GitHub

ADR-0070: Sealed worker-artifact launch attestation

Status: accepted
Date: 2026-08-03
Decision owners: NAUX architecture and x86-64 launch boundary

Context

ADR-0069 contains the complete ADR-0068 native corpus in one child, but accepts a caller-selected reviewed pathname. The parent does not prove that pathname still names the reviewed bytes when the kernel executes it. Hash-then-spawn by path has an unavoidable mutable-path and mutable-file race.

Decision drivers

  • Require an independently supplied exact byte length and SHA-256 identity; computing an expectation from the candidate inside the admission API grants no authority.
  • Read a bounded regular artifact with no symlink traversal, set-id bits, or trailing growth during admission.
  • Copy only admitted bytes into a NAUX-owned anonymous file, verify readback, and apply immutable write/grow/shrink/seal seals before launch.
  • Execute the sealed descriptor itself with Linux execveat(AT_EMPTY_PATH); never resolve PATH or reopen the caller pathname after admission.
  • Reuse the accepted ADR-0069 capture, timeout, process-group termination, reap, IPC decode, and parent oracle-only replay rather than creating another process protocol.
  • Keep toolchain reproducibility, dynamic-loader closure, sandbox, syscall filtering, standalone, timing, claim, and global encoder-policy authority closed.

Decision

Introduce an opaque reviewed expectation and a sealed launch capsule:

  1. The caller supplies the exact reviewed SHA-256 digest and byte length.
  2. Admission opens the path without following a final symlink, requires one regular non-set-id file, enforces a 256-MiB cap, reads exactly the declared bytes, checks EOF, and compares metadata before and after the read.
  3. NAUX creates an anonymous sealable memfd, writes and reads back the exact bytes, verifies the same digest, marks it executable, and applies F_SEAL_WRITE | F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL.
  4. Launch invokes the accepted ADR-0069 owner, but its child replaces the ordinary pathname exec with execveat on that exact sealed descriptor and an empty, bounded environment. Successful exec closes the descriptor.
  5. ADR-0070 evidence binds the reviewed expectation, source and sealed identities, seal mask, exact-FD launch mode, and accepted ADR-0069 process root. Verification independently reseals the receipt and replays ADR-0069.

Frozen limits

  • Linux x86-64 only;
  • one regular artifact, 1 through 256 MiB;
  • exact SHA-256 and exact byte length supplied before admission;
  • final symlink rejected; set-user-ID and set-group-ID rejected;
  • exactly four mandatory immutable seals;
  • one sealed descriptor, one execveat(AT_EMPTY_PATH) launch;
  • empty production environment; one bounded debug-probe variable only in debug builds;
  • global target encoder policy remains 1.4.0.

Consequences

  • Path replacement after admission cannot change the bytes executed by the accepted child lifecycle.
  • In-place writes to the launch capsule fail after sealing.
  • Trust moves to the independently reviewed expectation and the host kernel; the API must not pretend that self-measured candidate bytes are pre-approved.
  • The Rust binary may still depend on its ELF interpreter, shared libraries, kernel, CPU, and launch environment. Closing that dependency graph is a separate later authority step.
  • Artifact identity and correctness evidence are not performance evidence.

Acceptance gates

  1. Correct expectation admits, readback matches, all four seals are present, and exact-FD launch returns the accepted ADR-0069 process evidence.
  2. Wrong hash, wrong length, empty/oversized/non-regular/symlink/set-id input, mid-read metadata change, short read, growth, and seal failure return no launch witness.
  3. Replacing or deleting the source pathname after sealing does not change the launched descriptor identity.
  4. A write, truncate, or additional seal mutation against the capsule fails; no writable descriptor remains in successful evidence.
  5. Receipt/evidence mutation and a mismatched ADR-0069 process root fail independent replay.
  6. Production performs no PATH lookup and imports no historical raw/process/ standalone/measurement stack or native emitter.
  7. Focused, workspace, strict lint, governance, refinement, format, shell, and static authority gates pass before acceptance.

Accepted evidence

The reviewed-artifact launch mechanism is accepted under policy root 967282494499035aa13fe3daaf05d61825fb7ab9027052c6dec51f3420a5317d. The policy binds schema/policy 1.0.0, the 256-MiB cap, exact seal mask 0x000f, execveat flag AT_EMPTY_PATH, exact-FD launch mode, and the accepted ADR-0069 process root e3f97622df1a3e12b99e66678654881bc521761a6b7df6ab02b6d9f459e1d7ae.

Admission requires an exact caller-reviewed digest and length, rejects a final symlink, non-regular or set-id source, detects metadata drift, hashes the exact bounded bytes, verifies anonymous-file readback, and applies F_SEAL_WRITE | F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL. The writable file description is closed; the retained launch descriptor is read-only and all four seals replay exactly. Write, truncate, and seal mutation fail.

The successful child is replaced with execveat(AT_EMPTY_PATH) on that sealed descriptor under an empty production environment. Replacing or deleting the source pathname after admission cannot alter capsule verification. Wrong digest/length, symlink, set-id, directory, empty/oversized source, and non-ELF launch return no witness. Receipt, evidence, and locally resealed wrong-process mutations fail independent replay. Production imports no native emitter or historical raw/process/standalone/measurement authority.

The full workspace passes 402 library tests with 0 failures and 6 ignored; ADR-0069 and ADR-0070 public boundaries each pass 2/2, historical native process isolation passes 3/3, native parity passes 10/10, target-plan parity passes 9/9, and Gate A passes 3/3. Governance passes 22/22, strict refinement passes 8/8, and Clippy, format, shell syntax, and static authority gates pass.

This policy does not designate one globally reproducible Rust/Cargo executable. Each deployment must supply its independently reviewed digest and length; the resulting evidence is artifact-specific. ELF interpreter/shared-library closure, toolchain reproducibility, sandboxing, syscall filtering, standalone, timing, and performance authority remain closed.