127 lines
8.3 KiB
Markdown
127 lines
8.3 KiB
Markdown
# CUST73 interactive launch revision 3: locked source recipe
|
||
|
||
Same proposal/trial as r1/r2; original directories remain unchanged. All live
|
||
entry scripts have an unconditional refusal before mutation. No import,
|
||
distribution startup, package installation, sudo, authentication, listener,
|
||
firewall, service or production change was executed. Removing a source lock is
|
||
a new exact revision requiring supervisor disposition before execution.
|
||
|
||
## Fixed inputs and verified evidence
|
||
|
||
Target: new WSL2 distro `custodian-codex` on `bnt-lap001`, account/group
|
||
`custodian-codex` UID/GID1001, private home `/home/custodian-codex`, SSH alias
|
||
`custodian-codex-workstation`, candidate loopback TCP22273. A UID/GID collision,
|
||
existing distro/storage location or occupied endpoint refuses execution.
|
||
Local Windows store is `$env:LOCALAPPDATA\Custodian\WSL\custodian-codex`.
|
||
The actual Windows owner/ACL and loopback reachability must be checked, not
|
||
inferred from a path. No global `.wslconfig` or existing distro is modified.
|
||
|
||
Pinned rootfs: Ubuntu24.04.5 AMD64 `.wsl` from
|
||
[official release](https://releases.ubuntu.com/24.04.5/), SHA256
|
||
`bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e`.
|
||
Fetched checksum list and detached signature are retained. `gpgv` verified the
|
||
signature with installed Ubuntu cloudimage/archive keyrings, signer
|
||
`843938DF228D22F7B3742BC0D94AA3F0EFE21092`. Image bytes were not downloaded;
|
||
verify their digest before import. `rootfs.json` records provenance. Ubuntu's
|
||
manifest is retained as package information, not independently signed package
|
||
closure evidence. It contains Python3 and systemd, but **not openssh-server or
|
||
nftables**. Do not claim this image alone can run the recipe.
|
||
|
||
Pinned installed Codex candidate: 0.163.0, SHA256
|
||
`399ff69c431c066e40de318fba45c2b07f45a76b19939d247ee4828fc70c4215`.
|
||
`codex-candidate.json` records current user-owned installed binary; publisher
|
||
signature/provenance is not established. A trusted artifact must be installed
|
||
root-owned at `/usr/local/bin/codex` only after source/transport review. No
|
||
operator auth or `.codex` contents are copied. Desktop remote connection may
|
||
manage its own executable: confirm which binary it actually launches and bind
|
||
that digest; this candidate must not be misrepresented as enforced remotely.
|
||
|
||
## Files and intended execution sequence after later approval
|
||
|
||
1. `import-disabled.ps1`: refuses today. Reviewed body validates image SHA and
|
||
absent distro/store, then imports only the new name with WSL2. Before enabling,
|
||
add exact preflight receipts for Windows owner ACL, free space >=5GiB,
|
||
TCP22273 availability, verified WSL version, and native handoff UI support.
|
||
Rootfs import is distinct from first boot; no active session is migrated here.
|
||
2. Separate package/bootstrap preparation: verify signed Ubuntu apt metadata and
|
||
resolve openssh-server/nftables plus dependency closure against this rootfs;
|
||
retain exact package names/versions/SHAs and service-install behavior. Package
|
||
installation must suppress automatic service startup with a temporary
|
||
root-owned `policy-rc.d` returning101, removed only after verified staging.
|
||
This closure is an explicit missing input; no unpinned `apt install` is hidden
|
||
in the locked script. Transfer reviewed bundle through operator-owned stdin
|
||
or artifact channel, not a drive mount made available to the agent.
|
||
3. `guest-stage.sh`: refuses today. Intended body verifies root and exact distro,
|
||
refuses existing target account/UID/GID, requires dependencies, creates only
|
||
UID/GID1001/private home/state, installs wsl/SSH/systemd/nft source. It creates
|
||
no key/authentication/launch-approval marker and starts no service. Stage a
|
||
fresh root-owned machine identity and pin it in the supervisor receipt.
|
||
4. Stop/restart only this new distribution to activate `wsl.conf`; never invoke
|
||
global `wsl --shutdown`. Verify effective disabled interop/automount, no shared
|
||
host mounts/sockets, and namespace scope before loading any nft rules. WSL
|
||
distributions' actual network relationship must be observed: do not apply an
|
||
output UID rule if it could affect UID1001 in another guest/network namespace.
