ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Confine verification tooling to current repository checks

Browse source
This commit is contained in:
ms2k 2026-07-14 02:17:49 +09:00
commit c738d92f01
3 changed files with 798 additions and 2926 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/development.md
View file

@ -1,11 +0,0 @@
# Development and verification
The Cargo workspace separates shared production logic from process entry points. `lazaret-core` is the initial library boundary. The `lazaret` Client, `lazaret-host-coordinator`, `lazaret-runtime-supervisor`, `lazaret-network-sidecar`, and `lazaret-escalation-client` executables are thin binary packages; process behavior belongs in libraries so it can be verified without invoking private binary internals.
`support/work-packages.toml` is the dependency authority. `support/model-refinements.toml` assigns every modeled action and configured property to production packages and verification levels. `support/external-tools.toml` fixes the baseline host and tool contracts, including exact kernel qualification records and whether an unavailable capability fails or skips a level. `support/process-safety.toml` pins dependency source identities, features, and reviewed process APIs and registers the compiler and exercised-path syscall checks for the exclusive spawn/reap broker boundary. `docs/implementation-dependencies.md`, `docs/host-support.md`, and `.clippy.toml` are generated registry outputs.
Run `tools/verify-v1`, `tools/verify-v2`, `tools/verify-v3`, `tools/verify-v4`, or `tools/verify-v5`. Each higher level includes the lower levels. V1 is host-local and includes format, Clippy, tests, dependency policy, registry drift, and both TLC models. Physical suites register commands in `support/integration-tests.toml`; an empty level is an explicit skip. A registered scenario may skip only when every missing capability has `policy = "skip"` in the external-tool manifest.
Normal verification is offline: Cargo receives `--offline` and cargo-deny receives `--frozen`. `tools/dev refresh-advisories` is the explicit online operation that updates the local RustSec database and then verifies advisories offline. Every level audits the all-feature dependency source checksums, versions, enabled features, reviewed process APIs, generated compiler policy, and unauthorized lint exemptions. V2 registers optional `strace` cases for exact exercised binary paths; a missing tracer skips those cases, while an observed extra exec, process creation, wait, or `SIGCHLD` mutation fails. Dynamic tracing does not claim coverage of unexercised paths.
Run `tools/dev generate` after changing the work-package, external-tool, or process-safety registry. `tools/dev generate --check` fails when either committed generated view differs.

436
docs/host-support.md
View file

@ -1,436 +0,0 @@
# Host support and process-safety registry
Generated from `support/external-tools.toml` and `support/process-safety.toml`; do not edit this file directly.
## Pidfs host support
- Contract: `pidfs-process-identity-v1`
- Platform floor: `linux-x86_64` kernel `6.9` or newer
- Runtime refusal: `fail-before-generation`
- Unavailable verifier behavior: `skip`
- Smoke claim: `current-boot-smoke-only` cached only by `boot_id`
- Smoke bounds: one attempt per step, `5000` ms per step, `60000` ms total, `5000` ms cleanup
- Positive support: unavailable until IP-03 implements an exact running-build matcher and the smoke runner
The smoke steps are bounded observations and never qualify source or build provenance:
1. `linux-x86_64-kernel-floor`
1. `pidfd-operations`
1. `pidfs-magic`
1. `concurrent-same-process-identity`
1. `last-close-live-reopen-identity`
1. `simultaneous-process-distinct-inode`
1. `stale-handle-cannot-affect-live-peer`
1. `exit-reap-drop-all-later-process-non-reuse`
## Qualified kernel builds
| ID | Kind | Release | Source commit | Build image SHA-256 |
| --- | --- | --- | --- | --- |
| `upstream-linux-6.9.0-x86_64` | upstream | `6.9.0` | `a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6` | `e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc` |
## Process-safety audit
Policy `causal-child-acquisition-v1` pins 13 dependency source/version/feature/API-review records, generates compiler-resolved disallowed type/method lints, and registers `process-safety-baseline-exercised-paths` as V2 exercised-path tracing.
The dedicated `lazaret-process-broker` boundary is `unimplemented` and no lint exemption is authorized. Dynamic coverage is `registered-exercised-paths-only`; it does not claim unexercised-path coverage.
## Complete registered data
Every authoritative host-qualification and process-safety field is reproduced below so generated-view drift remains complete.
