128 lines
8.3 KiB
Markdown
128 lines
8.3 KiB
Markdown
|
# CUST73 interactive launch revision 3: locked source recipe
|
|||
|
|
|
|||
|
|
Same proposal/trial as r1/r2; original directories remain unchanged. All live
|
|||
|
|
entry scripts have an unconditional refusal before mutation. No import,
|
|||
|
|
distribution startup, package installation, sudo, authentication, listener,
|
|||
|
|
firewall, service or production change was executed. Removing a source lock is
|
|||
|
|
a new exact revision requiring supervisor disposition before execution.
|
|||
|
|
|
|||
|
|
## Fixed inputs and verified evidence
|
|||
|
|
|
|||
|
|
Target: new WSL2 distro `custodian-codex` on `bnt-lap001`, account/group
|
|||
|
|
`custodian-codex` UID/GID1001, private home `/home/custodian-codex`, SSH alias
|
|||
|
|
`custodian-codex-workstation`, candidate loopback TCP22273. A UID/GID collision,
|
|||
|
|
existing distro/storage location or occupied endpoint refuses execution.
|
|||
|
|
Local Windows store is `$env:LOCALAPPDATA\Custodian\WSL\custodian-codex`.
|
|||
|
|
The actual Windows owner/ACL and loopback reachability must be checked, not
|
|||
|
|
inferred from a path. No global `.wslconfig` or existing distro is modified.
|
|||
|
|
|
|||
|
|
Pinned rootfs: Ubuntu24.04.5 AMD64 `.wsl` from
|
|||
|
|
[official release](https://releases.ubuntu.com/24.04.5/), SHA256
|
|||
|
|
`bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e`.
|
|||
|
|
Fetched checksum list and detached signature are retained. `gpgv` verified the
|
|||
|
|
signature with installed Ubuntu cloudimage/archive keyrings, signer
|
|||
|
|
`843938DF228D22F7B3742BC0D94AA3F0EFE21092`. Image bytes were not downloaded;
|
|||
|
|
verify their digest before import. `rootfs.json` records provenance. Ubuntu's
|
|||
|
|
manifest is retained as package information, not independently signed package
|
|||
|
|
closure evidence. It contains Python3 and systemd, but **not openssh-server or
|
|||
|
|
nftables**. Do not claim this image alone can run the recipe.
|
|||
|
|
|
|||
|
|
Pinned installed Codex candidate: 0.163.0, SHA256
|
|||
|
|
`399ff69c431c066e40de318fba45c2b07f45a76b19939d247ee4828fc70c4215`.
|
|||
|
|
`codex-candidate.json` records current user-owned installed binary; publisher
|
|||
|
|
signature/provenance is not established. A trusted artifact must be installed
|
|||
|
|
root-owned at `/usr/local/bin/codex` only after source/transport review. No
|
|||
|
|
operator auth or `.codex` contents are copied. Desktop remote connection may
|
|||
|
|
manage its own executable: confirm which binary it actually launches and bind
|
|||
|
|
that digest; this candidate must not be misrepresented as enforced remotely.
|
|||
|
|
|
|||
|
|
## Files and intended execution sequence after later approval
|
|||
|
|
|
|||
|
|
1. `import-disabled.ps1`: refuses today. Reviewed body validates image SHA and
|
|||
|
|
absent distro/store, then imports only the new name with WSL2. Before enabling,
|
|||
|
|
add exact preflight receipts for Windows owner ACL, free space >=5GiB,
|
|||
|
|
TCP22273 availability, verified WSL version, and native handoff UI support.
|
|||
|
|
Rootfs import is distinct from first boot; no active session is migrated here.
|
|||
|
|
2. Separate package/bootstrap preparation: verify signed Ubuntu apt metadata and
|
|||
|
|
resolve openssh-server/nftables plus dependency closure against this rootfs;
|
|||
|
|
retain exact package names/versions/SHAs and service-install behavior. Package
|
|||
|
|
installation must suppress automatic service startup with a temporary
|
|||
|
|
root-owned `policy-rc.d` returning101, removed only after verified staging.
|
|||
|
|
This closure is an explicit missing input; no unpinned `apt install` is hidden
|
|||
|
|
in the locked script. Transfer reviewed bundle through operator-owned stdin
|
|||
|
|
or artifact channel, not a drive mount made available to the agent.
|
|||
|
|
3. `guest-stage.sh`: refuses today. Intended body verifies root and exact distro,
|
|||
|
|
refuses existing target account/UID/GID, requires dependencies, creates only
|
|||
|
|
UID/GID1001/private home/state, installs wsl/SSH/systemd/nft source. It creates
|
|||
|
|
no key/authentication/launch-approval marker and starts no service. Stage a
|
|||
|
|
fresh root-owned machine identity and pin it in the supervisor receipt.
|
|||
|
|
4. Stop/restart only this new distribution to activate `wsl.conf`; never invoke
|
|||
|
|
global `wsl --shutdown`. Verify effective disabled interop/automount, no shared
|
|||
|
|
host mounts/sockets, and namespace scope before loading any nft rules. WSL
|
|||
|
|
distributions' actual network relationship must be observed: do not apply an
|
|||
|
|
output UID rule if it could affect UID1001 in another guest/network namespace.
