Native scoped admission with authenticated receivers and child isolation #666

Merged

toasterson merged 9 commits from feat/mausbot-native-admission into main 2026-10-17 23:16:18 +00:00

Conversation 0 Commits 9 Files changed 44 +5413 -35

toasterson commented 2026-10-17 14:54:46 +00:00

Owner

Copy link

Change

Adds optional, default-empty native admission for dedicated allocation_read / executor_scoped principals. Each use checks the exact reconciled owner/allocation/session/workspace/sandbox/generation/executor/site/root/live-lease tuple. Canonical route/operation allowlists and independent executor receipt/process ownership checks deny adjacent or unattributed authority without effects.

Native TLS terminates directly at the receiver, with exact issuer/host verification at the proxy. Optional Linux child isolation requires a root receiver, valid nonzero child UID/GID, separate session, cleared groups/capabilities and no_new_privs. Key/token/config/data/issuer custody covers every symlink hop and excludes workspace traversal; protected hardlinks are required. API-created files/dirs remain usable by dropped children. Isolation rejects unisolated helper launch/restart/pair/login-status and active/unknown legacy helpers. Legacy configurations and #665 runtime_auth/private-slot implementation remain intact.

CI4316 failure and correction

At 19a40cd99c7de3c34d231db92940a31f709d6e89, test-session-platform job 0 failed: six new native TLS tests panicked with receiver trust files require trusted directory ancestry (9 passed, 6 failed, 0 ignored). Genuine Solstice request 1c7c85f8-cf98-48c9-a88a-c2329923e3fa explicitly checks out that SHA and exits 101. Forgejo's job-log download was not used for diagnosis.

Cause: the new TLS fixtures depended on default filesystem modes. The retained round-2 executable reproduces all 15 tests passing under umask 0022 and the identical six failures under 0002. This demonstrates an environment-sensitive fixture defect, not a claimed flake. The original guest's exact umask/offending component was not logged and remains unknown.

The correction at 612fd6a4977868fb2f057f3e77bc0ae126d61da1 requests certificate/projected-generation directories with mode 0700 and sets generated public CA/leaf files to 0644; private leaf keys stay 0600. A new regression reexecutes the real trust/symlink test under child-only umask 0000, retaining positive TLS/projected-key checks and writable-ancestry denials without racing the parent harness. This correction changes only fixtures/tests and evidence: production receiver/TLS/child/admission code, #665 runtime_auth and default-empty native_admission are unchanged.

Failure, cause, validation limits and exact compressed logs · Provenance and SHA256 receipt.

Validation and review

• Current source: direct rustfmt and diff checks pass; archived-log hashes, six failure identities, both historical reproduction summaries and old-head isolation receipt verified. Fresh-context independent delta review: CLEAN STATIC REVIEW, no concrete blockers; reviewed source hashes match. Round-4 review.
• No current-source local compile/test claim: Data had only 12.3 GiB free initially and 11.2 GiB at the next check, below the 20 GiB stop floor. No Cargo/build or target deletion was performed. Historical executable reproduction is diagnosis evidence only.
• Old-head Linux evidence: genuine request 03d34cc8-ff64-4edf-afed-6f5a0412e05f completed both receiver-isolation tests at 19a40cd9, with structured receipt tests_executed=2, tests_ignored=0. Probes include key/broad-token reads, same-filesystem hardlink, proc memory/fds, process_vm_readv, ptrace, signal/session, UID/GID/groups/caps/no_new_privs, CLOEXEC/setuid, API ownership, helper denials, endpoint failure/child rebind/no-bearer and rightful restart. This is old-head disposable-VM fixture proof only.
• Earlier round-2 local evidence: 15 native + 17 executor/sandbox/bootstrap + 35 affected library tests passed on Mac, as did feature-free, runtime-only (akhrtd, akh-runtime-auth), client-only and final executor/sandbox checks. #665 runtime_auth fixtures: 13 passed; the real-backend case remains in CI. Full-diff independent static review against main closed the custody, identity sentinel, helper, hardlink, API ownership and session-signal findings. Round-2 evidence · Round-2 review.

Fresh exact-head CI is required: all 16 native-admission tests (including the umask regression), remaining platform/transcript/Roman/real-backend checks, both Linux receiver-isolation tests and a new exact-head RECEIVER_ISOLATION_CI_RECEIPT with 2 executed / 0 ignored. Old-head passes do not validate this head. Parent owns CI watching and merges; this implementation child watches none.

