fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side)

Conversation 0 Commits 3 Files Changed 4

+368

3 Commits

Author	SHA1	Message	Date
topher	9154a006de	fleet: fix parent-escape ERE double-escape + arm (T110 delta B2) ci/woodpecker/pr/ci Pipeline was successful Details The parent-escape rejection grep used a double-escaped ERE ('\\.\\.'), which matches a literal backslash followed by any character - never a normal '..' component - so an absolute HOME containing '/../' traversed to a planted tree and executed it (rev-code-02 delta probe: rc 0, no diagnostic, sentinel present). Corrected to the single-escaped ERE ('\.\.'), which matches a literal dot-dot component. Suite: A8 parent-escape hostile arm added (absolute HOME <base>/../escape-target, executable planted at the resolved tree outside the seat home) - the real launcher must refuse with the parent-escape diagnostic and leave the sentinel absent, and a guard-bypassed mutant copy MUST execute the same plant under the identical arm (sentinel present), proving the check is what stands. The arm's HOME traversal was also corrected during authoring: the first draft double-prefixed the worktree path, which made the candidate nonexistent and would have let the mutant pass vacuously (the same wrong-resolved-path class B3 caught). Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-B2FIX-X8Y9.	2026-08-29 22:42:21 -05:00
topher	2435e74b8e	fleet: T110 rework - exact fleet/bin ownership, absolute fallback guard, mutation-controlled suite ci/woodpecker/pr/ci Pipeline was successful Details B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate executables absent from the package source. Replaced with exact entries (fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a dedicated ownership probe asserting the two shipped files are framework-owned while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned, on both resolvers. B2: a relative HOME bypassed the fallback guard (component probes were absolute-prefixed, so a relative candidate walked nonexistent absolute paths and a planted cwd-relative CLI executed). The untrusted fallback candidate is now refused unless absolute, with parent-escape (..) components refused as well; the symlink walk then applies. B3: A6 planted the executable off the resolved candidate path, so a guard-bypass mutant stayed green (nothing executable at the candidate). The symlink now points at $PLANT/.npm-global so the candidate resolves exactly to the planted binary, and the suite gains two mutation controls: a guard-bypassed copy MUST execute both the absolute-symlink plant and the new relative-HOME plant (sentinels asserted present), while the real launcher refuses both (rc 127, diagnostics, sentinels absent). Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.	2026-08-29 19:30:23 -05:00
topher	7e9e013f92	fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side) ci/woodpecker/pr/ci Pipeline was canceled Details Ships fleet/bin/mosaic in the framework so the T106 shipped-first launcher contract survives split-home layouts. The shipped npm mosaic resolves from the passwd real home instead of $HOME: under a seat home (HOME=seat dir) the operator's npm prefix is still found, so 'HOME=<seat-home> fleet/bin/mosaic --version' returns the shipped version. The $HOME/.npm-global candidate is consulted only when the passwd lookup fails, and then every path component must be a non-symlink (secure descriptor traversal; a planted descriptor is refused without execution). T106 behavior preserved verbatim: worktree builds are MOSAIC_CLI_WORKTREE opt-in only, health-checked, shipped fallback on doubt; MOSAIC_FLEET_CLI_OFF forces pure pass-through; no runnable candidate exits 127 with the documented stderr line; stale worktree candidates never regain default precedence (without the opt-in env the worktree path is never read). Manifest: fleet/bin/** added to the [framework] section so the updater and installer both own the subtree (manifest-parity 17/17 green). Hermetic suite test-mosaic-launcher.sh covers the split-home positive, typed failure, stale-worktree non-precedence, opt-in healthy/unhealthy, OFF pass-through, and descriptor-refusal arms. Marker T110-DISPATCH-TOPHER-1N2O.	2026-08-29 19:14:28 -05:00

Author

SHA1

Message

Date

topher

9154a006de

fleet: fix parent-escape ERE double-escape + arm (T110 delta B2)

ci/woodpecker/pr/ci Pipeline was successful

Details

The parent-escape rejection grep used a double-escaped ERE ('\\.\\.'), which
matches a literal backslash followed by any character - never a normal '..'
component - so an absolute HOME containing '/../' traversed to a planted tree
and executed it (rev-code-02 delta probe: rc 0, no diagnostic, sentinel
present). Corrected to the single-escaped ERE ('\.\.'), which matches a
literal dot-dot component.

Suite: A8 parent-escape hostile arm added (absolute HOME
<base>/../escape-target, executable planted at the resolved tree outside the
seat home) - the real launcher must refuse with the parent-escape diagnostic
and leave the sentinel absent, and a guard-bypassed mutant copy MUST execute
the same plant under the identical arm (sentinel present), proving the check
is what stands. The arm's HOME traversal was also corrected during authoring:
the first draft double-prefixed the worktree path, which made the candidate
nonexistent and would have let the mutant pass vacuously (the same
wrong-resolved-path class B3 caught).

Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-B2FIX-X8Y9.

2026-08-29 22:42:21 -05:00

topher

2435e74b8e

fleet: T110 rework - exact fleet/bin ownership, absolute fallback guard, mutation-controlled suite

ci/woodpecker/pr/ci Pipeline was successful

Details

B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate
executables absent from the package source. Replaced with exact entries
(fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a
dedicated ownership probe asserting the two shipped files are framework-owned
while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned,
on both resolvers.

B2: a relative HOME bypassed the fallback guard (component probes were
absolute-prefixed, so a relative candidate walked nonexistent absolute paths
and a planted cwd-relative CLI executed). The untrusted fallback candidate is
now refused unless absolute, with parent-escape (..) components refused as
well; the symlink walk then applies.

B3: A6 planted the executable off the resolved candidate path, so a
guard-bypass mutant stayed green (nothing executable at the candidate). The
symlink now points at $PLANT/.npm-global so the candidate resolves exactly to
the planted binary, and the suite gains two mutation controls: a
guard-bypassed copy MUST execute both the absolute-symlink plant and the new
relative-HOME plant (sentinels asserted present), while the real launcher
refuses both (rc 127, diagnostics, sentinels absent).

Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.

2026-08-29 19:30:23 -05:00

topher

7e9e013f92

fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side)

ci/woodpecker/pr/ci Pipeline was canceled

Details

Ships fleet/bin/mosaic in the framework so the T106 shipped-first launcher
contract survives split-home layouts. The shipped npm mosaic resolves from the
passwd real home instead of $HOME: under a seat home (HOME=seat dir) the
operator's npm prefix is still found, so 'HOME=<seat-home> fleet/bin/mosaic
--version' returns the shipped version. The $HOME/.npm-global candidate is
consulted only when the passwd lookup fails, and then every path component
must be a non-symlink (secure descriptor traversal; a planted descriptor is
refused without execution).

T106 behavior preserved verbatim: worktree builds are MOSAIC_CLI_WORKTREE
opt-in only, health-checked, shipped fallback on doubt; MOSAIC_FLEET_CLI_OFF
forces pure pass-through; no runnable candidate exits 127 with the documented
stderr line; stale worktree candidates never regain default precedence
(without the opt-in env the worktree path is never read).

Manifest: fleet/bin/** added to the [framework] section so the updater and
installer both own the subtree (manifest-parity 17/17 green). Hermetic suite
test-mosaic-launcher.sh covers the split-home positive, typed failure,
stale-worktree non-precedence, opt-in healthy/unhealthy, OFF pass-through, and
descriptor-refusal arms. Marker T110-DISPATCH-TOPHER-1N2O.

2026-08-29 19:14:28 -05:00

fleet: split-home-safe mosaic launcher (T110, P5-RM-009 stack side) #1480