|
|||
|
|
5. SSH service source hides host/shared paths for its process tree, retains
|
|||
|
|
native stdio sessions, and uses loopback only. The nft initial policy blocks
|
|||
|
|
new account egress; service requires a root-owned launch approval marker and
|
|||
|
|
separately authorized public key. No agent edits those files. Run `sshd -t`
|
|||
|
|
and `sshd -T`, `nft --check -f`, systemd unit verification, and boot-denial
|
|||
|
|
canaries in the new guest before enabling. These checks were NOT run live.
|
|||
|
|
6. Model/Hub egress remains closed. Resolve exact endpoints and constrain required
|
|||
|
|
outgoing connections without admitting host/admin/private network control
|
|||
|
|
planes; this requires a reviewed egress amendment and credential route. Do
|
|||
|
|
not remove the firewall to make inference work. Login with closed egress is
|
|||
|
|
transport preparation, never completed assignment admission.
|
|||
|
|
7. Install scoped Codex authentication and clean checkout, then operator's native
|
|||
|
|
existing-chat handoff. The [Codex remote connection guide](https://learn.chatgpt.com/docs/remote-connections)
|
|||
|
|
specifies SSH startup and existing-chat handoff; the actual UI availability
|
|||
|
|
answer is pending. Preserve [native approvals](https://learn.chatgpt.com/docs/app-server).
|
|||
|
|
Bind actual tool process identity, chat association and approved/denied action
|
|||
|
|
proofs plus original CUST73 negative checks before declaring isolation.
|
|||
|
|
|
|||
|
|
`verify-guest.py` is deliberately partial: checks identity, group/home/state,
|
|||
|
|
configuration and visible Windows paths only. Its success does not certify
|
|||
|
|
network policy, root sudo policy, other mount paths, cgroup restrictions,
|
|||
|
|
host identity, connector capability scope or assignment admission. Machine-ID
|
|||
|
|
plus UID probe from r2 remains relevant; root-owned marker is not attestation.
|
|||
|
|
|
|||
|
|
## Source-backed design
|
|||
|
|
|
|||
|
|
[Microsoft WSL configuration](https://learn.microsoft.com/en-us/windows/wsl/wsl-config)
|
|||
|
|
documents per-distribution systemd, automount and interop settings. Settings
|
|||
|
|
require restart; disabled automount does not prevent a privileged manual mount.
|
|||
|
|
[Import guide](https://learn.microsoft.com/en-us/windows/wsl/use-custom-distro)
|
|||
|
|
documents named WSL2 import and default root entry. This is why account/boot
|
|||
|
|
controls precede any chat attachment. The SSH service's systemd source adds a
|
|||
|
|
restricted mount view but still needs guest validation, especially Codex's
|
|||
|
|
nested sandbox and foreground app-server lifetime. If it breaks the runtime,
|
|||
|
|
revise exact controls and test; do not disable them silently.
|
|||
|
|
|
|||
|
|
## Approval, estimates and recovery
|
|||
|
|
|
|||
|
|
Expected result of staging: new dormant dedicated guest with reviewed source,
|
|||
|
|
private account and closed egress. Expected result is NOT a working authenticated
|
|||
|
|
Codex assignment. Runtime transport and admission are separately verified steps.
|
|||
|
|
|
|||
|
|
Estimated incremental infrastructure cost EUR0; no model requests in staging.
|
|||
|
|
Budget proposal: <=5GiB initial local storage (image around371MiB), SSH process
|
|||
|
|
tree MemoryMax2GiB/CPUQuota100%/TasksMax256, operator30–60minutes. Actual available
|
|||
|
|
disk/RAM are unverified; package downloads and inference would be separately
|
|||
|
|
bounded. Cost/risk numbers are estimates requiring supervisor acceptance.
|
|||
|
|
Estimated failure recovery30minutes; privileged workstation configuration risk
|
|||
|
|
moderate, production risk low because no production change is proposed. The
|
|||
|
|
main risks are Windows/WSL host escape surfaces, shared networking scope,
|
|||
|
|
unproven runtime compatibility, auth leakage and accidental old-session use.
|
|||
|
|
|
|||
|
|
Rollback: stop work/disconnect the destination, retain receipts, and terminate
|
|||
|
|
only `custodian-codex` after explicit confirmation of its identity. Preserve guest
|
|||
|
|
storage for inspection; never unregister/delete it automatically. Do not resume
|
|||
|
|
assignment tools under old UID1000. Original workstation distro and production
|
|||
|
|
k3s remain unaffected by the proposed target choice. If an existing distribution
|
|||
|
|
or namespace would be modified, stop; the approved scope would no longer match.
|
|||
|
|
|
|||
|
|
Remaining hard inputs before executable approval: UI answer; signed package
|
|||
|
|
closure; trusted actual runtime binary; rootfs byte hash; Windows ACL/disk/port;
|
|||
|
|
namespace/firewall compatibility; scoped auth and egress; full admission tests.
|
|||
|
|
This revision replaces null design choices with concrete files/pins, and leaves
|
|||
|
|
unverified facts explicit rather than filling them with guessed success.
|