200 lines
13 KiB
Markdown
200 lines
13 KiB
Markdown
# Install and verify the immutable Glas/rein runtime on railiance01
|
|
|
|
Proposal ID: **REINAH-WP-0008-T07-install-f599-r1**, revision **1**.
|
|
Status: **pending root review and exact founder approval; no native mutation**.
|
|
This is a separately reviewable installation step under existing T07. It does
|
|
not require completing the paid-attempt envelope because it uses no provider,
|
|
worker credential, owner/spend configuration, catalog change or queue action.
|
|
It does not activate the artifact or complete T07, GLAS-WP-0012-T03/T04, the
|
|
current Custodian assignment migration or TSA-06.
|
|
|
|
## Exact action and target
|
|
|
|
After root retains this exact revision and the supervisor's disposition, run:
|
|
|
|
```bash
|
|
python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply
|
|
```
|
|
|
|
The same file's default/`--dry-run` is read-only. `--apply` refuses any existing
|
|
local execution receipt, so a failed/uncertain attempt cannot be rerun blindly.
|
|
There is no scheduling, continuous claim loop, profile readiness override,
|
|
credential acquisition, provider request, owner renewal or service restart.
|
|
|
|
| Input | Exact value |
|
|
|---|---|
|
|
| Host | existing SSH alias railiance01; Kubernetes node must be Ready at 92.205.62.239 |
|
|
| Account | tegwick, UID/GID 1000, home /home/tegwick |
|
|
| Existing protected store | /home/tegwick/.helixforge-factory/runtimes, mode 0700, device 2049, inode 4751222 |
|
|
| New destination | /home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
|
|
| Complete runtime digest | sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
|
|
| Retained source artifact | /tmp/netkingdom-runtime-canonical-20261016/runtime |
|
|
| Exact new owned staging | /home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017 |
|
|
| Transfer archive | deterministic gzip/PAX tar, 109,931,109 bytes, 1,448 members |
|
|
| Transfer SHA-256 | sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7 |
|
|
| Logical regular-file bytes | 260,668,241; one retained internal relative symlink, lib64 → lib |
|
|
|
|
`action-inputs.json` freezes every executable/helper hash and archive input.
|
|
`artifact-manifest.json` binds this proposal and all retained review evidence.
|
|
Only the three named payload files go into remote staging: runtime.tar.gz,
|
|
runtime.py and install-verified.py. The workstation archive is regenerated
|
|
privately from the exact source only at execution, checked against the frozen
|
|
archive hash, transferred, and removed from its local temporary directory.
|
|
No large runtime archive or new source build is committed to this repository.
|
|
|
|
## Existing owner contract and actual observations
|
|
|
|
Sand-boxer `docs/bwrap-runtime.md` explicitly separates protected artifact
|
|
installation from profile selection, credentials, network activation and schedules.
|
|
The existing `runtime_store.install_runtime` verifies source, checks the owned
|
|
store and lock, copies symlinks/modes into its own private staging, verifies the
|
|
copy and atomically publishes under its digest. It never replaces an existing
|
|
artifact. This proposal uses that exact implementation already in f599; it does
|
|
not introduce another store or installer service. Remote owner source checkouts
|
|
are absent, so the pinned public digest reader/driver travel with the artifact.
|
|
|
|
Exact installed component hashes:
|
|
|
|
- sandboxer runtime.py: sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412
|
|
- sandboxer runtime_store.py: sha256:c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf
|
|
- rein owner_rehearsal.py: sha256:192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3
|
|
|
|
Runtime/store components match both the artifact's sandboxer `221126cb` and
|
|
current owner source `53f800c4`; the rehearsal matches artifact rein `9b88cadaa8`.
|
|
The complete build includes Glas `7357115c` and llm-connect `37436bb5` from the
|
|
previously reviewed immutable build. Reuse its actual manager/gateway proof for
|
|
isolation/workload-delivery mechanics; no deterministic proof is relabelled a
|
|
real model call. The new action proves native installation and free launch only.
|
|
|
|
Read-only target evidence verifies the expected account/node, safe home/factory/
|
|
store/lock modes and absent destination/staging. Four older digest directories
|
|
remain in the store, including b6e4e8a4; this action does not select, overwrite,
|
|
remove or execute them. Pinned native executables are /usr/bin/python3 (3.12.3),
|
|
/usr/local/bin/kubectl for the node read and /usr/bin/bwrap. No private owner/config/auth files were opened by these observations.
