ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Define prepared-lower lease and reclaim invariants

Browse source
This commit is contained in:
ms2k 2026-07-11 18:54:23 +09:00
commit 0e8269ab71
1 changed files with 258 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/specification.md
View file

@ -282,15 +282,21 @@ Anchor lower. Archive export alone is not a complete preparation boundary;
container tooling may participate only as transport into Lazaret-owned
preparation. Ad hoc unsupported tar extractors are not a production preparer.
Protocol prepared-lower lease, intent, and refuse-while-leased reclaim follow the
protocol model. Product encoding binds a lease to prepared-artifact ID (and
generation identity) under Host Coordinator durable state—not an engine mount
refcount. Distinct Domain generations may share one prepared-artifact ID only
through separate protocol leases. Concurrent preparation of the same source may
reuse a completed artifact or create a new prepared-artifact ID; an in-progress
prepare tree is not a State Anchor lower. After the last lease for an artifact
drops, product GC may reclaim that tree; foreign trees under deterministic paths
must not be deleted.
Prepared-artifact identity is independent of its storage pathname. Before State
Anchor mount, Host Coordinator durable state binds the Domain generation to the
prepared-artifact ID with a prepared-lower lease. Distinct generations sharing
an artifact hold separate leases; an engine mount refcount is not a lease.
Concurrent preparation of the same source may reuse a completed artifact or
publish a new prepared-artifact ID. An incomplete preparation is never a State
Anchor lower. Preparation, lease acquisition, and reclaim serialize so GC acts
only after the final lease is released. Recovery may reclaim an abandoned
preparation only from matching exact-owned durable intent; foreign or mismatched
trees remain untouched.
The prepared rootfs preserves OCI modes and is exposed only as a read-only State
Anchor lower. Lazaret enforces immutability through artifact ownership and
lifecycle rather than by rewriting image permission bits.
#### Durable generation document
@ -456,7 +462,7 @@ follow a symlink outside the Domain Root.
| **FR-19** | The Host Coordinator shall derive generation-bound network policy from trusted host configuration; the Runtime Supervisor shall install only that derived policy and attest readiness by observed namespace state. Durable network participant state shall record the network readiness fingerprint. |
| **FR-20** | Before publication, Lazaret shall verify from the Agent Sandbox network view, or an equivalent generation-bound probe using the same enforcement namespace, that default-denied private destinations are unreachable and that required permitted reachability including selected DNS resolvers works. |
| **FR-21** | The durable generation document encoding shall include schema/db version, generation identity, minted runtime component IDs, model-governed durable decision and participant intent, and ownership material for product recovery. Unknown newer schema versions shall fail closed until an explicit Host Coordinator migration runs. |
| **FR-22** | Preparation shall use a supported OCI-aware preparer that materialises a Lazaret-owned immutable rootfs with source identity and prepared-artifact ID. Protocol prepared-lower lease rules apply before State Anchor mount. |
| **FR-22** | Preparation shall use a supported OCI-aware preparer that materialises a Lazaret-owned immutable rootfs with source identity and prepared-artifact ID. A durable generation-bound prepared-lower lease shall exist before State Anchor mount. |
### 4.3 Developer-Experience Requirements
@ -479,4 +485,4 @@ follow a symlink outside the Domain Root.
| **OR-4** | Security-sensitive behavior shall be covered by integration tests on supported runsc, filesystem, and network configurations. Test evidence belongs in the journal. |
| **OR-5** | An interrupted State Anchor reset shall recover to either the prior generation or a new empty generation; it shall not leave a partially reset active upper layer. |
| **OR-6** | Lazaret shall not require a persistent global daemon or multi-Domain resident process that holds mutable runtime authority across Domains. Per-Domain authority shall be scoped by Domain ID, generation, configuration fingerprint, role identity, and exact physical ownership. |
| **OR-7** | After protocol leases for a prepared-artifact ID are released, product GC may reclaim that tree. Shared-artifact reclaim must wait until no lease remains for that artifact. In-progress prepare trees and foreign trees must not be deleted except through fail-closed recovery of exact-owned prepare intent. |
| **OR-7** | Product GC shall provide policy-controlled reclamation for prepared artifacts after all protocol leases for the prepared-artifact ID are released. Shared-artifact reclaim shall wait until no lease remains for that artifact. In-progress prepare trees and foreign trees shall not be deleted; exact-owned abandoned prepare trees may be reclaimed only through fail-closed recovery backed by durable prepare intent. |