makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

harden Phase 2B Stage 1 installation state

Browse source
This commit is contained in:
makearmy 2026-07-12 22:34:04 -04:00
parent 82e64cec43
commit df6b53e639
10 changed files with 1062 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/le-app-database-migration/phase2b-contained-runtime/STATIC-SAFETY-AUDIT.md
View file

@ -13,5 +13,8 @@ Status: pass for final review; execution remains approval-gated.
- **Existing nftables:** the verified ruleset has no `le_app_codex` objects. Dedicated tables avoid editing Docker-owned chains. Interface-scoped terminal drops remain effective alongside existing Docker base chains.
- **Inventory:** the root record checksums pass. UID 1200 is inactive, not lingering, has no process/runtime/socket; project ACLs and modes match Phase 1; no project-rooted mounts exist; all 41 Docker networks fall within denied IPv4/IPv6 space.
- **Rollback:** names and paths are Phase 2B-specific; teardown deletes only the project tables, namespace/veth, marker, and manifest-listed files.
- **Stage 1 installer:** installs exactly 16 allowlisted files; long Docker-context paths are single-line variables; existing shared parents are accepted only when real, root-owned, and not group/other writable; existing shared parent metadata is never changed.
- **Stage 1 state/rollback:** immutable mode `0600` manifest/checksum generations record commit, artifact-manifest digest, hashes, pending/completed files, pending/created/pre-existing directories, time, and host. A verified regular `current` pointer is switched by one atomic rename only after the new generation is synced and semantically validated. Rollback accepts `IN_PROGRESS` subsets or an exact 16-file `COMPLETE`, atomically tombstones the transaction before removal, re-verifies remaining objects on retry, and calls `rmdir` only for allowlisted recorded directories.
- **Crash recovery:** deterministic `.phase2b-new` payload temporaries are covered by `FILE_PENDING`; hidden incomplete state generations never become authoritative; old generations are retained. The parser shared by installer, rollback, and `tests/32-stage1-state-tests.sh` rejects blank, duplicate, unknown, malformed, unapproved, or escaping records. The state resolver separately rejects symlinked or escaping pointers/generations and unverified generation content. Publication failpoints cover initial and updated `IN_PROGRESS`, final `COMPLETE`, and both sides of the atomic pointer switch.
Hard stops remain: changed Docker version/launcher hash, changed inventory, public/NAT address drift, missing approval marker at namespace-start time, pre-existing project tables/namespace, any acceptance failure, or any endpoint other than the single rootless Unix socket. `ProtectProc=invisible` remains an unproven runtime acceptance candidate.