Complete remaining runtime installation history and supported-host evidence

Chiusa
  • Qualcosa non va?
#480 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@PelikanFix16 ci sta già lavorando.

Dal 23/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Parent #331, required v0.1 runtime outcomes. This child preserves the original contract below while tracking the remaining durable installation history, supported-Linux isolation/runtime/boot evidence, and actual runtime-install through egress. #385 delivers only its declared corrections; parent and child remain open until every required gate passes. This is tracking of existing work, not a new implementation or deferral.

Follow-up to #303 (F-022 T3, #278), from @Zamojski5's approving evaluation of 192a7f35 (https://github.com/ColdPhase/flux/pull/303). That approval holds only if M1, m1, m2 and m7 are fixed or tracked before T4 (#279, sign-in) lands. This issue tracks them, and it blocks #279's merge.

Must be resolved before #279 merges

  • M1. The CLI runs under the supervisor's uid. supervisor/process.ts:16 spawns the CLI as uid 1000, the same uid as the supervisor.
    • A compromised CLI could then read /proc/<supervisor>/environ (FLUX_RUNTIME_SLOT_SECRET). On ptrace_scope 0 it could also write /proc/<pid>/mem.
    • A supervisor patched that way could fake release, so the next owner inherits the old process and its /tmp.
    • Acceptance: the CLI runs under its own uid, or the supervisor is non-dumpable and the worker refuses slots where ptrace_scope is 0.
    • A probe as the CLI's uid then fails to open /proc/<supervisor>/mem for writing and to read /proc/<supervisor>/environ. A negative control shows the probe succeeds without the fix.
  • m1. Sign-out after the runtime is switched off. The egress allowlist is built from FLUX_AGENT_RUNTIME (egress/main.ts:12,16), so the documented "switch off, then purge/reset/clean" gets 403 on every logout CONNECT. forgetAll then reports signOutFailed:false.
    • Acceptance: sign-out reaches the vendor hosts during purge, reset and clean whatever the switch says, or the guide and the launcher require purging before switching off.
    • Either way, a failed or blocked logout is reported as failed. A check exercises off→purge.
  • m2. A skipped or missing sign-out reads as success. manager-port.ts:29 counts only failed/timeout. handlers.ts:117-124 skips logout on an unsafe binding directory, and not_installed is possible too.
    • Acceptance: skipped and not-installed logouts are reported as not signed out. Release logs out every signed-in CLI, as F-022 says.
  • m7. Scope and wording.
    • Open a tracked issue for the deferred ghcr.io/coldphase/flux-agent-runtime image and the release compose.
    • Fix the F-022 row in decisions.md ("installed by Anthropic's installer") and the plan's T3 bullets (lines 127 and 131) to match ai-modes.md as merged.

Tracked, to fix with T4 or record as accepted risks

  • m3: the socket test misses directory bind mounts (/var/run, /run:/host-run). Use an allowlist of bind sources in test_container_isolation.py and inspect.py.
  • m4: check_agent_runtime.sh step 5 uses the host's ip, which macOS lacks. Run it in a container.
  • m5: any signed-in account can bind a slot before sign-in, and sign-up is open. Bind when T4's sign-in starts, or record it as accepted.
  • m6: egress SNI isn't tied to the CONNECT host, and there is one global maxConnections. Record both as accepted risks, or add a per-slot cap.
  • m8: reconciliation race (reconcile.ts:40,45) and wipeBootId read before release. Low.
  • m9: the real install path through egress is never exercised. One run through runtime-install → egress → downloads.claude.ai.
  • Nits:
    • the 0056 header names reserved numbers that are on main, and a test file that doesn't exist;
    • ensure_runtime_secrets writes a temporary file holding secrets under the default umask;
    • the manager client reads the whole body before its 4 MiB check;
    • the account_label CHECK is weak.

Owner of remaining implementation: @Zamojski5. Evaluator: @PelikanFix16. Original #303/T4 authorship remains PelikanFix16; historical artifacts are preserved.

Remaining acceptance includes an independently established installation history (filesystem absence alone is insufficient), the actual supported-host check with kernel isolation and the original positive/negative controls, the reconciliation/boot journey, and one real runtime-install → egress → downloads.claude.ai path. Preserve every original M1/m1/m2/m7/m3–m9 requirement or explicitly recorded accepted risk; copied criteria above are unchanged. Current ptrace_scope=0 host is not a supported acceptance observation, and no host security settings have been changed. Required installation/distribution/release outcomes remain with #249 and their accepted tasks.

Owner: Zamojski5; independent evaluator: PelikanFix16. Resume existing artifacts within WIP limits after bounded #385 integration. No extra active feature is started by this record.

Ownership handoff, 2026-10-11: at the user's explicit request, remaining implementation is assigned to Zamojski5; independent evaluator is PelikanFix16. Acceptance criteria and required v0.1 scope are unchanged. This queues existing work, not an extra simultaneous implementation beyond the WIP limit. See the pinned handoff comment.

Lingua principale
TypeScript
Stelle
3
Fork
0
Merge medio
18h 50m
PR unite (30g)
395

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ColdPhase/flux

Tutte le issue di ColdPhase/flux

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.