifact_digest, and check all executable descriptor closures.", |
| 14 | "Read only private FIFO stdin with 65536 plus one byte bound and EOF; match exact input_sha256 and check stdin closure. A failed startup returns only a fixed error and no private result bytes.", |
| 15 | "The future command adapter must next validate the signed Home request using pinned role/origin/action/configuration, then construct the existing opened-DB connector. Startup metadata alone grants no mutation or worker authority. No database is opened by this component." |
| 16 | ], |
| 17 | "boundary": "Native Linux, fixed nonserving trusted-worker process. The worker owns actual owner approval, lifecycle fence, continuous lease, verified release/environment and strict containment. Neither synthetic inherited descriptors nor metadata establish those facts.", |
| 18 | "verification": [ |
| 19 | "Actual subprocesses with both default Go runtime and controlled fixture runtime settings", |
| 20 | "Valid v2 checker context rejected by mutable-v1 reader", |
| 21 | "Regular-file context/stdin and same-inode O_PATH executable descriptor rejected", |
| 22 | "Wrong context, oversized input/context, wrong selector/hash/image/flags and expired deadline refuse", |
| 23 | "Stalled context and stdin terminate under the two-second caller deadline (the component also sets an independent five-second upper bound)", |
| 24 | "fd0/fd3/fd4 refer to readonly /dev/null on return; a subsequently opened regular file uses a descriptor above 4 and remains usable after os.Stdin.Close; database sentinel remains unchanged" |
| 25 | ], |
| 26 | "remaining_before_mount": [ |
| 27 | "Fable review of this alignment and source", |
| 28 | "Fixed pinned configuration schema and signed-request binding in final command adapter", |
| 29 | "Modernc package-init and opened-DB baseline call-graph review", |
| 30 | "Native full worker plus consumer integration", |
| 31 | "Real owner-approved preview provisioning and restore drill" |
| 32 | ], |
| 33 | "review_history": [ |
| 34 | { |
| 35 | "revision": "6143a83", |
| 36 | "model": "claude-fable-5-1", |
| 37 | "verdict": "REQUEST_CHANGES", |
| 38 | "receipt": "/home/paulca/.cache/oficina-provisioning-20260911/home-startup-review/review.json", |
| 39 | "required": [ |
| 40 | "Atomically replace consumed descriptors with readonly /dev/null", |
| 41 | "Prove regular-file context/stdin refusal" |
| 42 | ] |
| 43 | } |
| 44 | ], |
| 45 | "parent_contract_note": "Platform maintenance-launch.md retains a stale pending annotation. Actual approvals are recorded in platform discussion117; this Home alignment and source require their own fresh verdict before mounting." |
| 46 | } |
| 47 | |
amadan