56e3cbd638Keep gloved in a systemd-owned supervisor leaf while creating sibling session cgroups under the empty delegated parent. Under mapped-root supervisors, attach blocked children before releasing their existing start gate instead of combining nested UID mapping with CLONE_INTO_CGROUP.
55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
# Verification surface
|
|
|
|
[`future-work.md`](future-work.md) is the single list of incomplete engineering
|
|
work. This document defines which checks produce acceptable evidence.
|
|
|
|
## Repository gate
|
|
|
|
```sh
|
|
./scripts/preflight.sh
|
|
```
|
|
|
|
Preflight runs actionlint, formatting, clang-tidy analysis, ASan/UBSan tests,
|
|
fuzz targets, and TSan tests. A completed clang-tidy stage means analysis ran;
|
|
it does not claim the diagnostic backlog is zero.
|
|
|
|
## Shipping lanes
|
|
|
|
| Lane | Required evidence |
|
|
|---|---|
|
|
| macOS | Native preflight plus `scripts/macos-shipping-lane.sh` on a physical Apple Silicon host. The Apple VM probe must prove network denial, read-only root, private workspace, environment scrubbing, and requested/effective resource observations. |
|
|
| Linux | Warning-clean build plus installed user-service probes for namespaces, seccomp, delegated cgroups, terminal receipts, process-tree termination, and cleanup. Ordinary-shell skips are not enforcement evidence. |
|
|
|
|
Platform-specific kernel controls are reported as capabilities. A skipped or
|
|
unavailable control never counts as a pass for another platform's boundary.
|
|
On systemd 254+ Linux hosts,
|
|
`container_linux_systemd_delegate_subgroup` must run without a skip: it starts
|
|
actual `gloved` under the generated delegation/unshare topology, checks the
|
|
advertised `pi` managed runtime and cgroup-v2 enforcement before and after a
|
|
forced service restart, then executes the actual Node inherited-stream
|
|
clone/exec/seccomp probe and managed PTY attach/stop path in the same topology.
|
|
|
|
## Real harness evidence
|
|
|
|
Codex, Claude Code, Pi, Copilot, and OpenCode must run through the same
|
|
programmatic Glove adapter path and shared invariant manifest. Test images do
|
|
not bundle vendor clients or credentials. Synthetic probes remain useful for
|
|
fault isolation but cannot replace an installed-client lane.
|
|
|
|
Provide an owner-reviewed, immutable harness root explicitly and run the
|
|
separate matrix test:
|
|
|
|
```sh
|
|
GLOVE_TEST_NATIVE_HARNESS_ROOT=/absolute/protected/harness-root \
|
|
ctest --test-dir build/dev --output-on-failure \
|
|
-R '^container_linux_native_harness_matrix$'
|
|
```
|
|
|
|
The root must contain all five reviewed client distributions. When the variable
|
|
is absent, CTest reports this lane as skipped; that skip is not client evidence.
|
|
|
|
## Performance evidence
|
|
|
|
Benchmarks are opt-in and emit schema-versioned JSON Lines. Retain raw results
|
|
and compare identical workloads and platform metadata; correctness gates do not
|
|
use timing thresholds.
|