|
|
|
|
The final read-only dry-run at **2026-10-17 02:35:19 UTC** passed all guards:
|
|
about 124.21GB free disk, 7.65GB available memory, one-second CPU busy fraction
|
|
0.5852 and one-minute load 5.06 across four CPUs. Earlier observations found
|
|
99.5% busy CPU and a dry-run refusal at load 12.60; those remain retained. A
|
|
passing snapshot is not a reservation or a promise of future headroom.
|
|
|
|
## Exact execution and refusal behavior
|
|
|
|
1. Verify every local helper hash and the complete source artifact digest.
|
|
Read target metadata only; require the exact existing store device/inode,
|
|
expected UID/GID/modes and Ready node/IP. Require both new paths absent,
|
|
at least 2GiB free disk and 1GiB available memory, one-minute load ≤8 on four
|
|
CPUs, and CPU busy ≤85% in one bounded one-second sample. Refuse on drift;
|
|
no polling or mutation follows a failed gate.
|
|
2. Write the local attempt intent before native staging. Recreate and verify
|
|
the exact deterministic archive locally. Recheck CPU and exact store metadata
|
|
before exclusive creation of the named 0700 remote staging directory. Record
|
|
its actual device/inode in the local receipt before uploading anything.
|
|
3. SCP only the archive and two public helpers. The fixed SSH bootstrap verifies
|
|
the exact directory identity, complete three-file inventory, regular-file
|
|
owner and all three payload hashes; it sets those owned public payload files
|
|
to 0600. Then it execs the hashed install helper with a cleared application
|
|
environment. Existing SSH authentication is transport only; no key is fetched,
|
|
copied into the workload or exposed in evidence.
|
|
4. The helper rechecks identity/headroom, lowers its scheduling priority to nice
|
|
19, verifies archive hash/size and every member name/type/mode/count/size,
|
|
rejects hardlinks/special/escaping members, extracts directories/files before
|
|
internal relative symlinks and checks the complete extracted digest. It does
|
|
not restore archive owners or execute a tar-supplied command. All created
|
|
files belong to tegwick. A local temporary roundtrip independently passed
|
|
that extraction and the exact final runtime digest, with modes/symlink intact.
|
|
5. The staged candidate interpreter with `-I -B` imports and hash-checks its
|
|
existing owner runtime/store modules, then calls existing install_runtime
|
|
under a 180-second alarm. No new package resolution/download occurs. The
|
|
existing helper holds its normal lock and cleans its own temporary copy on
|
|
ordinary exception, then atomically appends the verified new digest. Refuse
|
|
if the destination appeared, even if somebody installed identical bytes;
|
|
no existing install is silently adopted as this action's success.
|
|
6. Rehash the complete native destination. Execute only the installed artifact's
|
|
existing owner_rehearsal.rehearse directly, independent of owner.json,
|
|
SpendPolicy or ledger state. It launches rein-aharness --help,
|
|
glas-harness --help and Claude --version inside empty-egress bwrap, each with
|
|
a 60-second timeout and discarded command output; the phase has a 240-second
|
|
alarm. Require exactly those three zero exits. No model/task command or
|
|
credential route is constructed. Child environment is cleared; host HOME
|
|
and credentials are not mounted. These ephemeral namespaces create no
|
|
SandboxManager record, persistent worker, model session or provider lease.
|
|
7. Rehash the entire installed tree after rehearsal and remove only the exact
|
|
owned staging directory after device/inode/owner/mode and known-inventory
|
|
checks. Capture the final structured result in this packet's
|
|
execution-receipt.json. SSH closes when the foreground helper exits.
|
|
|
|
The rehearsal is the existing credential-free source API, not metered-once
|
|
--rehearse against a private old owner configuration. This avoids changing pins
|
|
or reading a ledger merely to validate an inactive artifact. It neither changes
|
|
nor bypasses the normal future runtime/profile/spend/credential admission path.