```json
{
"host_capabilities": [
{
"diagnostic": "Physical and composition suites currently support Linux x86_64.",
"id": "linux-x86_64",
"levels": [
"V2",
"V3",
"V4",
"V5"
],
"policy": "skip",
"probe": "linux-x86_64"
},
{
"diagnostic": "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity.",
"id": "kernel",
"levels": [
"V2",
"V3",
"V4",
"V5"
],
"minimum": "6.9",
"policy": "skip",
"probe": "kernel-at-least"
},
{
"contract": "pidfs-process-identity-v1",
"diagnostic": "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record.",
"id": "pidfs-host-support",
"levels": [
"V2",
"V3",
"V4",
"V5"
],
"policy": "skip",
"probe": "registered-host-support"
}
],
"host_probe": [
{
"attempts_per_step": 1,
"cache_key": "boot_id",
"cleanup_timeout_ms": 5000,
"id": "pidfs-host-support-probe-v1",
"owner": "IP-03",
"result_claim": "bounded-current-boot-observations",
"step_timeout_ms": 5000,
"steps": [
"linux-x86_64-kernel-floor",
"pidfd-operations",
"pidfs-magic",
"concurrent-same-process-identity",
"last-close-live-reopen-identity",
"simultaneous-process-distinct-inode",
"stale-handle-cannot-affect-live-peer",
"exit-reap-drop-all-later-process-non-reuse"
],
"total_timeout_ms": 60000
}
],
"kernel_qualification": [
{
"acquisition_result_sha256": "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3",
"architecture": "x86_64",
"build_config_sha256": "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a",
"build_image_sha256": "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc",
"id": "upstream-linux-6.9.0-x86_64",
"kind": "upstream",
"pidfs_inode_semantics": "boot-monotonic-u64",
"probe_binary_sha256": "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f",
"release": "6.9.0",
"reuse_result_sha256": "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f",
"source_archive_sha256": "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149",
"source_commit": "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6",
"source_ref": "v6.9",
"source_signer_fingerprint": "647F28654894E3BD457199BE38DBBDC86092693E",
"status": "qualified"
}
],
"pidfs_host_support": {
"bounded_claim": "current-boot-smoke-only",
"diagnostic_kernel": "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport.",
"diagnostic_platform": "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64.",
"diagnostic_qualification": "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record.",
"diagnostic_smoke": "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created.",
"id": "pidfs-process-identity-v1",
"minimum_kernel": "6.9",
"platform": "linux-x86_64",
"probe": "pidfs-host-support-probe-v1",
"qualification_ids": [
"upstream-linux-6.9.0-x86_64"
],
"runtime_failure_policy": "fail-before-generation",
"verifier_unavailable_policy": "skip"
},
"process_safety": {
"policy": {
"broker_crate": "lazaret-process-broker",
"broker_state": "unimplemented",
"completion_owner": "IP-03",
"disallowed_methods": [
"libc::clone",
"libc::execve",
"libc::execveat",
"libc::fork",
"libc::posix_spawn",
"libc::sigaction",
"libc::signal",
"libc::vfork",
"libc::wait",
"libc::wait4",
"libc::waitid",
"libc::waitpid",
"nix::sys::signal::sigaction",
"nix::sys::wait::wait",
"nix::sys::wait::waitid",
"nix::sys::wait::waitpid",
"nix::unistd::execve",
"nix::unistd::execveat",
"nix::unistd::fork",
"nix::unistd::vfork",
"rustix::process::kill_process",
"rustix::process::kill_process_group",
"rustix::process::pidfd_open",
"rustix::process::pidfd_send_signal",
"rustix::process::waitid",
"rustix::process::waitpid",
"std::process::Child::kill",
"std::process::Child::try_wait",
"std::process::Child::wait",
"std::process::Child::wait_with_output",
"std::process::Command::output",
"std::process::Command::spawn",
"std::process::Command::status"
],
"disallowed_types": [
"std::process::Child",
"std::process::Command",
"tokio::process::Child",
"tokio::process::Command"
],
"dynamic_coverage": "registered-exercised-paths-only",
"dynamic_scenario": "process-safety-baseline-exercised-paths",
"forbidden_syscall_patterns": [
"^clone3?\\(",
"^execveat\\(",
"^fork\\(",
"^vfork\\(",
"^wait4\\(",
"^waitid\\(",
"^rt_sigaction\\(SIGCHLD,"
],
"id": "causal-child-acquisition-v1",
"lint_allow_paths": [],
"lint_config": ".clippy.toml",
"production_roots": [
"crates"
],
"trace_expression": "process,wait4,waitid,rt_sigaction"
