docs/post-merge-socket-audit #128

Merged

clawdie merged 3 commits from docs/post-merge-socket-audit into main 2026-10-07 08:41:40 +02:00

Conversation 0 Commits 3 Files changed 4 +69 -25

clawdie commented 2026-10-07 08:41:31 +02:00

Owner

Copy link

No description provided.

clawdie added 3 commits 2026-10-07 08:41:31 +02:00

docs(spec): post-merge alignment of kernel caller check and socket security ... 5d1f4f6736

docs only

- Update PRIVILEGE-BOUNDARY-SPEC.md Controls Matrix row 35: reflect that
  verify_caller_identity in crates/colibri-daemon/src/socket.rs was merged
  in colibri commit 2f8e916 (PR #127), validating peer credentials via Tokio
  stream.peer_cred() (SO_PEERCRED on Linux, getpeereid on FreeBSD), while
  noting that native FreeBSD host validation on valhala remains pending.
- Update control-plane-bridge.md (EN and SL): clarify that socket access
  requires both filesystem DAC (0770) and kernel caller verification,
  requiring connecting bridge processes to run as daemon UID or root (UID 0)
  until multi-caller brokering (§5.6) is configured.
- Preserve historical Track A and Track B audit reports untouched as dated
  evidence snapshots.
- Update OKF frontmatter to 2026-10-07.
- Evaluated via Jev probes (probe_doc_audit_before, probe_doc_audit_after).

docs(spec): reconcile runtime-UID verification and open broker decision ... 358bd3f84b

docs only

- Clarify packaging divergence between FreeBSD rc.d templates and Clawdie
  installer privilege dropping in English and Slovenian bridge guides.
- Add explicit process UID inspection steps to guide verification blocks.
- Point privilege boundary target planned column at open broker model decision
  in §5.6 (Options A/B/C) rather than presuming a settled allowlist.
- Record that operational root policy authorization is tracked for formal
  ratification under Phase 1 deterministic policy floor.
- Normalize kernel caller check terminology in bherdr deltas, §5.1, and Phase 1.
- Update legacy verified_by in docs/SSH-ACCESS.md frontmatter to antigravity@debby.
- All gates passing: wiki-lint, check-dates, check-okf, check-format, whitespace.

docs(spec): correct FreeBSD validation status for kernel caller check ... c53de86452

Replace the unsubstantiated 'Validated in CI suites on Linux and native
FreeBSD 15 (valhala)' with the status the source actually supports:

- unit-tested on Linux (cargo test -p colibri-daemon)
- native FreeBSD 15 host validation on valhala remains pending

Matches crates/colibri-daemon/src/socket.rs:206 and the absence of a
serving FreeBSD CI runner (.forgejo/workflows/ci.yml).

clawdie merged commit 6f90c0855c into main 2026-10-07 08:41:40 +02:00

clawdie deleted branch docs/post-merge-socket-audit 2026-10-07 08:41:40 +02:00

clawdie referenced this pull request from a commit 2026-10-07 08:41:41 +02:00

Merge pull request 'docs/post-merge-socket-audit' (#128) from docs/post-merge-socket-audit into main

clawdie referenced this pull request 2026-10-07 09:25:36 +02:00

Attestation design: signer, key ownership, and verification (deferred) #125

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/colibri!128

No description provided.