GitHub

ADR-0073: Exact worker dependency-object byte admission

Status: accepted
Date: 2026-08-09
Decision owners: NAUX architecture and x86-64 dependency-object boundary

Context

ADR-0072 proves that the exact sealed worker declares the exact interpreter, ordered direct dependencies, and hardening flags approved by review. A loader name still does not identify bytes: pathname targets can change, distributions can resolve the same name differently, and reopening an approved path can race with replacement. Declaration admission is therefore not object admission.

Decision drivers

  • Authority must originate in an externally reviewed canonical locator, exact byte length, and SHA-256 digest; measuring the candidate inside admission is not review.
  • Pathnames are locators, never stable identity. Verification must survive replacement or deletion of every source path.
  • Matching bytes must be copied into NAUX-owned private read-only descriptors with the exact four immutable Linux seals.
  • Every sealed object must independently decode as bounded little-endian ELF64 ET_DYN for x86-64, with no W+X load or executable stack.
  • Ordering and identity must bind exactly to the accepted ADR-0072 interpreter and direct-dependency vector.
  • No API may expose raw descriptors or bytes, resolve a loader name, map an object, or execute code.

Considered options

Trust canonical pathnames

Rejected. Lexical canonicality removes ambiguity from the manifest but cannot prevent target replacement or prove the bytes observed later.

Reopen and rehash paths during every verification

Rejected. This detects some drift but makes authority depend on mutable host state, reintroduces time-of-check/time-of-use races, and prevents evidence from remaining valid after a reviewed bundle is removed.

Hash once and retain ordinary open files

Rejected. An open file pins an inode, but it does not itself prove immutable content or eliminate writable aliases.

Copy exact bytes into private sealed descriptors

Selected. Admission opens the final path component with O_NOFOLLOW, compares source identity before and after the bounded read, verifies exact length and digest, decodes ELF independently, copies bytes to a private memfd, verifies readback, applies all four immutable seals, reopens read-only, and closes the writable file description. Replay uses only this opaque set.

Claim these are the objects selected by the host loader

Rejected. Exact reviewed objects are not evidence of actual loader resolution. That requires a separately designed observation/launch boundary.

Decision

Introduce an ordered object manifest containing one interpreter followed by one object for every ADR-0072 DT_NEEDED declaration. Each expectation seals kind, declaration, canonical absolute source path, exact length, exact digest, and the accepted ADR-0073 policy identity. A repeated path is permitted only when every byte-identity field agrees; this covers the accepted worker whose loader is both PT_INTERP and one direct dependency.

Admission first independently replays ADR-0072. It then admits every object into a private read-only four-seal descriptor and constructs object evidence from descriptor readback, not from caller records. Verification preflights all manifest/evidence bindings, fully replays ADR-0072, re-reads and rehashes every sealed descriptor, independently re-decodes ELF structure, and reconstructs the complete evidence root. Source paths are never reopened during replay.

Frozen limits

  • Linux x86-64 only;
  • exactly one interpreter plus 1 through 64 direct dependencies;
  • at most 4,096 printable non-space ASCII bytes per canonical absolute path;
  • at most 256 MiB per object and 512 MiB total;
  • exactly four immutable memfd seals and a read-only retained descriptor;
  • ELF64, little-endian, current version, ET_DYN, EM_X86_64;
  • System V or GNU OS ABI with ABI version zero and zero identification padding;
  • at most 64 program headers, 4,096 section headers, and 16 load segments;
  • exactly one dynamic segment and one non-executable GNU stack segment;
  • no writable-executable load segment;
  • accepted ADR-0072 policy root 5a69470530ec8f65be018f53927379381a6d20cec7ca9076a69441a80183ec22;
  • proof-only object admission; encoder policy remains 1.4.0.

Consequences

  • Positive: NAUX can retain and independently replay the exact reviewed direct object bytes even after all source locators disappear.
  • Positive: declaration order, byte identity, immutable storage, and basic ELF architecture/hardening shape form one domain-separated evidence chain.
  • Negative: sovereign SHA-256 and full descriptor replay cost time proportional to admitted bytes, especially in debug builds.
  • Negative: an object set retains one descriptor and one private byte copy per declaration; duplicate reviewed objects are intentionally not deduplicated.
  • Risk: intermediate pathname components can change during open. Exact digest, length, before/after descriptor identity, and sealed-copy replay prevent that locator instability from becoming byte authority.
  • Open: contained DT_SONAME, transitive DT_NEEDED closure, symbol versions, relocations, actual loader selection, mapping state, sandboxing, and execution remain outside this decision.

Acceptance gates

  1. The exact ADR-0072 interpreter/direct-dependency vector admits in order, retains four-seal read-only descriptors, and independently replays.
  2. Deleting every source path after admission cannot change verification.
  3. Path, length, digest, order, duplicate-path conflict, symlink, ELF identity, table range/cardinality, W+X, executable-stack, root, record, and locally resealed evidence drift fail closed.
  4. Production imports no process launcher, host loader, native emitter, historical standalone/raw decoder, measurement, or external ELF library.
  5. Focused, workspace, strict lint, governance, refinement, format, shell, link, parity, and static-authority gates pass before acceptance.
  • ADR-0070 establishes the sealed exact worker artifact.
  • ADR-0071 inventories the worker’s dynamic declarations.
  • ADR-0072 admits the reviewed declaration vector consumed here.

Accepted evidence

The object-admission policy is accepted under root c9780ea71b48becf884b4bc4bc1963fa6794b4da4c83c5486bc3ae70c3737bc9. The root binds schema/policy 1.0.0, the accepted ADR-0072 root, every byte/path/ table/segment/resource limit, the exact four-seal contract, and twelve named capabilities covering external review, source identity, path-independent descriptor replay, bounded ELF identity, hardening, predecessor replay, and the proof-only authority ceiling.

The acceptance manifest contains exactly four ordered declarations: one interpreter, then libgcc_s.so.1, libc.so.6, and ld-linux-x86-64.so.2. The interpreter and final direct dependency may name the same reviewed loader bytes only because their exact path, length, and digest agree. All four objects replay from private read-only descriptors with seal mask 0x000f; deleting the complete source bundle after admission leaves verification unchanged.

The focused ADR-0073 suite passes 2/2, including 23 independent ELF mutation classes plus locator, symlink, digest, manifest, evidence, and locally resealed record failures. The complete workspace passes 408 library tests with zero failures and six explicit release-only ignores, every enabled integration and doc test, strict Clippy, and formatting. Object/manifest/evidence roots remain deployment-specific; only the policy root is global.

Acceptance proves exact reviewed direct-object bytes and bounded ELF shape. It does not prove contained DT_SONAME, transitive dependency closure, host-loader selection, mapping, relocation, execution, sandbox, timing, performance claim, or global encoder-policy authority.