ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Restore pre-publication network readiness semantics

Browse source
This commit is contained in:
ms2k 2026-07-16 19:26:03 +09:00
commit c8acf116d6
1 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/specification.md
View file

@ -924,9 +924,13 @@ participant as `Intent`. It acquires the helper through
Supervisor pidfs ownership is committed, it may accept network readiness Supervisor pidfs ownership is committed, it may accept network readiness
evidence and advance the `network` participant. evidence and advance the `network` participant.
The Host Coordinator independently reads the Runtime Supervisor's namespace The Host Coordinator independently reads the Runtime Supervisor's namespace
identity and persists the attestation, fingerprint, and generation-bound identity and records the network readiness fingerprint as the durable encoding
deny/permit/DNS probe result. Persisted readiness files are evidence after this of protocol network readiness. Before publication, Lazaret verifies from the
exchange, not its transport. Agent Sandbox network view, or an equivalent generation-bound probe using the
same enforcement namespace, that default-denied private destinations are
unreachable and that required permitted reachability, including selected DNS
resolvers, works. Persisted readiness files are evidence after this exchange,
not its transport.
#### Default policy and deny representation #### Default policy and deny representation
@ -1047,9 +1051,9 @@ not duplicated here.
| **FR-15** | For each interactive Client Session, Lazaret shall preserve the Session Terminal record and protocol described by the Session Terminal refinement; serialize bounded terminal events and merged output by Session ID; map resize and the `Interrupt`, `Quit`, and `Suspend` events to the specified exact process-group operations; collect exit status from the non-detached `runsc exec` client; and follow the specified release and hard-loss recovery ordering without reattachment or mismatched cleanup. | | **FR-15** | For each interactive Client Session, Lazaret shall preserve the Session Terminal record and protocol described by the Session Terminal refinement; serialize bounded terminal events and merged output by Session ID; map resize and the `Interrupt`, `Quit`, and `Suspend` events to the specified exact process-group operations; collect exit status from the non-detached `runsc exec` client; and follow the specified release and hard-loss recovery ordering without reattachment or mismatched cleanup. |
| **FR-16** | Domain network connectivity shall use `slirp4netns` as the production connectivity helper. The Domain Store shall record independent `helper` intent before launch and exact committed helper and supervising Runtime Supervisor pidfs ownership before network readiness. | | **FR-16** | Domain network connectivity shall use `slirp4netns` as the production connectivity helper. The Domain Store shall record independent `helper` intent before launch and exact committed helper and supervising Runtime Supervisor pidfs ownership before network readiness. |
| **FR-17** | The Domain Store shall be opened only by the Host Coordinator process holding the Domain `flock`; mutations shall use whole redb transactions. Storage Catalog opens shall be bounded by `storage-catalog.lock` and one transaction. Cross-store lease release shall follow the durable release-intent, exact-unmount, catalog-delete, Domain-clean ordering defined by the durable generation refinement. | | **FR-17** | The Domain Store shall be opened only by the Host Coordinator process holding the Domain `flock`; mutations shall use whole redb transactions. Storage Catalog opens shall be bounded by `storage-catalog.lock` and one transaction. Cross-store lease release shall follow the durable release-intent, exact-unmount, catalog-delete, Domain-clean ordering defined by the durable generation refinement. |
| **FR-18** | Product network-readiness evidence shall include the readiness fingerprint plus the generation-bound deny/permit/DNS probe result described by the network-readiness refinement. | | **FR-18** | Product network readiness encoding shall include a network readiness fingerprint and the pre-publication reachability verification described under network isolation; protocol publication and readiness gates follow the protocol model. |
| **FR-19** | The Host Coordinator shall derive generation-bound network policy from trusted host configuration; the Runtime Supervisor shall install only that derived policy and attest readiness by observed namespace state. Durable network participant state shall record the network readiness fingerprint. | | **FR-19** | The Host Coordinator shall derive generation-bound network policy from trusted host configuration; the Runtime Supervisor shall install only that derived policy and attest readiness by observed namespace state. Durable network participant state shall record the network readiness fingerprint. |
| **FR-20** | The physical network probe shall execute in the Agent Sandbox network view or an equivalent generation-bound process using the same enforcement namespace and record configured deny, permitted reachability, and selected DNS resolver observations. | | **FR-20** | Before publication, Lazaret shall verify from the Agent Sandbox network view, or an equivalent generation-bound probe using the same enforcement namespace, that default-denied private destinations are unreachable and that required permitted reachability including selected DNS resolvers works. |
| **FR-21** | The Domain Store and Storage Catalog shall preserve the records, ownership variants, identities, and relationships described by the durable-generation and prepared-lower refinements. | | **FR-21** | The Domain Store and Storage Catalog shall preserve the records, ownership variants, identities, and relationships described by the durable-generation and prepared-lower refinements. |
| **FR-22** | Preparation shall use a supported OCI-aware preparer that materialises a Lazaret-owned immutable rootfs with source identity and prepared-artifact ID. | | **FR-22** | Preparation shall use a supported OCI-aware preparer that materialises a Lazaret-owned immutable rootfs with source identity and prepared-artifact ID. |