Merge PR #23 head 4097a21adb (Velinus's
"Make Apple resource sampling lifecycle safe") into the Layer-2
integration branch, preserving all contributor commits unchanged.
Retained proven fixes from 4097a21:
- Sampler creation moves into start_finalizer() so a sampler
std::system_error is reported synchronously to the caller. In
ca8600a the sampler was constructed inside finalize() after the
caller had treated startup as successful; the failure path
published an error without attach reaping, container deletion, or
durable mark_managed_failed, and set finished_ so stop() became a
no-op while attach/container survived.
Repairs retained beyond the contributor head, each bound to a
demonstrated failure:
- std::jthread + deterministic stop_token handles the partial-start
case where sampler construction succeeds but finalizer launch
fails (regression: tests/control/apple_container_unavailable_test
and the start_sampler_then_finalizer seam used by production).
- Restored hard-disabled Apple boundary: lifecycle_operational()
false, receipt schema 0, disk enforcement unavailable, empty
managed runtime advertisement, and public method denial before
any side effect. The current PR #23 head crossed the reviewed
activation boundary (schema 0 -> 1, filesystem_quota advertised,
lifecycle constructed-state true) without live-validation.
- glaze parsing hardened: strict_json_options now sets
null_terminated=false; non-NUL-terminated string_views fed
parse_apple_container_stats and duplicate_key_guard caused a
heap-buffer-overflow read in glz::skip_ws (ASan crash input
[{"id":"aanumProcesses" reproduced deterministically; seed corpus
fuzz/corpus/apple_container_stats/truncated-object.json added).
- Sage bundle projection admission hardening (Layer-1 2bba117) and
its test coverage carried through the merge.
Validation (umask 0022):
- Dev CTest 76/76; ASan/UBSan 76/76; TSan 76/76.
- libFuzzer 10,000 units each: library_bundle, session_plan,
apple_container_stats (LLVM 22, ASan/UBSan), all fuzz_exit=0.
- clang-format clean on changed TUs; git diff --check clean.
Preserve known non-skill metadata in projection commitments, reject duplicate and oversized bundles, close Codex exec grammar ambiguity, and keep raw-bundle requirements explicit. Keep layer-2 Sage materialization tests out of this layer.
Validated by the exact layer-1 build and 75-test suite; Apple lifecycle remains a separately skipped layer-2 concern.
Signed-off-by: 0xkite <me@hack4kitesdev.dev>
Bind digest-addressed Sage bundles and immutable guest identity into the constrained Apple Container runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mixed libraries were failing start because any non-skill entry aborted the
projection. The managed sandbox bypass also has to sit after `exec` so
headless Codex can run inside Glove.
Revalidation walked immutable payloads depth-first while planning hashed a flat lexicographic path sequence. Sort bounded descriptor-safe records before hashing so valid adopted Pi packages retain their canonical identity.
Bind Glove-owned Pi adoption snapshots to launch profiles and receipts while keeping host state out of private homes. Add an offline hostile-content policy and repeatable Linux service setup.
Model and PTY cannot self-report pass or failure. Glove now runs
each refinement-eval-v1 session through a declarative evaluator that
checks bounded fixture assertions (termination cause, exit code, max
latency, required and forbidden transcript literals) against audited
resource events, then binds the evaluated outcome inside the
authenticated receipt digest. Capability advances to version 1 with
the evaluator landed.
Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.
Run the Linux service in a delegated user and mount namespace and preserve precise owner-local launch diagnostics while keeping remote denials generic.
Accept validated v2 session plans without bypassing direct-write consent, and bind explicit native runtimes through the same managed launch and receipt boundary.
