ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Refine rootless and network readiness contracts

Browse source 
Correct the caller-configured user-namespace topology, bind modeled network readiness to the live sandbox and helper, and keep physical canary, topology, encoding, and capability predicates in compact specification tables below the model boundary.
This commit is contained in:
ms2k 2026-07-19 19:52:41 +09:00
commit 02fc29acb1
3 changed files with 120 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/protocol/Lazaret.cfg
View file

@ -91,6 +91,7 @@ INVARIANTS
OrderedFailureRecovery
ResultDeliveryStateConsistent
MultiRoleDurableIntent
NetworkReadinessBoundToSandbox
GenerationScopedIdentitiesDistinct
HelperUnderSupervisor
PreparedLowerLeaseBeforeMount

46
docs/protocol/Lazaret.tla
View file

@ -655,6 +655,8 @@ StartSidecar(d) ==
/\ SidecarCertificateValid[d]
/\ sidecarState[d] = "Stopped"
/\ sidecarState' = [sidecarState EXCEPT ![d] = "Ready"]
/\ durableIntent' = [durableIntent EXCEPT ![d] =
[@ EXCEPT !["network"] = TRUE]]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sandboxState,
trustReady, lockOwner, published, registered, connected, sessionPhase,
@ -663,7 +665,8 @@ StartSidecar(d) ==
hostCoordinatorProc, runtimeSupervisorProc, attachedRunscProc,
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId, genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
durableDecision, pathMismatch, genCoordinatorId, genSidecarId,
genSandboxId, networkReady, preparedLowerLeased, helperProc
>>
ArmRuntimeCausalEdge(d) ==
@ -694,8 +697,9 @@ StartSandbox(d) ==
/\ supervisorLease[d] = "Held"
/\ runtimeCausalEdge[d] = "Armed"
/\ sidecarState[d] = "Ready"
/\ networkReady[d]
/\ durableIntent[d]["network"]
/\ helperProc[d] = "Alive"
/\ durableIntent[d]["helper"]
/\ durableIntent[d]["anchor"]
/\ durableIntent[d]["prepared_lower"]
/\ sandboxState[d] = "Stopped"
@ -876,6 +880,7 @@ StopSandbox(d) ==
/\ sandboxState' = [sandboxState EXCEPT ![d] = "Stopped"]
/\ attachedRunscProc' = [attachedRunscProc EXCEPT ![d] = "Absent"]
/\ runtimeCausalEdge' = [runtimeCausalEdge EXCEPT ![d] = "Unarmed"]
/\ networkReady' = [networkReady EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sidecarState,
trustReady, lockOwner, published, registered, connected, sessionPhase,
@ -884,7 +889,8 @@ StopSandbox(d) ==
hostCoordinatorProc, runtimeSupervisorProc, supervisorLease,
runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId, genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, preparedLowerLeased, helperProc
>>
StopSidecar(d) ==
@ -1367,12 +1373,14 @@ HardLoseAttachedRunsc(d) ==
/\ attachedRunscProc' = [attachedRunscProc EXCEPT ![d] = "Dead"]
/\ sandboxState' = [sandboxState EXCEPT ![d] = "Stopped"]
/\ runtimeCausalEdge' = [runtimeCausalEdge EXCEPT ![d] = "Unarmed"]
/\ networkReady' = [networkReady EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
stateAnchorState, sidecarState, approvalSource, approvedCommand,
domainLockHeld, hostCoordinatorProc, runtimeSupervisorProc,
supervisorLease,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId, genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, preparedLowerLeased, helperProc
>>
StopHostCoordinatorProcess(d) ==
@ -1506,6 +1514,7 @@ LeaseTeardownStopSandbox(d) ==
/\ attachedRunscProc' = [attachedRunscProc EXCEPT
![d] = IF ProcessPresent(attachedRunscProc[d]) THEN "Dead" ELSE "Absent"]
/\ runtimeCausalEdge' = [runtimeCausalEdge EXCEPT ![d] = "Unarmed"]
/\ networkReady' = [networkReady EXCEPT ![d] = FALSE]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sidecarState,
trustReady, lockOwner, published, registered, connected, sessionPhase,
@ -1514,7 +1523,8 @@ LeaseTeardownStopSandbox(d) ==
hostCoordinatorProc, runtimeSupervisorProc, supervisorLease,
runtimeFaultsRemaining,
domainGeneration,
durableDecision, durableIntent, pathMismatch, genCoordinatorId, genSidecarId, genSandboxId, networkReady, preparedLowerLeased, helperProc
durableDecision, durableIntent, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, preparedLowerLeased, helperProc
>>
LeaseTeardownStopSidecar(d) ==
@ -1835,6 +1845,7 @@ StartConnectivityHelper(d) ==
/\ RuntimeSupervisorAlive(d)
/\ supervisorLease[d] = "Held"
/\ sidecarState[d] = "Ready"
/\ durableIntent[d]["network"]
/\ helperProc[d] = "Absent"
/\ helperProc' = [helperProc EXCEPT ![d] = "Alive"]
/\ durableIntent' = [durableIntent EXCEPT ![d] =
@ -1850,19 +1861,22 @@ StartConnectivityHelper(d) ==
genSidecarId, genSandboxId, networkReady, preparedLowerLeased
>>
\* Authenticated network readiness (abstract fingerprint/attest gate).
