lazaret/docs/host-support.md

Host support and process-safety registry

Generated from support/external-tools.toml and support/process-safety.toml; do not edit this file directly.

Pidfs host support

• Contract: pidfs-process-identity-v1
• Platform floor: linux-x86_64 kernel 6.9 or newer
• Runtime refusal: fail-before-generation
• Unavailable verifier behavior: skip
• Smoke claim: current-boot-smoke-only cached only by boot_id
• Smoke bounds: one attempt per step, 5000 ms per step, 60000 ms total, 5000 ms cleanup
• Positive support: unavailable until IP-03 implements an exact running-build matcher and the smoke runner

The smoke steps are bounded observations and never qualify source or build provenance:

1. linux-x86_64-kernel-floor
2. pidfd-operations
3. pidfs-magic
4. concurrent-same-process-identity
5. last-close-live-reopen-identity
6. simultaneous-process-distinct-inode
7. stale-handle-cannot-affect-live-peer
8. exit-reap-drop-all-later-process-non-reuse

Qualified kernel builds

ID	Kind	Release	Source commit	Build image SHA-256
upstream-linux-6.9.0-x86_64	upstream	6.9.0	a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6	e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc

Process-safety audit

Policy causal-child-acquisition-v1 pins 13 dependency source/version/feature/API-review records, generates compiler-resolved disallowed type/method lints, and registers process-safety-baseline-exercised-paths as V2 exercised-path tracing.

The dedicated lazaret-process-broker boundary is unimplemented and no lint exemption is authorized. Dynamic coverage is registered-exercised-paths-only; it does not claim unexercised-path coverage.

Complete registered data

Every authoritative host-qualification and process-safety field is reproduced below so generated-view drift remains complete.

