ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/specification.md
View file

@ -969,7 +969,7 @@ The protocol model treats the following physical refinement as the atomic
| Known-live control | Both canary endpoints authenticate independent generation-bound challenges before policy installation. Final policy has an aggregate loopback-unicast canary deny and a more-specific allowed `/32`. |
| Imported behavior | A static, closed-environment non-user root init verifies canary and `tap0` identity, authenticates the allowed endpoint, cannot reach the known-live denied endpoint, observes no non-loopback IPv6 address or route, has empty network-administration capability sets, and cannot mutate a route. |
| Exact cleanup | With no concurrent link mutator, the Runtime Supervisor closes responder and peer-namespace descriptors and deletes the veth only when its current rtnetlink shape matches its versioned creation record. Namespace and ifindex alone are insufficient. |
| Cleanup observation | The formerly allowed endpoint is unreachable, `tap0` remains present, and IPv6 disposition is unchanged. The imported canary interface and route remain inert until sandbox teardown. |
| Cleanup observation | The formerly allowed endpoint is unreachable, `tap0` remains present, and IPv6 disposition is unchanged. |
| Authority drop | The Runtime Supervisor irreversibly drops network-administration capability. No canary listener, peer namespace, or host interface remains. |
Any failed or mismatched predicate refuses physical attestation. The root init