\* Physical readiness evidence is an atomic refinement boundary here.
MarkNetworkReady(d) ==
/\ domainPhase[d] = "Starting"
/\ HostCoordinatorAlive(d)
/\ RuntimeSupervisorAlive(d)
/\ supervisorLease[d] = "Held"
/\ sidecarState[d] = "Ready"
/\ sandboxState[d] = "Ready"
/\ attachedRunscProc[d] = "Alive"
/\ runtimeCausalEdge[d] = "Armed"
/\ durableIntent[d]["sandbox"]
/\ durableIntent[d]["network"]
/\ helperProc[d] = "Alive"
/\ durableIntent[d]["helper"]
/\ ~networkReady[d]
/\ networkReady' = [networkReady EXCEPT ![d] = TRUE]
/\ durableIntent' = [durableIntent EXCEPT ![d] =
[@ EXCEPT !["network"] = TRUE]]
/\ UNCHANGED <<
domainPhase, stateAnchorState, sidecarState, sandboxState, trustReady,
lockOwner, published, registered, connected, sessionPhase,
@ -1870,8 +1884,9 @@ MarkNetworkReady(d) ==
approvalSource, approvedCommand, hostRunning, domainLockHeld,
hostCoordinatorProc, runtimeSupervisorProc, attachedRunscProc,
runtimeCausalEdge, supervisorLease, runtimeFaultsRemaining,
domainGeneration, durableDecision, pathMismatch, genCoordinatorId,
genSidecarId, genSandboxId, preparedLowerLeased, helperProc
domainGeneration, durableDecision, durableIntent, pathMismatch,
genCoordinatorId, genSidecarId, genSandboxId, preparedLowerLeased,
helperProc
>>
\* Helper-only hard loss: SC remains present; network readiness withdrawn.
@ -1906,9 +1921,9 @@ DomainServiceProgress(d) ==
\/ MountStateAnchor(d)
\/ StartSidecar(d)
\/ StartConnectivityHelper(d)
\/ MarkNetworkReady(d)
\/ ArmRuntimeCausalEdge(d)
\/ StartSandbox(d)
\/ MarkNetworkReady(d)
\/ PublishDomain(d)
\/ BeginTeardown(d)
\/ StopSandbox(d)
@ -2328,6 +2343,14 @@ MultiRoleDurableIntent ==
/\ (networkReady[d] => durableIntent[d]["network"])
/\ (helperProc[d] = "Alive" => durableIntent[d]["helper"])
NetworkReadinessBoundToSandbox ==
\A d \in Domains :
networkReady[d] =>
/\ sandboxState[d] = "Ready"
/\ ProcessPresent(attachedRunscProc[d])
/\ runtimeCausalEdge[d] = "Armed"
/\ helperProc[d] = "Alive"
Safety ==
/\ TypeOK
/\ ConfigurationConfinement
@ -2366,6 +2389,7 @@ Safety ==
/\ FailedDomainIsolation
/\ OrderedFailureRecovery
/\ ResultDeliveryStateConsistent
/\ NetworkReadinessBoundToSandbox
(***************************************************************************
Liveness properties.