{
  "host_capabilities": [
    {
      "diagnostic": "Physical and composition suites currently support Linux x86_64.",
      "id": "linux-x86_64",
      "levels": [
        "V2",
        "V3",
        "V4",
        "V5"
      ],
      "policy": "skip",
      "probe": "linux-x86_64"
    },
    {
      "diagnostic": "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity.",
      "id": "kernel",
      "levels": [
        "V2",
        "V3",
        "V4",
        "V5"
      ],
      "minimum": "6.9",
      "policy": "skip",
      "probe": "kernel-at-least"
    },
    {
      "contract": "pidfs-process-identity-v1",
      "diagnostic": "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record.",
      "id": "pidfs-host-support",
      "levels": [
        "V2",
        "V3",
        "V4",
        "V5"
      ],
      "policy": "skip",
      "probe": "registered-host-support"
    }
  ],
  "host_probe": [
    {
      "attempts_per_step": 1,
      "cache_key": "boot_id",
      "cleanup_timeout_ms": 5000,
      "id": "pidfs-host-support-probe-v1",
      "owner": "IP-03",
      "result_claim": "bounded-current-boot-observations",
      "step_timeout_ms": 5000,
      "steps": [
        "linux-x86_64-kernel-floor",
        "pidfd-operations",
        "pidfs-magic",
        "concurrent-same-process-identity",
        "last-close-live-reopen-identity",
        "simultaneous-process-distinct-inode",
        "stale-handle-cannot-affect-live-peer",
        "exit-reap-drop-all-later-process-non-reuse"
      ],
      "total_timeout_ms": 60000
    }
  ],
  "kernel_qualification": [
    {
      "acquisition_result_sha256": "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3",
      "architecture": "x86_64",
      "build_config_sha256": "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a",
      "build_image_sha256": "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc",
      "id": "upstream-linux-6.9.0-x86_64",
      "kind": "upstream",
      "pidfs_inode_semantics": "boot-monotonic-u64",
      "probe_binary_sha256": "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f",
      "release": "6.9.0",
      "reuse_result_sha256": "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f",
      "source_archive_sha256": "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149",
      "source_commit": "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6",
      "source_ref": "v6.9",
      "source_signer_fingerprint": "647F28654894E3BD457199BE38DBBDC86092693E",
      "status": "qualified"
    }
  ],
  "pidfs_host_support": {
    "bounded_claim": "current-boot-smoke-only",
    "diagnostic_kernel": "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport.",
    "diagnostic_platform": "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64.",
    "diagnostic_qualification": "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record.",
    "diagnostic_smoke": "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created.",
    "id": "pidfs-process-identity-v1",
    "minimum_kernel": "6.9",
    "platform": "linux-x86_64",
    "probe": "pidfs-host-support-probe-v1",
    "qualification_ids": [
      "upstream-linux-6.9.0-x86_64"
    ],
    "runtime_failure_policy": "fail-before-generation",
    "verifier_unavailable_policy": "skip"
  },
  "process_safety": {
    "policy": {
      "broker_crate": "lazaret-process-broker",
      "broker_state": "unimplemented",
      "completion_owner": "IP-03",
      "disallowed_methods": [
        "libc::clone",
        "libc::execve",
        "libc::execveat",
        "libc::fork",
        "libc::posix_spawn",
        "libc::sigaction",
        "libc::signal",
        "libc::vfork",
        "libc::wait",
        "libc::wait4",
        "libc::waitid",
        "libc::waitpid",
        "nix::sys::signal::sigaction",
        "nix::sys::wait::wait",
        "nix::sys::wait::waitid",
        "nix::sys::wait::waitpid",
        "nix::unistd::execve",
        "nix::unistd::execveat",
        "nix::unistd::fork",
        "nix::unistd::vfork",
        "rustix::process::kill_process",
        "rustix::process::kill_process_group",
        "rustix::process::pidfd_open",
        "rustix::process::pidfd_send_signal",
        "rustix::process::waitid",
        "rustix::process::waitpid",
        "std::process::Child::kill",
        "std::process::Child::try_wait",
        "std::process::Child::wait",
        "std::process::Child::wait_with_output",
        "std::process::Command::output",
        "std::process::Command::spawn",
        "std::process::Command::status"
      ],
      "disallowed_types": [
        "std::process::Child",
        "std::process::Command",
        "tokio::process::Child",
        "tokio::process::Command"
      ],
      "dynamic_coverage": "registered-exercised-paths-only",
      "dynamic_scenario": "process-safety-baseline-exercised-paths",
      "forbidden_syscall_patterns": [
        "^clone3?\\(",
        "^execveat\\(",
        "^fork\\(",
        "^vfork\\(",
        "^wait4\\(",
        "^waitid\\(",
        "^rt_sigaction\\(SIGCHLD,"
      ],
      "id": "causal-child-acquisition-v1",
      "lint_allow_paths": [],
      "lint_config": ".clippy.toml",
      "production_roots": [
        "crates"
      ],
      "trace_expression": "process,wait4,waitid,rt_sigaction"
    },
    "runtime_dependency": [
      {
        "checksum": "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1",
        "features": [],
        "name": "cobs",
