feat(protected): Isolate owned daemon roles from runtime observers - #1416
Conversation
Add a fixed four-role source-build adapter with controller-owned launch intent, isolated storage and network namespaces, scoped process observation, and exact-invocation cleanup. Require controller-verified app sessions, set role access independently of administrator umask, and handle process-exit sampling races without weakening required bindings. Include an installed positive-path driver, acceptance contract, regression tests, and the remaining implementation and installed-validation gaps. Keep protected execution closed pending workload, finite-native, and original-authority prerequisites.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Use controller-owned role constants throughout preparation after validating the selected roster. This removes private selection data from generated configuration paths and resolves the CodeQL clear-text data flow without suppressing the check. Cover substituted and reordered role selections before mutation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 204134e8f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Keep malformed candidate HTTP responses inside the request error boundary so they cannot terminate the controller and healthy sibling roles. Require distinct measured principal context in workload acceptance v2 and bind denial UIDs to the fixed actor account. Add live HTTP parser and hostile principal regressions.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a36b7048e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9592b50f38
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c092ab8e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15492c2bc6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Provide the Linux peer-option name only within fake-connection tests, preserving protocol and malformed-response coverage on macOS. Guard the real descriptor-transfer test on its Linux proc, setns, and close-on-exec prerequisites. Keep production credential handling unchanged.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a9b36565a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f50583f507
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: daf5757aee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5aa876606f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 145ec11990
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c5811959f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ef78579d8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
1 participant
The current cross-version supervisor launches candidate code as the observer, so its private state and sibling management interfaces do not have a workload boundary. This adds a prospective controller-owned four-role adapter for
debian13-systemd257-workload-v1, with distinct role accounts, fixed systemd services, isolated storage and network namespaces, constrained management connections, and scoped process observation and termination.Draft: PR-314 implementation and installed acceptance remain incomplete. Protected authorize/start/checkpoint remain closed.
Changes
Validation
Latest focused checks executed during implementation/review:
Earlier broader checks and exact counts are recorded in
docs/pr-314-controller-owned-workload-role-isolation.md. They include the four certification self-tests and a successful./gradlew :platform-devtools:installDist assembleCryptadDist. No Java source changed; the full Java test suite was not run. The distribution build reported 329 Error Prone warnings in 117 untouched Java files. Two overlapping local scheduler runs passed their harness tests but produced different numeric verdicts, including dispersion/regression findings in one run; neither established performance acceptance.Local root fixtures exercise filesystem permissions, socket transfer and real process-exit timing. Service-manager and many fault observations are simulated. Unit-file verification is static only. The installed driver prerequisite probe returned exit 78: not executed.
Outstanding implementation and acceptance
Base is
45eb43d6654074df884f59415fa598c1cda93e36, the squash integration of #1415 (PR-313). Historical observations and failed/interrupted evidence are preserved. No VM was allocated or deleted, and no existing-host workload deployment or protected enablement was performed.