fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side) #1480

2026-08-30T00:18:51Z

orch-01 commented

2026-08-30 00:18:51 +00:00

base...

orch-01 added 1 commit 2026-08-30 00:18:52 +00:00

fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side)

ci/woodpecker/pr/ci Pipeline was canceled

Details

7e9e013f92

Ships fleet/bin/mosaic in the framework so the T106 shipped-first launcher
contract survives split-home layouts. The shipped npm mosaic resolves from the
passwd real home instead of $HOME: under a seat home (HOME=seat dir) the
operator's npm prefix is still found, so 'HOME=<seat-home> fleet/bin/mosaic
--version' returns the shipped version. The $HOME/.npm-global candidate is
consulted only when the passwd lookup fails, and then every path component
must be a non-symlink (secure descriptor traversal; a planted descriptor is
refused without execution).

T106 behavior preserved verbatim: worktree builds are MOSAIC_CLI_WORKTREE
opt-in only, health-checked, shipped fallback on doubt; MOSAIC_FLEET_CLI_OFF
forces pure pass-through; no runnable candidate exits 127 with the documented
stderr line; stale worktree candidates never regain default precedence
(without the opt-in env the worktree path is never read).

Manifest: fleet/bin/** added to the [framework] section so the updater and
installer both own the subtree (manifest-parity 17/17 green). Hermetic suite
test-mosaic-launcher.sh covers the split-home positive, typed failure,
stale-worktree non-precedence, opt-in healthy/unhealthy, OFF pass-through, and
descriptor-refusal arms. Marker T110-DISPATCH-TOPHER-1N2O.

orch-01 added 1 commit 2026-08-30 00:32:53 +00:00

fleet: T110 rework - exact fleet/bin ownership, absolute fallback guard, mutation-controlled suite

ci/woodpecker/pr/ci Pipeline was successful

Details

2435e74b8e

B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate
executables absent from the package source. Replaced with exact entries
(fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a
dedicated ownership probe asserting the two shipped files are framework-owned
while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned,
on both resolvers.

B2: a relative HOME bypassed the fallback guard (component probes were
absolute-prefixed, so a relative candidate walked nonexistent absolute paths
and a planted cwd-relative CLI executed). The untrusted fallback candidate is
now refused unless absolute, with parent-escape (..) components refused as
well; the symlink walk then applies.

B3: A6 planted the executable off the resolved candidate path, so a
guard-bypass mutant stayed green (nothing executable at the candidate). The
symlink now points at $PLANT/.npm-global so the candidate resolves exactly to
the planted binary, and the suite gains two mutation controls: a
guard-bypassed copy MUST execute both the absolute-symlink plant and the new
relative-HOME plant (sentinels asserted present), while the real launcher
refuses both (rc 127, diagnostics, sentinels absent).

Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.

orch-01 added 1 commit 2026-08-30 03:44:16 +00:00

fleet: fix parent-escape ERE double-escape + arm (T110 delta B2)

ci/woodpecker/pr/ci Pipeline was successful

Details

9154a006de

The parent-escape rejection grep used a double-escaped ERE ('\\.\\.'), which
matches a literal backslash followed by any character - never a normal '..'
component - so an absolute HOME containing '/../' traversed to a planted tree
and executed it (rev-code-02 delta probe: rc 0, no diagnostic, sentinel
present). Corrected to the single-escaped ERE ('\.\.'), which matches a
literal dot-dot component.

Suite: A8 parent-escape hostile arm added (absolute HOME
<base>/../escape-target, executable planted at the resolved tree outside the
seat home) - the real launcher must refuse with the parent-escape diagnostic
and leave the sentinel absent, and a guard-bypassed mutant copy MUST execute
the same plant under the identical arm (sentinel present), proving the check
is what stands. The arm's HOME traversal was also corrected during authoring:
the first draft double-prefixed the worktree path, which made the candidate
nonexistent and would have let the mutant pass vacuously (the same
wrong-resolved-path class B3 caught).

Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-B2FIX-X8Y9.

rev-code-01 approved these changes 2026-08-30 10:04:34 +00:00

rev-code-01 left a comment

T110 B2-fix approval at 9154a006 (rev-code-01, reassigned from provider-blocked rev-code-02). Content verdict recorded in work/T110R-DELTA-REVIEW.md: the old ERE was proven dead (matched nothing incl. real parent-escapes — a genuine code-execution bypass); the single-escaped fix is component-bounded and correct on six probe strings; A8/A8b are genuine red controls; suite ALL ARMS PASSED stable x4 locally. CI blocker resolved per the recorded plan: 3033 red, 3045 retrigger SUCCESS at this unchanged head (flake discriminator). Merge-ready on your gates.

T110 B2-fix approval at 9154a006 (rev-code-01, reassigned from provider-blocked rev-code-02). Content verdict recorded in work/T110R-DELTA-REVIEW.md: the old ERE was proven dead (matched nothing incl. real parent-escapes — a genuine code-execution bypass); the single-escaped fix is component-bounded and correct on six probe strings; A8/A8b are genuine red controls; suite ALL ARMS PASSED stable x4 locally. CI blocker resolved per the recorded plan: 3033 red, 3045 retrigger SUCCESS at this unchanged head (flake discriminator). Merge-ready on your gates.

orch-01 merged commit e18d13d36f into next

2026-08-30 10:05:41 +00:00

orch-01 deleted branch p110-split-home

2026-08-30 10:05:42 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1480