126
docs/specification.md
View file

@ -99,7 +99,7 @@ implementation, logs, and user interfaces.
| **Network Sidecar** | The logical Domain network-policy role for one Domain generation: derived-policy application, enforcement network-namespace preparation, connectivity-helper supervision, and network readiness attestation. Under the selected architecture this role is realized on the Runtime Supervisor-owned install path (with a supervised connectivity helper). It is not a constitutive Session Coordinator process and need not be a separate OS process. The Agent Sandbox never holds network-administration capability. |
| **Network Sidecar ID** | Protocol component identifier for the Domain generation's Network Sidecar role instance (not a Runtime Supervisor or connectivity-helper process id, and not a filesystem path). Generation scoping follows the protocol model. |
| **Connectivity helper** | The supervised process that provides user-space connectivity for the Domain enforcement network namespace. Lazaret v1 uses `slirp4netns`. Ownership and lease coupling follow the protocol model; process identity is product recovery material, not the Network Sidecar ID. |
| **Derived network policy** | The generation-bound policy document Lazaret derives from trusted host configuration (default and profile allow/deny prefixes, DNS reachability, address-family disposition). Only derived policy is installed; the Agent Sandbox never supplies policy. |
| **Derived network policy** | The generation-bound policy document Lazaret derives from trusted host configuration and fixed product topology (default and profile allow/deny prefixes, connectivity-helper routes, address-family disposition). Only derived policy is installed; the Agent Sandbox never supplies policy. |
| **Network readiness fingerprint** | Product encoding of protocol network readiness: a cryptographic digest over Domain ID, generation, configuration fingerprint, Network Sidecar ID, derived-policy digest, and enforcement network-namespace identity material. |
| **Prepared lower** | A Lazaret-owned immutable root filesystem tree materialised from the selected base image. Content is identified by a prepared-artifact identity. |
| **Prepared-artifact ID** | A Lazaret-assigned identity for one immutable prepared-lower tree (content-addressed or otherwise unique among prepared lowers under the Storage Root). |
@ -164,8 +164,12 @@ flowchart TB
```
The physical Session Coordinator refinement uses an HC→RS parent/child edge and
lifetime pipe. The RS creates the generation namespaces, arms the parent-death
edge, and launches a non-detached runsc client. Client CLI protocol descriptors
lifetime pipe. Before releasing the RS, the HC creates its user namespace through
`newuidmap` and `newgidmap` and verifies the live maps. Namespace ID 0 maps to the
invoking host UID or GID, and namespace IDs 1 through 65536 map to the lowest
configured contiguous subordinate allocation of at least 65536 IDs. The RS
creates the generation mount and network namespaces, arms the parent-death edge,
and launches a non-detached runsc client. Client CLI protocol descriptors
terminate in the HC process.
The Agent Sandbox uses gVisor's application-kernel isolation under rootless
@ -796,6 +800,10 @@ Store and Storage Catalog encode the model's generation-to-artifact lease with
separate Domain and generation fields; an engine mount refcount is not its
physical representation. Preparation uses descriptor-relative staging,
publication, quarantine, and deletion beneath validated Storage Root handles.
Materialisation runs in a short-lived preparation worker under the same verified
user-namespace map used by the Runtime Supervisor. It applies logical image
ownership inside that namespace, so nonzero image UIDs and GIDs become
subordinate host IDs without granting initial-user-namespace authority.
The prepared rootfs preserves OCI modes and is exposed only as a read-only State
Anchor lower. Lazaret enforces immutability through artifact ownership and
@ -908,19 +916,17 @@ override Lazaret's host control plane.
### 3.7 Network Isolation
The Network Sidecar role is realized on the Runtime Supervisor-owned install
path. The Runtime Supervisor holds network-administration capability while it
installs and attests policy and while attached runsc imports the Domain
enforcement network namespace. It irreversibly drops that capability after the
initial runsc handoff and before publication. Stock attached runsc retains
network-administration capability in the subordinate Domain user namespace for
its generation lifetime; it is a trusted host runtime process and has no
authority over initial-user-namespace host network resources. The Agent Sandbox
OCI process does not receive the capability and may join only that prepared
enforcement namespace, not the host network namespace. Lazaret v1 uses
`slirp4netns` for connectivity. Installing policy by driving nftables through runsc into the
guest is not a supported path. Protocol helper ownership, network readiness,
and publication gates follow the protocol model.
