fix(memory,gate): complete Step 3 jail policy wiring and observation fixes #231

Merged

clawdie merged 8 commits from clawdie/fix/probe-unprivileged-bastille-discovery into main 2026-10-29 16:36:32 +01:00 AGit

Conversation 0 Commits 8 Files changed 12 +1124 -53

clawdie commented 2026-10-29 14:31:47 +01:00

Owner

Copy link

Follow-up on the nine-property Oxy observation contract and Step 3 gate wiring.

Includes the previously reviewed changes through bf63563 plus one focused correction:

• Hydrator refresh updates both colibri:observedAt and colibri:dynamicHeadroomObservedAt.
• QueryNodeCapacity selects and uses ?nodeID; future clock-skew is rejected.
• Protected Core Services Veto now applies to clone sources as well as destinations, so jail:src:cms cannot bypass the veto.
• Create-only provision/clone and destroy invariants remain fail-closed.
• Lineage unit_name validation, ZFS doas fallback, and first-non-empty-line parsing retained.
• Contract documentation aligned with the nine-property ZFS schema.

Native/local verification at this head:

go test ./...                                             rc=0
go test -race -count=1 ./internal/memory/... ./pkg/gate/... ./internal/task/...  rc=0

No real jail/dataset mutations were performed.

Follow-up on the nine-property Oxy observation contract and Step 3 gate wiring. Includes the previously reviewed changes through `bf63563` plus one focused correction: - Hydrator refresh updates both `colibri:observedAt` and `colibri:dynamicHeadroomObservedAt`. - `QueryNodeCapacity` selects and uses `?nodeID`; future clock-skew is rejected. - Protected Core Services Veto now applies to **clone sources as well as destinations**, so `jail:src:cms` cannot bypass the veto. - Create-only provision/clone and destroy invariants remain fail-closed. - Lineage `unit_name` validation, ZFS `doas` fallback, and first-non-empty-line parsing retained. - Contract documentation aligned with the nine-property ZFS schema. Native/local verification at this head: ```text go test ./... rc=0 go test -race -count=1 ./internal/memory/... ./pkg/gate/... ./internal/task/... rc=0 ``` No real jail/dataset mutations were performed.

clawdie added 7 commits 2026-10-29 14:31:47 +01:00

fix(memory): support doas bastille fallback and preserve readable jails across 0700 siblings 0f8e0624ec

feat(memory): hydrate 9-property clawdie:* ZFS workload schema into Oxigraph and StateEnvelope f8ee39abc6

fix(memory): normalize clawdie:ip and isolate BastilleJailsDir in unit tests 440c9d4021

docs(memory): document nine-property ZFS observation schema caae416e4b

chore(memory): refresh Go token badge b088a24fc2

feat(memory,gate): fix RefreshHeadroom freshness and wire Step 3 Boundary 1 jail policy gate bf6356393e

fix(memory): veto clones whose source is a protected core service e219416fda

clawdie added 1 commit 2026-10-29 14:33:02 +01:00

chore(memory): refresh Go token badge for Step 3 gate 3976f64714

clawdie referenced this pull request 2026-10-29 16:03:44 +01:00

Make screening provider-neutral with compatible v2 contracts #233

clawdie merged commit e51f300571 into main 2026-10-29 16:36:32 +01:00

clawdie referenced this pull request from a commit 2026-10-29 16:36:33 +01:00

Merge pull request 'fix(memory,gate): complete Step 3 jail policy wiring and observation fixes' (#231) from clawdie/fix/probe-unprivileged-bastille-discovery into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/colibri!231

No description provided.