56e3cbd638Keep gloved in a systemd-owned supervisor leaf while creating sibling session cgroups under the empty delegated parent. Under mapped-root supervisors, attach blocked children before releasing their existing start gate instead of combining nested UID mapping with CLONE_INTO_CGROUP.
2.4 KiB
Verification surface
future-work.md is the single list of incomplete engineering
work. This document defines which checks produce acceptable evidence.
Repository gate
./scripts/preflight.sh
Preflight runs actionlint, formatting, clang-tidy analysis, ASan/UBSan tests, fuzz targets, and TSan tests. A completed clang-tidy stage means analysis ran; it does not claim the diagnostic backlog is zero.
Shipping lanes
| Lane | Required evidence |
|---|---|
| macOS | Native preflight plus scripts/macos-shipping-lane.sh on a physical Apple Silicon host. The Apple VM probe must prove network denial, read-only root, private workspace, environment scrubbing, and requested/effective resource observations. |
| Linux | Warning-clean build plus installed user-service probes for namespaces, seccomp, delegated cgroups, terminal receipts, process-tree termination, and cleanup. Ordinary-shell skips are not enforcement evidence. |
Platform-specific kernel controls are reported as capabilities. A skipped or
unavailable control never counts as a pass for another platform's boundary.
On systemd 254+ Linux hosts,
container_linux_systemd_delegate_subgroup must run without a skip: it starts
actual gloved under the generated delegation/unshare topology, checks the
advertised pi managed runtime and cgroup-v2 enforcement before and after a
forced service restart, then executes the actual Node inherited-stream
clone/exec/seccomp probe and managed PTY attach/stop path in the same topology.
Real harness evidence
Codex, Claude Code, Pi, Copilot, and OpenCode must run through the same programmatic Glove adapter path and shared invariant manifest. Test images do not bundle vendor clients or credentials. Synthetic probes remain useful for fault isolation but cannot replace an installed-client lane.
Provide an owner-reviewed, immutable harness root explicitly and run the separate matrix test:
GLOVE_TEST_NATIVE_HARNESS_ROOT=/absolute/protected/harness-root \
ctest --test-dir build/dev --output-on-failure \
-R '^container_linux_native_harness_matrix$'
The root must contain all five reviewed client distributions. When the variable is absent, CTest reports this lane as skipped; that skip is not client evidence.
Performance evidence
Benchmarks are opt-in and emit schema-versioned JSON Lines. Retain raw results and compare identical workloads and platform metadata; correctness gates do not use timing thresholds.