        "reviewed_process_apis": [],
        "version": "0.3.0"
      },
      {
        "checksum": "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced",
        "features": [
          "alloc"
        ],
        "name": "embedded-io",
        "reviewed_process_apis": [],
        "version": "0.4.0"
      },
      {
        "checksum": "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d",
        "features": [
          "alloc"
        ],
        "name": "embedded-io",
        "reviewed_process_apis": [],
        "version": "0.6.1"
      },
      {
        "checksum": "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24",
        "features": [
          "alloc",
          "use-std"
        ],
        "name": "postcard",
        "reviewed_process_apis": [],
        "version": "1.1.3"
      },
      {
        "checksum": "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934",
        "features": [
          "default",
          "proc-macro"
        ],
        "name": "proc-macro2",
        "reviewed_process_apis": [],
        "version": "1.0.106"
      },
      {
        "checksum": "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368",
        "features": [
          "default",
          "proc-macro"
        ],
        "name": "quote",
        "reviewed_process_apis": [],
        "version": "1.0.46"
      },
      {
        "checksum": "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e",
        "features": [
          "alloc",
          "default",
          "derive",
          "serde_derive",
          "std"
        ],
        "name": "serde",
        "reviewed_process_apis": [],
        "version": "1.0.228"
      },
      {
        "checksum": "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad",
        "features": [
          "alloc",
          "result",
          "std"
        ],
        "name": "serde_core",
        "reviewed_process_apis": [],
        "version": "1.0.228"
      },
      {
        "checksum": "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79",
        "features": [
          "default"
        ],
        "name": "serde_derive",
        "reviewed_process_apis": [],
        "version": "1.0.228"
      },
      {
        "checksum": "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422",
        "features": [
          "clone-impls",
          "default",
          "derive",
          "parsing",
          "printing",
          "proc-macro"
        ],
        "name": "syn",
        "reviewed_process_apis": [],
        "version": "2.0.118"
      },
      {
        "checksum": "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4",
        "features": [],
        "name": "thiserror",
        "reviewed_process_apis": [],
        "version": "2.0.18"
      },
      {
        "checksum": "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5",
        "features": [],
        "name": "thiserror-impl",
        "reviewed_process_apis": [],
        "version": "2.0.18"
      },
      {
        "checksum": "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75",
        "features": [],
        "name": "unicode-ident",
        "reviewed_process_apis": [],
        "version": "1.0.24"
      }
    ],
    "schema": 2,
    "trace_case": [
      {
        "args": [],
        "binary": "lazaret",
        "expected_exit_code": 0,
        "initial_execve_count": 1
      },
      {
        "args": [],
        "binary": "lazaret-escalation-client",
        "expected_exit_code": 0,
        "initial_execve_count": 1
      },
      {
        "args": [],
        "binary": "lazaret-host-coordinator",
        "expected_exit_code": 0,
        "initial_execve_count": 1
      },
      {
        "args": [],
        "binary": "lazaret-network-sidecar",
        "expected_exit_code": 0,
        "initial_execve_count": 1
      },
      {
        "args": [],
        "binary": "lazaret-runtime-supervisor",
        "expected_exit_code": 0,
        "initial_execve_count": 1
      }
    ]
  },
  "process_trace_capability": {
    "args": [
      "--version"
    ],
    "diagnostic": "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases.",
    "id": "strace",
    "levels": [
      "V2",
      "V3",
      "V4",
      "V5"
    ],
    "policy": "skip",
    "program": "strace",
    "version_pattern": "^strace -- version [6-9]\\.|^strace -- version [1-9][0-9]\\."
  },
  "process_trace_scenario": {
    "capabilities": [
      "linux-x86_64",
      "strace"
    ],
    "command": [
      "tools/dev",
      "process-audit",
      "--dynamic"
    ],
    "level": "V2",
    "name": "process-safety-baseline-exercised-paths"
  },
  "workspace_lints": {
    "clippy": {
      "all": {
        "level": "deny",
        "priority": -1
      },
      "disallowed_methods": "deny",
      "disallowed_types": "deny",
      "pedantic": {
        "level": "deny",
        "priority": -1
      }
    },
    "rust": {
      "unsafe_code": "forbid",
      "unused": {
        "level": "deny",
        "priority": -1
      }
    }
  },
  "workspace_member_lints": {
    "crates/lazaret-client": {
      "workspace": true
    },
    "crates/lazaret-core": {
      "workspace": true
    },
    "crates/lazaret-escalation-client": {
      "workspace": true
    },
    "crates/lazaret-host-coordinator": {
      "workspace": true
    },
    "crates/lazaret-network-sidecar": {
      "workspace": true
    },
    "crates/lazaret-runtime-supervisor": {
      "workspace": true
    }
  }
}