},
"runtime_dependency": [
{
"checksum": "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1",
"features": [],
"name": "cobs",
"reviewed_process_apis": [],
"version": "0.3.0"
},
{
"checksum": "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced",
"features": [
"alloc"
],
"name": "embedded-io",
"reviewed_process_apis": [],
"version": "0.4.0"
},
{
"checksum": "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d",
"features": [
"alloc"
],
"name": "embedded-io",
"reviewed_process_apis": [],
"version": "0.6.1"
},
{
"checksum": "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24",
"features": [
"alloc",
"use-std"
],
"name": "postcard",
"reviewed_process_apis": [],
"version": "1.1.3"
},
{
"checksum": "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934",
"features": [
"default",
"proc-macro"
],
"name": "proc-macro2",
"reviewed_process_apis": [],
"version": "1.0.106"
},
{
"checksum": "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368",
"features": [
"default",
"proc-macro"
],
"name": "quote",
"reviewed_process_apis": [],
"version": "1.0.46"
},
{
"checksum": "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e",
"features": [
"alloc",
"default",
"derive",
"serde_derive",
"std"
],
"name": "serde",
"reviewed_process_apis": [],
"version": "1.0.228"
},
{
"checksum": "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad",
"features": [
"alloc",
"result",
"std"
],
"name": "serde_core",
"reviewed_process_apis": [],
"version": "1.0.228"
},
{
"checksum": "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79",
"features": [
"default"
],
"name": "serde_derive",
"reviewed_process_apis": [],
"version": "1.0.228"
},
{
"checksum": "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422",
"features": [
"clone-impls",
"default",
"derive",
"parsing",
"printing",
"proc-macro"
],
"name": "syn",
"reviewed_process_apis": [],
"version": "2.0.118"
},
{
"checksum": "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4",
"features": [],
"name": "thiserror",
"reviewed_process_apis": [],
"version": "2.0.18"
},
{
"checksum": "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5",
"features": [],
"name": "thiserror-impl",
"reviewed_process_apis": [],
"version": "2.0.18"
},
{
"checksum": "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75",
"features": [],
"name": "unicode-ident",
"reviewed_process_apis": [],
"version": "1.0.24"
}
],
"schema": 2,
"trace_case": [
{
"args": [],
"binary": "lazaret",
"expected_exit_code": 0,
"initial_execve_count": 1
},
{
"args": [],
"binary": "lazaret-escalation-client",
"expected_exit_code": 0,
"initial_execve_count": 1
},
{
"args": [],
"binary": "lazaret-host-coordinator",
"expected_exit_code": 0,
"initial_execve_count": 1
},
{
"args": [],
"binary": "lazaret-network-sidecar",
"expected_exit_code": 0,
"initial_execve_count": 1
},
{
"args": [],
"binary": "lazaret-runtime-supervisor",
"expected_exit_code": 0,
"initial_execve_count": 1
}
]
},
"process_trace_capability": {
"args": [
"--version"
],
"diagnostic": "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases.",
"id": "strace",
"levels": [
"V2",
"V3",
"V4",
"V5"
],
"policy": "skip",
"program": "strace",
"version_pattern": "^strace -- version [6-9]\\.|^strace -- version [1-9][0-9]\\."
},
"process_trace_scenario": {
"capabilities": [
"linux-x86_64",
"strace"
],
"command": [
"tools/dev",
"process-audit",
"--dynamic"
],
"level": "V2",
"name": "process-safety-baseline-exercised-paths"
},
"workspace_lints": {
"clippy": {
"all": {
"level": "deny",
"priority": -1
},
"disallowed_methods": "deny",
"disallowed_types": "deny",
"pedantic": {
"level": "deny",
"priority": -1
}
},
"rust": {
"unsafe_code": "forbid",
"unused": {
"level": "deny",
"priority": -1
}
}
},
"workspace_member_lints": {
"crates/lazaret-client": {
"workspace": true
},
"crates/lazaret-core": {
"workspace": true
},
"crates/lazaret-escalation-client": {
"workspace": true
},
"crates/lazaret-host-coordinator": {
"workspace": true
},
"crates/lazaret-network-sidecar": {
"workspace": true
},
"crates/lazaret-runtime-supervisor": {
"workspace": true
}
}
}
```

159
docs/implementation-dependencies.md
View file

@ -1,159 +0,0 @@
# Implementation dependencies
Generated from `support/work-packages.toml`; do not edit this file directly.
