the-custodian/docs/changes/CUST-WP-0073/interactive-launch-r3/PROPOSAL.md

CUST73 interactive launch revision 3: locked source recipe

Same proposal/trial as r1/r2; original directories remain unchanged. All live entry scripts have an unconditional refusal before mutation. No import, distribution startup, package installation, sudo, authentication, listener, firewall, service or production change was executed. Removing a source lock is a new exact revision requiring supervisor disposition before execution.

Fixed inputs and verified evidence

Target: new WSL2 distro custodian-codex on bnt-lap001, account/group custodian-codex UID/GID1001, private home /home/custodian-codex, SSH alias custodian-codex-workstation, candidate loopback TCP22273. A UID/GID collision, existing distro/storage location or occupied endpoint refuses execution. Local Windows store is $env:LOCALAPPDATA\Custodian\WSL\custodian-codex. The actual Windows owner/ACL and loopback reachability must be checked, not inferred from a path. No global .wslconfig or existing distro is modified.

Pinned rootfs: Ubuntu24.04.5 AMD64 .wsl from official release, SHA256 bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e. Fetched checksum list and detached signature are retained. gpgv verified the signature with installed Ubuntu cloudimage/archive keyrings, signer 843938DF228D22F7B3742BC0D94AA3F0EFE21092. Image bytes were not downloaded; verify their digest before import. rootfs.json records provenance. Ubuntu's manifest is retained as package information, not independently signed package closure evidence. It contains Python3 and systemd, but not openssh-server or nftables. Do not claim this image alone can run the recipe.

Pinned installed Codex candidate: 0.163.0, SHA256 399ff69c431c066e40de318fba45c2b07f45a76b19939d247ee4828fc70c4215. codex-candidate.json records current user-owned installed binary; publisher signature/provenance is not established. A trusted artifact must be installed root-owned at /usr/local/bin/codex only after source/transport review. No operator auth or .codex contents are copied. Desktop remote connection may manage its own executable: confirm which binary it actually launches and bind that digest; this candidate must not be misrepresented as enforced remotely.

Files and intended execution sequence after later approval

1. import-disabled.ps1: refuses today. Reviewed body validates image SHA and absent distro/store, then imports only the new name with WSL2. Before enabling, add exact preflight receipts for Windows owner ACL, free space >=5GiB, TCP22273 availability, verified WSL version, and native handoff UI support. Rootfs import is distinct from first boot; no active session is migrated here.
2. Separate package/bootstrap preparation: verify signed Ubuntu apt metadata and resolve openssh-server/nftables plus dependency closure against this rootfs; retain exact package names/versions/SHAs and service-install behavior. Package installation must suppress automatic service startup with a temporary root-owned policy-rc.d returning101, removed only after verified staging. This closure is an explicit missing input; no unpinned apt install is hidden in the locked script. Transfer reviewed bundle through operator-owned stdin or artifact channel, not a drive mount made available to the agent.
3. guest-stage.sh: refuses today. Intended body verifies root and exact distro, refuses existing target account/UID/GID, requires dependencies, creates only UID/GID1001/private home/state, installs wsl/SSH/systemd/nft source. It creates no key/authentication/launch-approval marker and starts no service. Stage a fresh root-owned machine identity and pin it in the supervisor receipt.
4. Stop/restart only this new distribution to activate wsl.conf; never invoke global wsl --shutdown. Verify effective disabled interop/automount, no shared host mounts/sockets, and namespace scope before loading any nft rules. WSL distributions' actual network relationship must be observed: do not apply an output UID rule if it could affect UID1001 in another guest/network namespace.
5. SSH service source hides host/shared paths for its process tree, retains native stdio sessions, and uses loopback only. The nft initial policy blocks new account egress; service requires a root-owned launch approval marker and separately authorized public key. No agent edits those files. Run sshd -t and sshd -T, nft --check -f, systemd unit verification, and boot-denial canaries in the new guest before enabling. These checks were NOT run live.
6. Model/Hub egress remains closed. Resolve exact endpoints and constrain required outgoing connections without admitting host/admin/private network control planes; this requires a reviewed egress amendment and credential route. Do not remove the firewall to make inference work. Login with closed egress is transport preparation, never completed assignment admission.
7. Install scoped Codex authentication and clean checkout, then operator's native existing-chat handoff. The Codex remote connection guide specifies SSH startup and existing-chat handoff; the actual UI availability answer is pending. Preserve native approvals. Bind actual tool process identity, chat association and approved/denied action proofs plus original CUST73 negative checks before declaring isolation.

verify-guest.py is deliberately partial: checks identity, group/home/state, configuration and visible Windows paths only. Its success does not certify network policy, root sudo policy, other mount paths, cgroup restrictions, host identity, connector capability scope or assignment admission. Machine-ID plus UID probe from r2 remains relevant; root-owned marker is not attestation.

Source-backed design

Microsoft WSL configuration documents per-distribution systemd, automount and interop settings. Settings require restart; disabled automount does not prevent a privileged manual mount. Import guide documents named WSL2 import and default root entry. This is why account/boot controls precede any chat attachment. The SSH service's systemd source adds a restricted mount view but still needs guest validation, especially Codex's nested sandbox and foreground app-server lifetime. If it breaks the runtime, revise exact controls and test; do not disable them silently.

Approval, estimates and recovery

Expected result of staging: new dormant dedicated guest with reviewed source, private account and closed egress. Expected result is NOT a working authenticated Codex assignment. Runtime transport and admission are separately verified steps.

Estimated incremental infrastructure cost EUR0; no model requests in staging. Budget proposal: <=5GiB initial local storage (image around371MiB), SSH process tree MemoryMax2GiB/CPUQuota100%/TasksMax256, operator30–60minutes. Actual available disk/RAM are unverified; package downloads and inference would be separately bounded. Cost/risk numbers are estimates requiring supervisor acceptance. Estimated failure recovery30minutes; privileged workstation configuration risk moderate, production risk low because no production change is proposed. The main risks are Windows/WSL host escape surfaces, shared networking scope, unproven runtime compatibility, auth leakage and accidental old-session use.

Rollback: stop work/disconnect the destination, retain receipts, and terminate only custodian-codex after explicit confirmation of its identity. Preserve guest storage for inspection; never unregister/delete it automatically. Do not resume assignment tools under old UID1000. Original workstation distro and production k3s remain unaffected by the proposed target choice. If an existing distribution or namespace would be modified, stop; the approved scope would no longer match.

Remaining hard inputs before executable approval: UI answer; signed package closure; trusted actual runtime binary; rootfs byte hash; Windows ACL/disk/port; namespace/firewall compatibility; scoped auth and egress; full admission tests. This revision replaces null design choices with concrete files/pins, and leaves unverified facts explicit rather than filling them with guessed success.