This section refines physical network mechanisms below the protocol model's
`networkReady` abstraction. The model owns helper intent, sandbox lifetime,
readiness, publication, and session-admission ordering.
| Concern | Physical refinement |
| :--- | :--- |
| Policy owner | The Network Sidecar role is realized on the Runtime Supervisor install path. Driving nftables through runsc into the guest is unsupported. |
| Connectivity | Lazaret v1 uses supervised `slirp4netns`. |
| Network authority | The Runtime Supervisor holds network-administration capability only while preparing, importing, and attesting the enforcement namespace. Successful physical attestation requires its irreversible drop. |
| Trusted runtime | Stock attached runsc may retain network-administration capability only in the subordinate Domain user namespace. It has no initial-user-namespace network authority. |
| Agent Sandbox | The OCI process joins only the prepared enforcement namespace, never the host network namespace, and receives no network-administration capability. |
#### Derived policy and readiness encoding
@ -928,31 +934,66 @@ Rust network records and fixed codec tests own the v1 policy, attestation,
readiness-identity projection, and fingerprint encodings described by this
refinement.
The v1 policy transport passes canonical bytes through a write-sealed inherited
memfd. The Runtime Supervisor verifies the seals and digest, installs the policy,
and returns observed route, helper, process, and namespace evidence over an
inherited Host Coordinator-created private `SOCK_SEQPACKET` channel.
Before helper launch, the Host Coordinator durably records independent helper
intent. It acquires the helper through the causal child acquisition protocol;
after the exact helper and supervising Runtime Supervisor pidfs ownership is
committed, it may accept network readiness evidence.
The Host Coordinator independently reads the Runtime Supervisor's namespace
identity and records the network readiness fingerprint as the durable encoding
of protocol network readiness. Before publication, Lazaret verifies from the
Agent Sandbox network view, or an equivalent generation-bound probe using the
same enforcement namespace, that default-denied private destinations are
unreachable and that required permitted reachability, including selected DNS
resolvers, works. Persisted readiness files are evidence after this exchange,
not its transport.
| Encoding boundary | v1 mechanism |
| :--- | :--- |
| Policy transport | Canonical bytes in a write-sealed inherited memfd; the Runtime Supervisor verifies seals and digest. |
| Evidence transport | Observed route, helper, process, and namespace evidence over an inherited Host Coordinator-created private `SOCK_SEQPACKET` channel. |
| Independent identity | The Host Coordinator reads the Runtime Supervisor's enforcement namespace identity directly. |
| Durable encoding | The network readiness fingerprint binds the generation, configuration, policy, role, and namespace identities. |
The fixed v1 topology is:
| Purpose | Value |
| :--- | :--- |
| Reserved topology | `10.137.54.0/23` |
| `slirp4netns` network | `10.137.54.0/24` |
| Gateway | `10.137.54.2` |
| Synthetic DNS | `10.137.54.3` |
| Sandbox address | `10.137.54.100` |
| Canary network | `10.137.55.0/29` |
| Enforcement endpoint | `10.137.55.1` |
| Allowed canary endpoint | `10.137.55.2` |
| Denied canary endpoint | `10.137.55.3` |
A configured allow intersecting the reserved topology, or a configured deny
within it at `/23` or greater specificity, is invalid. Broader denies remain
valid and Lazaret's fixed more-specific routes take precedence. Lazaret passes
the `slirp4netns` CIDR explicitly.