|
||
5. SSH service source hides host/shared paths for its process tree, retains
|
||
native stdio sessions, and uses loopback only. The nft initial policy blocks
|
||
new account egress; service requires a root-owned launch approval marker and
|
||
separately authorized public key. No agent edits those files. Run `sshd -t`
|
||
and `sshd -T`, `nft --check -f`, systemd unit verification, and boot-denial
|
||
canaries in the new guest before enabling. These checks were NOT run live.
|
||
6. Model/Hub egress remains closed. Resolve exact endpoints and constrain required
|
||
outgoing connections without admitting host/admin/private network control
|
||
planes; this requires a reviewed egress amendment and credential route. Do
|
||
not remove the firewall to make inference work. Login with closed egress is
|
||
transport preparation, never completed assignment admission.
|
||
7. Install scoped Codex authentication and clean checkout, then operator's native
|
||
existing-chat handoff. The [Codex remote connection guide](https://learn.chatgpt.com/docs/remote-connections)
|
||
specifies SSH startup and existing-chat handoff; the actual UI availability
|
||
answer is pending. Preserve [native approvals](https://learn.chatgpt.com/docs/app-server).
|
||
Bind actual tool process identity, chat association and approved/denied action
|
||
proofs plus original CUST73 negative checks before declaring isolation.
|
||
|
||
`verify-guest.py` is deliberately partial: checks identity, group/home/state,
|
||
configuration and visible Windows paths only. Its success does not certify
|
||
network policy, root sudo policy, other mount paths, cgroup restrictions,
|
||
host identity, connector capability scope or assignment admission. Machine-ID
|
||
plus UID probe from r2 remains relevant; root-owned marker is not attestation.
|
||
|
||
## Source-backed design
|
||
|
||
[Microsoft WSL configuration](https://learn.microsoft.com/en-us/windows/wsl/wsl-config)
|
||
documents per-distribution systemd, automount and interop settings. Settings
|
||
require restart; disabled automount does not prevent a privileged manual mount.
|
||
[Import guide](https://learn.microsoft.com/en-us/windows/wsl/use-custom-distro)
|
||
documents named WSL2 import and default root entry. This is why account/boot
|
||
controls precede any chat attachment. The SSH service's systemd source adds a
|
||
restricted mount view but still needs guest validation, especially Codex's
|
||
nested sandbox and foreground app-server lifetime. If it breaks the runtime,
|
||
revise exact controls and test; do not disable them silently.
|
||
|
||
## Approval, estimates and recovery
|
||
|
||
Expected result of staging: new dormant dedicated guest with reviewed source,
|
||
private account and closed egress. Expected result is NOT a working authenticated
|
||
Codex assignment. Runtime transport and admission are separately verified steps.
|
||
|
||
Estimated incremental infrastructure cost EUR0; no model requests in staging.
|
||
Budget proposal: <=5GiB initial local storage (image around371MiB), SSH process
|
||
tree MemoryMax2GiB/CPUQuota100%/TasksMax256, operator30–60minutes. Actual available
|
||
disk/RAM are unverified; package downloads and inference would be separately
|
||
bounded. Cost/risk numbers are estimates requiring supervisor acceptance.
|
||
Estimated failure recovery30minutes; privileged workstation configuration risk
|
||
moderate, production risk low because no production change is proposed. The
|
||
main risks are Windows/WSL host escape surfaces, shared networking scope,
|
||
unproven runtime compatibility, auth leakage and accidental old-session use.
|
||
|
||
Rollback: stop work/disconnect the destination, retain receipts, and terminate
|
||
only `custodian-codex` after explicit confirmation of its identity. Preserve guest
|
||
storage for inspection; never unregister/delete it automatically. Do not resume
|
||
assignment tools under old UID1000. Original workstation distro and production
|
||
k3s remain unaffected by the proposed target choice. If an existing distribution
|
||
or namespace would be modified, stop; the approved scope would no longer match.
|
||
|
||
Remaining hard inputs before executable approval: UI answer; signed package
|
||
closure; trusted actual runtime binary; rootfs byte hash; Windows ACL/disk/port;
|
||
namespace/firewall compatibility; scoped auth and egress; full admission tests.
|
||
This revision replaces null design choices with concrete files/pins, and leaves
|
||
unverified facts explicit rather than filling them with guessed success.
|