| Package | Deliverable | Depends on | Verification |
| --- | --- | --- | --- |
| `IP-00` | Repository scaffold and verification | — | V1, V2, V3, V4, V5 |
| `IP-01` | Typed schema and protocol records | `IP-00` | V1 |
| `IP-02` | Trusted-host configuration | `IP-00`, `IP-01` | V1, V2 |
| `IP-03` | Linux primitives | `IP-00`, `IP-01` | V1, V2 |
| `IP-04` | Ignored-workspace contract | `IP-00` | V1, V2, V5 |
| `IP-10` | Domain Store | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
| `IP-11` | Storage Catalog | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
| `IP-12` | OCI transport and layer preparer | `IP-02`, `IP-03`, `IP-11` | V1, V2, V4 |
| `IP-13` | State Anchor | `IP-02`, `IP-03`, `IP-10`, `IP-11`, `IP-12` | V1, V2, V4 |
| `IP-14` | Derived network policy | `IP-01`, `IP-02` | V1 |
| `IP-15` | Protocol cryptography and codecs | `IP-01`, `IP-02`, `IP-03` | V1, V2 |
| `IP-16` | OCI specification and runsc command builder | `IP-01`, `IP-02`, `IP-03` | V1 |
| `IP-20` | Ignored-workspace router and Git Sentry | `IP-02`, `IP-03`, `IP-04`, `IP-10` | V1, V2, V4, V5 |
| `IP-21` | Runtime Supervisor and runsc ownership | `IP-03`, `IP-13`, `IP-16` | V2, V3, V4 |
| `IP-22` | Network installation and connectivity helper | `IP-03`, `IP-10`, `IP-14`, `IP-21` | V2, V3, V4 |
| `IP-23` | Host-private control face | `IP-02`, `IP-10`, `IP-15` | V1, V2 |
| `IP-24` | Escalation mailbox and execution | `IP-03`, `IP-10`, `IP-15`, `IP-23` | V1, V2, V3, V4 |
| `IP-30` | Core Host Coordinator lifecycle | `IP-10`, `IP-11`, `IP-12`, `IP-13`, `IP-14`, `IP-15`, `IP-16`, `IP-21`, `IP-22`, `IP-23` | V1, V2, V3 |
| `IP-31` | Non-interactive Client CLI | `IP-02`, `IP-16`, `IP-23`, `IP-30` | V1, V3 |
| `IP-40` | Minimal non-interactive runtime slice | `IP-30`, `IP-31` | V3 |
| `IP-32` | Recovery and prepared-artifact GC | `IP-30`, `IP-40` | V1, V2, V4 |
| `IP-33` | Session Terminal engine | `IP-10`, `IP-21`, `IP-23`, `IP-30`, `IP-40` | V1, V2, V4 |
| `IP-34` | Interactive Client CLI | `IP-31`, `IP-33` | V1, V3 |
| `IP-35` | State inspection and reset | `IP-10`, `IP-13`, `IP-20`, `IP-32` | V1, V2, V4 |
| `IP-41` | Workspace, Git, and persistence slice | `IP-20`, `IP-32`, `IP-40` | V3, V5 |
| `IP-42` | Interactive and multi-session slice | `IP-33`, `IP-34`, `IP-40` | V3 |
| `IP-43` | Host-escalation slice | `IP-24`, `IP-34`, `IP-42` | V3 |
| `IP-44` | Durability and hostile-failure gate | `IP-32`, `IP-35`, `IP-40`, `IP-41`, `IP-42`, `IP-43` | V4 |
| `IP-45` | Release qualification | `IP-44` | V5 |
```mermaid
graph TD
IP_00["IP-00 Repository scaffold and verification"]
IP_01["IP-01 Typed schema and protocol records"]