|
|
|
|
## Expected result, cost and risk
|
|
|
|
Success is `installed_and_offline_rehearsal_verified`, with actual install result,
|
|
owner UID/store mode, extracted/installed/post-rehearsal full digest equality,
|
|
three explicit launcher exit codes and staging absence. Destination remains a
|
|
dormant append. Profile and credential flags stay false; provider calls are zero.
|
|
No current owner/catalog/queue/definition/profile bytes are read or changed by the
|
|
installation action. T07's spend acceptance, owner renewal and real-model/native
|
|
approvals remain separate.
|
|
|
|
Persistent addition is about 261MB of logical file data plus filesystem metadata.
|
|
Transfer is about 110MB. Extraction/copy temporarily add two artifact-sized trees
|
|
plus the archive; the 2GiB free-disk requirement includes operating margin. Hashing
|
|
and copy are sequential and lower priority, but a snapshot gate cannot guarantee
|
|
that shared-host CPU/IO remains idle throughout execution.
|
|
|
|
Requested provider spend is USD 0: no provider API exists in this action. No new
|
|
paid resource or recurring service is committed. Incremental infrastructure,
|
|
energy and human recovery time in EUR are **unknown**, not zero. Credible EUR
|
|
loss from unexpected shared single-node IO/resource interruption is also unknown.
|
|
Approval must explicitly cover this small supervised append/rehearsal exposure;
|
|
this proposal grants no autonomous budget or autopilot authority. Root may defer
|
|
execution until the fresh headroom gate passes without weakening its thresholds.
|
|
|
|
## Cleanup, rollback and uncertainty
|
|
|
|
Normal success/failure after verified stage identity removes only the owned
|
|
staging tree. Unexpected directory identity or top-level objects stop cleanup;
|
|
they are not swept. The local attempt intent retains remote staging device/inode
|
|
before transfer. A transfer/bootstrap failure before remote helper execution may
|
|
leave that exact staging: root can review the recorded identity and remove only
|
|
its known upload files after confirming no execution started. The exact
|
|
conditional command is `python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py --apply`; it requires the local receipt
|
|
phase before_transfer, matching remote inode/device/owner/mode, only named
|
|
regular upload files and no extracted runtime. It refuses every later phase. An SSH timeout or
|
|
lost final reply after `remote_execution_started` is an uncertain outcome; do not
|
|
replay --apply or delete staging while the helper may still be running. First
|
|
confirm exact process quiescence, then inspect destination digest/stage identity
|
|
read-only and reconcile under the same proposal. The 600-second outer SSH timeout
|
|
is not proof that a disconnected remote process stopped.
|
|
|
|
The existing installer cleans its private `.install-*` copy on ordinary Python
|
|
failure. Hard host/process loss may leave it; do not glob-delete store staging
|
|
or infer ownership from the prefix. Preserve exact baseline/new-object metadata
|
|
and request attended owner recovery for anything not tied to this attempt.
|
|
|
|
Rollback does not restore owner/catalog configuration because this action never
|
|
changes it. Keep every older artifact and the newly installed immutable artifact
|
|
as dormant evidence; removal of a published digest is not part of existing
|
|
installer rollback and is not authorized here. If installation succeeds but
|
|
rehearsal fails, record that partial outcome, retain the inactive artifact and
|
|
staging cleanup facts, and stop. No automatic profile selection, in-place repair,
|
|
artifact deletion, credential/provider retry or follow-up service action follows.
|
|
|
|
## Review evidence
|
|
|
|
- action-inputs.json: fixed argv/paths/helper hashes/archive/components/guards.
|
|
- target-readonly-observation.json and target-readonly-addendum.json: actual
|
|
target/account/store/node/absence and Python/bwrap observations.
|
|
- cpu-readonly-observation.json and retained-headroom-refusal.json: earlier
|
|
saturation/refusal, retained separately from the later passing snapshot.
|
|
- final-readonly-dry-run.json: actual final helper's read-only result, zero writes.
|
|
- local-transfer-verification.json: deterministic archive and complete local
|
|
extraction digest/mode/symlink roundtrip, removed local temporary tree.
|
|
|
|
Root must review/freeze the proposal/manifest digest, retain it in the existing
|
|
supervision trial, obtain the exact founder disposition and only then invoke the
|
|
--apply command. No native staging, install, launcher execution, owner change or
|
|
paid call has happened during this preparation.
|