Keep gloved in a systemd-owned supervisor leaf while creating sibling session cgroups under the empty delegated parent. Under mapped-root supervisors, attach blocked children before releasing their existing start gate instead of combining nested UID mapping with CLONE_INTO_CGROUP.
Closes the sol-audit blockers in dd7d3f3:
HIGH - degradation could not stop the guest. create() moved
config.runtime into the protocol and then stored the moved-from config,
so the degrade path always saw an empty runtime pointer and a guest
launched by start_session outlived its vanished controller connection.
The server now shares the live runtime with the protocol (copy on
compose, one owner of teardown authority), and a Linux-gated server test
drives the real create() -> handle_frame -> broken-pipe path and proves
the guest is torn down (fails on the pre-fix ownership bug).
MEDIUM - degradation was not bound to authentication/application. The
degrade path re-decoded the raw frame to extract start_session and its
session id, granting teardown authority with no auth/schema/deadline or
application evidence; a same-UID peer could reset the socket after
submitting a valid-shaped but unauthorized frame to trigger stop() on a
named session. handle_frame now emits structured
receipt_control_outcome metadata (authenticated / applied /
response_success / method / session_id) from the real dispatch, and
degrade_failed_delivery acts only on genuinely authenticated+applied
start_session outcomes; every other outcome records only the
connection-scoped audit event. The raw frame is never re-decoded.
MEDIUM - control-audit.jsonl guarantees. jsonl_sink::record() is now
bounded by an optional max_file_bytes policy with oldest-record
truncation (newest event always attempted); gloved configures the cap
(host::control_audit_max_file_bytes, 4 MiB) with a bound test.
record_control_delivery_audit() surfaces sink write failures as
structured stderr logs instead of discarding them (receipt-chain audit
guarantees stay fatal). The derived control-audit.jsonl path is
registered in all_configured_paths() so it cannot alias the receipt
journal, audit key, session store, or any other configured path, with a
config-distinctness test.
MEDIUM - tests missed the production failure mode. The degrade test now
constructs the real server through create() and drives a real
authenticated+applied start_session over the socket; the broken-pipe
test synchronizes on an observable (runtime recorded the applied start)
before the client resets, removing the reset-vs-write race; a protocol-
level test proves wrong-secret / expired-deadline / rejected / non-start
outcomes never stop the guest; the Linux executor test asserts the
durable mark_stopping ordering survives an independent registry reopen.
LOW - unified the duplicate wire::rpc_error / response envelope in
remote_protocol.cpp with receipt_wire.hpp (ODR hazard).
Validated: clang build + CTest 80/80 local; Ghost g++14.2 build and
CTest in a follow-up artifact. No push.
Introduce the framed guest_channel_transport with shared deadlines and
std::jthread ownership, metadata-only retired-schema quarantine with
fail-closed integrity, stateless frozen-catalog validators with
capability pinned to zero, and the generic local-service proxy with
descriptor-pinned endpoints, alias-only guest sockets, audit-gated
delivery, and a Linux managed runtime capability derived only from a
registry-bound operational factory. Sage vocabulary is confined to
src/adapters/sage.
Bind digest-addressed Sage bundles and immutable guest identity into the constrained Apple Container runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bind Glove-owned Pi adoption snapshots to launch profiles and receipts while keeping host state out of private homes. Add an offline hostile-content policy and repeatable Linux service setup.
Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.
Resolve safe shebang interpreters and exact package roots during staging so operators do not need broad manual grants. Credential homes remain outside the generated closure and unsupported interpreter shapes fail closed.
Detect and bind operator-installed harnesses through explicit, digest-bound runtime policy. Keep macOS and Linux shipping lanes capability-aware and fail closed when isolation evidence is absent.
Run the Linux service in a delegated user and mount namespace and preserve precise owner-local launch diagnostics while keeping remote denials generic.
Accept validated v2 session plans without bypassing direct-write consent, and bind explicit native runtimes through the same managed launch and receipt boundary.