IP_02["IP-02 Trusted-host configuration"]
IP_03["IP-03 Linux primitives"]
IP_04["IP-04 Ignored-workspace contract"]
IP_10["IP-10 Domain Store"]
IP_11["IP-11 Storage Catalog"]
IP_12["IP-12 OCI transport and layer preparer"]
IP_13["IP-13 State Anchor"]
IP_14["IP-14 Derived network policy"]
IP_15["IP-15 Protocol cryptography and codecs"]
IP_16["IP-16 OCI specification and runsc command builder"]
IP_20["IP-20 Ignored-workspace router and Git Sentry"]
IP_21["IP-21 Runtime Supervisor and runsc ownership"]
IP_22["IP-22 Network installation and connectivity helper"]
IP_23["IP-23 Host-private control face"]
IP_24["IP-24 Escalation mailbox and execution"]
IP_30["IP-30 Core Host Coordinator lifecycle"]
IP_31["IP-31 Non-interactive Client CLI"]
IP_40["IP-40 Minimal non-interactive runtime slice"]
IP_32["IP-32 Recovery and prepared-artifact GC"]
IP_33["IP-33 Session Terminal engine"]
IP_34["IP-34 Interactive Client CLI"]
IP_35["IP-35 State inspection and reset"]
IP_41["IP-41 Workspace, Git, and persistence slice"]
IP_42["IP-42 Interactive and multi-session slice"]
IP_43["IP-43 Host-escalation slice"]
IP_44["IP-44 Durability and hostile-failure gate"]
IP_45["IP-45 Release qualification"]
IP_00 --> IP_01
IP_00 --> IP_02
IP_01 --> IP_02
IP_00 --> IP_03
IP_01 --> IP_03
IP_00 --> IP_04
IP_01 --> IP_10
IP_02 --> IP_10
IP_03 --> IP_10
IP_01 --> IP_11
IP_02 --> IP_11
IP_03 --> IP_11
IP_02 --> IP_12
IP_03 --> IP_12
IP_11 --> IP_12
IP_02 --> IP_13
IP_03 --> IP_13
IP_10 --> IP_13
IP_11 --> IP_13
IP_12 --> IP_13
IP_01 --> IP_14
IP_02 --> IP_14
IP_01 --> IP_15
IP_02 --> IP_15
IP_03 --> IP_15
IP_01 --> IP_16
IP_02 --> IP_16
IP_03 --> IP_16
IP_02 --> IP_20
IP_03 --> IP_20
IP_04 --> IP_20
IP_10 --> IP_20
IP_03 --> IP_21
IP_13 --> IP_21
IP_16 --> IP_21
IP_03 --> IP_22
IP_10 --> IP_22
IP_14 --> IP_22
IP_21 --> IP_22
IP_02 --> IP_23
IP_10 --> IP_23
IP_15 --> IP_23
IP_03 --> IP_24
IP_10 --> IP_24
IP_15 --> IP_24
IP_23 --> IP_24
IP_10 --> IP_30
IP_11 --> IP_30
IP_12 --> IP_30
IP_13 --> IP_30
IP_14 --> IP_30
IP_15 --> IP_30
IP_16 --> IP_30
IP_21 --> IP_30
IP_22 --> IP_30
IP_23 --> IP_30
IP_02 --> IP_31
IP_16 --> IP_31
IP_23 --> IP_31
IP_30 --> IP_31
IP_30 --> IP_40
IP_31 --> IP_40
IP_30 --> IP_32
IP_40 --> IP_32
IP_10 --> IP_33
IP_21 --> IP_33
IP_23 --> IP_33
IP_30 --> IP_33
IP_40 --> IP_33
IP_31 --> IP_34
IP_33 --> IP_34
IP_10 --> IP_35
IP_13 --> IP_35
IP_20 --> IP_35
IP_32 --> IP_35
IP_20 --> IP_41
IP_32 --> IP_41
IP_40 --> IP_41
IP_33 --> IP_42
IP_34 --> IP_42
IP_40 --> IP_42
IP_24 --> IP_43
IP_34 --> IP_43
IP_42 --> IP_43
IP_32 --> IP_44
IP_35 --> IP_44
IP_40 --> IP_44
IP_41 --> IP_44
IP_42 --> IP_44
IP_43 --> IP_44
IP_44 --> IP_45
```