The protocol model treats the following physical refinement as the atomic
`MarkNetworkReady` action:
| Evidence boundary | Required observation |
| :--- | :--- |
| Linux policy state | A versioned policy-semantic rtnetlink projection exactly matches derived policy and fixed topology. It includes destination, table, next-hop, and precedence semantics, but excludes counters, cache state, and presentation. IPv6 is disabled, with no non-loopback IPv6 address or route. |
| Known-live control | Both canary endpoints authenticate independent generation-bound challenges before policy installation. Final policy has an aggregate loopback-unicast canary deny and a more-specific allowed `/32`. |
| Imported behavior | A static, closed-environment non-user root init verifies canary and `tap0` identity, authenticates the allowed endpoint, cannot reach the known-live denied endpoint, observes no non-loopback IPv6 address or route, has empty network-administration capability sets, and cannot mutate a route. |
| Exact cleanup | With no concurrent link mutator, the Runtime Supervisor closes responder and peer-namespace descriptors and deletes the veth only when its current rtnetlink shape matches its versioned creation record. Namespace and ifindex alone are insufficient. |
| Cleanup observation | The formerly allowed endpoint is unreachable, `tap0` remains present, and IPv6 disposition is unchanged. The imported canary interface and route remain inert until sandbox teardown. |
| Authority drop | The Runtime Supervisor irreversibly drops network-administration capability. No canary listener, peer namespace, or host interface remains. |
Any failed or mismatched predicate refuses physical attestation. The root init
is product-owned, statically linked, has no ELF interpreter or dynamic section,
receives a closed product environment, and never receives profile environment.
The canary adds no durable process role.
Network readiness never depends on a DNS response, public egress, or
availability of a configured permitted destination. Lazaret v1 supplies the
protected sandbox resolver configuration and route for the slirp4netns
synthetic DNS endpoint; upstream resolver failure is an ordinary runtime
connectivity failure. Persisted readiness files are evidence after this
exchange, not its transport.
#### Default policy and deny representation
IPv4 destinations are permitted by default except for the RFC 1918 private
address ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), which are denied
by default. Explicit, more-specific allow rules may grant access within those
ranges. Lazaret also installs the reachability needed for the Domain's selected
DNS resolvers. Other permitted and denied destination prefixes come from trusted
host configuration.
ranges. Lazaret also installs the fixed connectivity-helper routes needed for
the slirp4netns gateway and synthetic DNS endpoint. Those routes and their
precedence over the default RFC 1918 deny are explicit inputs to the canonical
derived policy and its digest, not post-install route exceptions. Other
permitted and denied destination prefixes come from trusted host configuration.
Default and configured deny prefixes are enforced with **loopback-unicast deny
routes** in the Domain enforcement network namespace (routes that direct matching
@ -961,8 +1002,10 @@ destinations to a loopback unicast address so packets are not forwarded). Linux
Equal-prefix allow/deny conflicts must be rejected or resolved in favor of denial.
Normal Linux longest-prefix routing determines the most specific matching route.
IPv4 and IPv6 must either receive equivalent policy or an address family must be
disabled.
Lazaret v1 disables IPv6 in the Linux enforcement namespace before helper and
canary setup and requires both the Linux namespace and imported sandbox view to
have no non-loopback IPv6 address or route. The sandbox-visible check does not
depend on Linux sysctl files because gVisor need not expose them.
The OCI configuration joins only the Domain enforcement network namespace, and
`slirp4netns` attached to that namespace is the sole external egress mechanism.
@ -1042,11 +1085,11 @@ not duplicated here.
| **SR-1** | Agent processes shall execute in a rootless gVisor sandbox and shall not receive host root authority. |
| **SR-3** | Host paths outside the Agent Workspace, developer-configured volumes, and Lazaret-owned fixed control mounts shall not be accessible to the Agent Sandbox. |
| **SR-4** | The sandbox shall be unable to modify the host repository's `.git/config` or default `.git/hooks` directory through the workspace mount. |
| **SR-5** | The Runtime Supervisor shall irreversibly drop network-administration capability after initial attached-runsc network import and before publication. Trusted attached runsc may retain that capability only in the subordinate Domain user namespace for its generation lifetime. The Agent Sandbox process specification shall omit the capability and set `noNewPrivileges`. |
| **SR-5** | Successful physical network attestation shall require the Runtime Supervisor's irreversible network-administration capability drop. Trusted attached runsc may retain that capability only in the subordinate Domain user namespace. The trusted init and Agent Sandbox process specifications shall omit the capability and set `noNewPrivileges`. |