Post-merge acceptance (parent/operator)

Operator-approved live activation remains with the parent after merge and green exact-head CI:

1. Capture merged-main image/binary provenance, concrete Service/Pod/endpoints and kernel/container/namespace topology; direct native TLS route with sequenced legacy callers and no plaintext bypass.
2. Reconcile authoritative owner/session/allocation/workspace/generation; verify root/child/helper/content ownership, drain/reconcile legacy helpers or route helper workloads separately; issue exact SAN/CA and dedicated grant/verifier, verify private projected-file custody plus renewal/revocation.
3. Exercise real cluster proxy-to-native lifecycle and wrong principal/tuple/host/CA/substitute denials, deployed key/proc/ptrace/signal/capability checks and receiver-process restart/unknown-receipt cleanup.
4. Complete PR200 callback TLS, native MCP discovery/tool calls, visible-partial-text cancellation and same-allocation acceptance. UNKNOWN/expired candidates remain unbound; Janus delegated authority stays separate; Tecton stays deferred; destination rules stay empty until reconciliation.

Detailed acceptance and rollback.

No merge, deployment, live mutation, enrollment, grant issuance, activation, Board use or blind rerun was performed. #644 was untouched. WAITING-CI: this exact head is not merge-ready until its checks pass.

## Change Adds optional, default-empty native admission for dedicated `allocation_read` / `executor_scoped` principals. Each use checks the exact reconciled owner/allocation/session/workspace/sandbox/generation/executor/site/root/live-lease tuple. Canonical route/operation allowlists and independent executor receipt/process ownership checks deny adjacent or unattributed authority without effects. Native TLS terminates directly at the receiver, with exact issuer/host verification at the proxy. Optional Linux child isolation requires a root receiver, valid nonzero child UID/GID, separate session, cleared groups/capabilities and `no_new_privs`. Key/token/config/data/issuer custody covers every symlink hop and excludes workspace traversal; protected hardlinks are required. API-created files/dirs remain usable by dropped children. Isolation rejects unisolated helper launch/restart/pair/login-status and active/unknown legacy helpers. Legacy configurations and #665 runtime_auth/private-slot implementation remain intact. ## CI4316 failure and correction At `19a40cd99c7de3c34d231db92940a31f709d6e89`, `test-session-platform` job 0 failed: six new native TLS tests panicked with `receiver trust files require trusted directory ancestry` (9 passed, 6 failed, 0 ignored). Genuine Solstice request `1c7c85f8-cf98-48c9-a88a-c2329923e3fa` explicitly checks out that SHA and exits 101. Forgejo's job-log download was not used for diagnosis. Cause: the new TLS fixtures depended on default filesystem modes. The retained round-2 executable reproduces all 15 tests passing under umask `0022` and the identical six failures under `0002`. This demonstrates an environment-sensitive fixture defect, not a claimed flake. The original guest's exact umask/offending component was not logged and remains unknown. The correction at `612fd6a4977868fb2f057f3e77bc0ae126d61da1` requests certificate/projected-generation directories with mode `0700` and sets generated public CA/leaf files to `0644`; private leaf keys stay `0600`. A new regression reexecutes the real trust/symlink test under child-only umask `0000`, retaining positive TLS/projected-key checks and writable-ancestry denials without racing the parent harness. This correction changes only fixtures/tests and evidence: production receiver/TLS/child/admission code, #665 runtime_auth and default-empty native_admission are unchanged. [Failure, cause, validation limits and exact compressed logs](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/evidence/native-admission-20261017/round4-ci4316/README.md) · [Provenance and SHA256 receipt](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/evidence/native-admission-20261017/round4-ci4316/receipt.json). ## Validation and review - **Current source:** direct rustfmt and diff checks pass; archived-log hashes, six failure identities, both historical reproduction summaries and old-head isolation receipt verified. Fresh-context independent delta review: **CLEAN STATIC REVIEW**, no concrete blockers; reviewed source hashes match. [Round-4 review](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/evidence/native-admission-20261017/round4-ci4316/independent-review.md). - **No current-source local compile/test claim:** Data had only 12.3 GiB free initially and 11.2 GiB at the next check, below the 20 GiB stop floor. No Cargo/build or target deletion was performed. Historical executable reproduction is diagnosis evidence only. - **Old-head Linux evidence:** genuine request `03d34cc8-ff64-4edf-afed-6f5a0412e05f` completed both receiver-isolation tests at `19a40cd9`, with structured receipt `tests_executed=2`, `tests_ignored=0`. Probes include key/broad-token reads, same-filesystem hardlink, proc memory/fds, process_vm_readv, ptrace, signal/session, UID/GID/groups/caps/no_new_privs, CLOEXEC/setuid, API ownership, helper denials, endpoint failure/child rebind/no-bearer and rightful restart. This is old-head disposable-VM fixture proof only. - **Earlier round-2 local evidence:** 15 native + 17 executor/sandbox/bootstrap + 35 affected library tests passed on Mac, as did feature-free, runtime-only (`akhrtd`, `akh-runtime-auth`), client-only and final executor/sandbox checks. #665 runtime_auth fixtures: 13 passed; the real-backend case remains in CI. Full-diff independent static review against main closed the custody, identity sentinel, helper, hardlink, API ownership and session-signal findings. [Round-2 evidence](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/evidence/native-admission-20261017/VALIDATION.md) · [Round-2 review](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/evidence/native-admission-20261017/round2-independent-review.md). **Fresh exact-head CI is required:** all 16 native-admission tests (including the umask regression), remaining platform/transcript/Roman/real-backend checks, both Linux receiver-isolation tests and a new exact-head `RECEIVER_ISOLATION_CI_RECEIPT` with 2 executed / 0 ignored. Old-head passes do not validate this head. Parent owns CI watching and merges; this implementation child watches none. ## Post-merge acceptance (parent/operator) Operator-approved live activation remains with the parent after merge and green exact-head CI: 1. Capture merged-main image/binary provenance, concrete Service/Pod/endpoints and kernel/container/namespace topology; direct native TLS route with sequenced legacy callers and no plaintext bypass. 2. Reconcile authoritative owner/session/allocation/workspace/generation; verify root/child/helper/content ownership, drain/reconcile legacy helpers or route helper workloads separately; issue exact SAN/CA and dedicated grant/verifier, verify private projected-file custody plus renewal/revocation. 3. Exercise real cluster proxy-to-native lifecycle and wrong principal/tuple/host/CA/substitute denials, deployed key/proc/ptrace/signal/capability checks and receiver-process restart/unknown-receipt cleanup. 4. Complete PR200 callback TLS, native MCP discovery/tool calls, visible-partial-text cancellation and same-allocation acceptance. UNKNOWN/expired candidates remain unbound; Janus delegated authority stays separate; Tecton stays deferred; destination rules stay empty until reconciliation. [Detailed acceptance and rollback](https://code.aopc.cloud/toasterson/akh-medu/src/commit/612fd6a4977868fb2f057f3e77bc0ae126d61da1/docs/mausbot/native-admission.md#post-merge-acceptance-parentoperator-owns-execution). No merge, deployment, live mutation, enrollment, grant issuance, activation, Board use or blind rerun was performed. #644 was untouched. **WAITING-CI: this exact head is not merge-ready until its checks pass.**

