From 3dbf1780b4771d3f65e466c8614b38bc4d9c529f Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 04:45:45 +0000 Subject: [PATCH] docs(prd): require shared storage permissions --- .../0082-authoritative-failure-boundaries.md | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/docs/prds/0082-authoritative-failure-boundaries.md b/docs/prds/0082-authoritative-failure-boundaries.md index 15faf1c9..5a784c02 100644 --- a/docs/prds/0082-authoritative-failure-boundaries.md +++ b/docs/prds/0082-authoritative-failure-boundaries.md @@ -13,7 +13,9 @@ resource-consuming boundary revalidate the assumptions it acts on. This finishes the focused quality work begun under #444 without broad rewrites: cleanup cannot act on stale identities, policy introspection cannot publish a fabricated empty policy, gateway servers bound untrusted work, and daemon -shutdown does not emit uncaught background-thread failures. +shutdown does not emit uncaught background-thread failures. Shared +control-plane storage and gateway credential provisioning also enforce their +filesystem security contract before sensitive data is written. ## Problem @@ -54,6 +56,9 @@ misleading behavior: 11. Git smart-HTTP can retain sixteen 100 MiB request bodies concurrently, cleanup mutations have no subprocess deadline, and Firecracker signalling failures bypass shared mutation accounting. +12. SQLite creates the shared control-plane database before its mode is + restricted, then suppresses permission-repair failures. Gateway transports + also differ in whether copied deploy-key modes are preserved. These are one design problem: state used to authorize deletion, replacement, or resource allocation must be authoritative at the point of use. @@ -91,6 +96,11 @@ or resource allocation must be authoritative at the point of use. - Git request bodies spool to disk behind a separate heavy-work semaphore; cleanup commands have configurable deadlines; Firecracker signalling failures aggregate while identity-verification uncertainty still aborts. +- The shared database directory and file are private before SQLite writes any + control-plane state; an inability to enforce those modes aborts startup. +- Gateway credential directories and files receive explicit private modes + inside the gateway, independent of Docker, Apple Container, or SSH copy + semantics. - Unit tests cover PID/path reuse, partial backend enumeration, transient policy resolution failure, slow bodies, concurrency saturation, and stream closure races. @@ -153,6 +163,17 @@ The gateway output pump catches only stream-closure exceptions expected after the supervisor closes child pipes. Other I/O failures remain visible and are reported through the supervisor's normal diagnostic channel. +### Shared filesystem security + +The common SQLite store owns database creation for every backend. It creates +the parent directory and an empty database with private modes before opening +SQLite, repairs existing modes, verifies the resulting state, and propagates +every enforcement failure. Backend launchers do not duplicate this policy. + +The backend-neutral gateway provisioner likewise applies directory and file +modes after transport copies complete. This avoids relying on copy behavior +that differs among Docker, Apple Container, and Firecracker's SSH transport. + ## Implementation chunks 1. Existing fail-closed security and backend enumeration fixes. @@ -168,6 +189,8 @@ reported through the supervisor's normal diagnostic channel. and mutation accounting, and contained Git backend process failures. 10. Disk-spooled and separately bounded Git bodies, cleanup command deadlines, and classified Firecracker signalling failures. +11. Fail-closed shared database creation and backend-neutral gateway credential + permissions. ## Open questions