| **SR-6** | Network policy shall cover every enabled address family and shall deny equal-specificity policy conflicts. Default and configured deny prefixes shall be enforced with loopback-unicast deny routes in the Domain enforcement network namespace; Linux blackhole routes shall not be used for denial on this path. |
| **SR-10** | Domain sockets, mailboxes, and coordination files shall reside in a host-private directory owned by the developer. |
| **SR-11** | Runtime and persistent path construction shall begin from validated Domain roots, include the Domain ID in resource identities, and verify stored Domain identity before reuse. |
| **SR-12** | The runsc OCI specification shall create private PID, IPC, UTS, mount, and user namespaces and set its network namespace path to the independently verified Runtime Supervisor namespace descriptor. It shall contain no host namespace path entry. |
| **SR-12** | The Host Coordinator shall launch preparation workers and the Runtime Supervisor in independently verified caller-configured user namespaces whose ID maps bind namespace ID 0 to the invoking host identity and namespace IDs 1 through 65536 to configured subordinate IDs. The runsc OCI specification shall create private PID, IPC, UTS, and mount namespaces, join the independently verified Runtime Supervisor network namespace descriptor, and omit a nested user namespace and OCI UID/GID mappings. It shall contain no host namespace path entry. |
| **SR-13** | Git-ignored Agent Workspace paths shall use Ignored Workspace State by default, preventing the sandbox from reading or modifying corresponding host content; only trusted host configuration may disable this behavior. |
| **SR-14** | State Anchor maintenance shall remain confined to the resolved Domain Root. Destructive maintenance shall require exclusive lifecycle ownership and an inactive, unmounted target. |
| **SR-15** | Lazaret shall not use a live container-engine image mount as the State Anchor lower; the lower shall be a Lazaret-owned prepared lower. Archive export alone shall not be treated as a complete preparation boundary. |
@ -1064,11 +1107,10 @@ not duplicated here.
| **FR-11** | The host CLI shall list, inspect, structurally verify, and reset all or selected State Anchors without requiring direct manipulation of Lazaret's storage layout. |
| **FR-14** | The Host Coordinator shall own one host PTY master per interactive Client Session; the PTY slave shall attach through non-detached `runsc exec` standard streams. The root attached `runsc run` client shall remain terminal-neutral. Session PTYs shall not depend on `runsc exec -console-socket`. |
| **FR-15** | For each interactive Client Session, Lazaret shall preserve the durable terminal authority and protocol described by the Session Terminal refinement; serialize bounded terminal events and merged output by Session ID; map resize and the `Interrupt`, `Quit`, and `Suspend` events to the specified exact process-group operations; collect exit status from the non-detached `runsc exec` client; and follow the specified release and hard-loss recovery ordering without reattachment or mismatched cleanup. |
| **FR-16** | Lazaret v1 shall use `slirp4netns` as the Domain connectivity helper. The Domain Store shall record independent helper intent before launch and exact committed helper and supervising Runtime Supervisor pidfs ownership before network readiness. |
| **FR-16** | Lazaret v1 shall use supervised `slirp4netns` with the explicit product CIDR as the Domain connectivity helper. |
| **FR-17** | The Domain Store shall be opened only by the Host Coordinator process holding the Domain `flock`; mutations shall use atomic transactions. Storage Catalog access shall use one bounded lock/open/transaction/close section. Cross-store lease release shall follow the durable release-intent, exact-unmount, catalog-delete, Domain-clean ordering defined by the durable generation refinement. |
| **FR-18** | Product network readiness encoding shall include a network readiness fingerprint and the pre-publication reachability verification described under network isolation; protocol publication and readiness gates follow the protocol model. |
| **FR-19** | The Host Coordinator shall derive generation-bound network policy from trusted host configuration; the Runtime Supervisor shall install only that derived policy and attest readiness by observed namespace state. Durable network participant state shall record the network readiness fingerprint. |
| **FR-20** | Before publication, Lazaret shall verify from the Agent Sandbox network view, or an equivalent generation-bound probe using the same enforcement namespace, that default-denied private destinations are unreachable and that required permitted reachability including selected DNS resolvers works. |
| **FR-20** | Physical network readiness shall use product-owned known-live targets. DNS, public egress, and configured destination availability shall not gate it. |
| **FR-21** | The Domain Store and Storage Catalog shall preserve the independently recoverable ownership, identities, and authority relationships described by the durable-generation and prepared-lower refinements. |
| **FR-22** | Preparation shall use a supported OCI-aware preparer that materialises a Lazaret-owned immutable rootfs with source identity and prepared-artifact ID. |