toasterson added 1 commit 2026-10-17 14:54:46 +00:00

feat(sandbox): add exact native admission for scoped computer principals c20c232fed

toasterson added 1 commit 2026-10-17 14:58:43 +00:00

docs(mausbot): clarify receiver isolation and validation scope [skip ci] 4c92ed4716

toasterson added 1 commit 2026-10-17 14:59:41 +00:00

docs(mausbot): retain scoped lifecycle acceptance gaps [skip ci] 9acddb8520

toasterson added 4 commits 2026-10-17 21:48:44 +00:00

Merge remote-tracking branch 'origin/main' into feat/mausbot-native-admission 8b570aa0ec

feat(executor): authenticate native receivers and isolate executor children beb26c1e82

ci(executor): require receiver isolation receipts from disposable root VMs 6699ca74fa

docs(mausbot): record receiver review and post-merge acceptance gates e221017b91

toasterson added 1 commit 2026-10-17 21:49:00 +00:00

docs(mausbot): normalize validation log whitespace 19a40cd99c

toasterson changed title from [WIP] Native scoped allocation and executor admission to Native scoped admission with authenticated receivers and child isolation 2026-10-17 21:49:26 +00:00

toasterson added 1 commit 2026-10-17 22:32:33 +00:00

test(native): make TLS trust fixtures independent of umask 612fd6a497

toasterson merged commit 71ca31b755 into main 2026-10-17 23:16:18 +00:00

toasterson referenced this pull request from a commit 2026-10-17 23:16:19 +00:00

Native scoped admission with authenticated receivers and child isolation (#666)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

follow-up

Documented operational follow-up

No labels

follow-up

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

toasterson/akh-medu!666

No description provided.