the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md

Install and verify the immutable Glas/rein runtime on railiance01

Proposal ID: REINAH-WP-0008-T07-install-f599-r1, revision 2. Status: pending root review and exact founder approval; no native mutation. R1 remains frozen, unapproved and unexecuted. This is revision 2 of the same proposal/trial, addressing root review of descendant cleanup. This is a separately reviewable installation step under existing T07. It does not require completing the paid-attempt envelope because it uses no provider, worker credential, owner/spend configuration, catalog change or queue action. It does not activate the artifact or complete T07, GLAS-WP-0012-T03/T04, the current Custodian assignment migration or TSA-06.

Exact action and target

After root retains this exact revision and the supervisor's disposition, run:

python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py --apply

The same file's default/--dry-run is read-only. --apply refuses any existing local execution receipt, so a failed/uncertain attempt cannot be rerun blindly. There is no scheduling, continuous claim loop, profile readiness override, credential acquisition, provider request, owner renewal or service restart.

Input	Exact value
Host	existing SSH alias railiance01; Kubernetes node must be Ready at 92.205.62.239
Account	tegwick, UID/GID 1000, home /home/tegwick
Existing protected store	/home/tegwick/.helixforge-factory/runtimes, mode 0700, device 2049, inode 4751222
New destination	/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
Complete runtime digest	sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
Retained source artifact	/tmp/netkingdom-runtime-canonical-20261016/runtime
Exact new owned staging	/home/tegwick/.helixforge-factory/runtime-install-f599-r2-20261017
Transfer archive	deterministic gzip/PAX tar, 109,931,109 bytes, 1,448 members
Transfer SHA-256	sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7
Logical regular-file bytes	260,668,241; one retained internal relative symlink, lib64 → lib

action-inputs.json freezes every executable/helper hash and archive input. artifact-manifest.json binds this proposal and all retained review evidence. Only four named payload files go into remote staging: runtime.tar.gz, runtime.py, install-verified.py and process_supervision.py. The private one-action watchdog and its JSON receipts exist beneath that staging only; they create no service, schedule or persistent control plane. The workstation archive is regenerated privately from the exact source only at execution, checked against the frozen archive hash, transferred, and removed from its local temporary directory. No large runtime archive or new source build is committed to this repository.

Existing owner contract and actual observations

Sand-boxer docs/bwrap-runtime.md explicitly separates protected artifact installation from profile selection, credentials, network activation and schedules. The existing runtime_store.install_runtime verifies source, checks the owned store and lock, copies symlinks/modes into its own private staging, verifies the copy and atomically publishes under its digest. It never replaces an existing artifact. This proposal uses that exact implementation already in f599; it does not introduce another store or installer service. Remote owner source checkouts are absent, so the pinned public digest reader/driver travel with the artifact.

Exact installed component hashes:

• sandboxer runtime.py: sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412
• sandboxer runtime_store.py: sha256:c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf
• rein owner_rehearsal.py: sha256:192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3

Runtime/store components match both the artifact's sandboxer 221126cb and current owner source 53f800c4; the rehearsal matches artifact rein 9b88cadaa8. The complete build includes Glas 7357115c and llm-connect 37436bb5 from the previously reviewed immutable build. Reuse its actual manager/gateway proof for isolation/workload-delivery mechanics; no deterministic proof is relabelled a real model call. The new action proves native installation and free launch only.

Read-only target evidence verifies the expected account/node, safe home/factory/ store/lock modes and absent destination/staging. Four older digest directories remain in the store, including b6e4e8a4; this action does not select, overwrite, remove or execute them. Pinned native executables are /usr/bin/python3 (3.12.3), /usr/local/bin/kubectl for the node read and /usr/bin/bwrap. No private owner/config/auth files were opened by these observations.

The R2 read-only dry-run at 2026-10-17 06:01:35 UTC passed all guards: 123,352,678,400 free disk bytes, 7,735,549,952 available memory bytes, one-second CPU busy fraction 0.2832 and one-minute load 1.9634 across four CPUs. The new R2 staging and destination were absent. Earlier R1 target observations and headroom refusal remain copied as explicitly historical evidence; only final-readonly-dry-run.json records this R2 controller. A passing snapshot is not a reservation. All guards run again before any approved attempt.

The target's installed bubblewrap 0.9.0 help supports --die-with-parent. Its installed upstream manual states that it kills all sandbox processes when bwrap or its parent dies, using PR_SET_PDEATHSIG. The R2 dry-run records the manual excerpt plus successful pidfd-open and PR_GET_CHILD_SUBREAPER readback. No target namespace or runtime was launched to obtain this evidence.

Exact execution and refusal behavior

1. Verify every local helper hash and the complete source artifact digest. Read target metadata only; require the exact existing store device/inode, expected UID/GID/modes and Ready node/IP. Require both new paths absent, at least 2GiB free disk and 1GiB available memory, one-minute load ≤8 on four CPUs, and CPU busy ≤85% in one bounded one-second sample. Refuse on drift; no polling or mutation follows a failed gate.
2. Write the local attempt intent before native staging. Recreate and verify the exact deterministic archive locally. Recheck CPU and exact store metadata before exclusive creation of the named 0700 remote staging directory. Record its actual device/inode in the local receipt before uploading anything.
3. SCP only the archive and three public helpers. The fixed SSH bootstrap verifies the exact directory identity, complete four-file inventory, regular-file owner and all four payload hashes; it sets those owned public payload files to 0600. Then it execs the hashed install helper with a cleared application environment. Existing SSH authentication is transport only; no key is fetched, copied into the workload or exposed in evidence.
4. After exact staging identity verification, the helper lowers priority to nice 19 before starting its private process supervisor, so descendants inherit it. The helper rechecks identity/headroom and verifies archive hash/size and every member name/type/mode/count/size, rejects hardlinks/special/escaping members, extracts directories/files before internal relative symlinks and checks the complete extracted digest. It does not restore archive owners or execute a tar-supplied command. All created files belong to tegwick. A local temporary roundtrip independently passed that extraction and the exact final runtime digest, with modes/symlink intact.
5. The staged candidate interpreter with -I -B imports and hash-checks its existing owner runtime/store modules, then calls existing install_runtime under a 180-second alarm and a supervised 200-second outer phase bound. No new package resolution/download occurs. The existing helper holds its normal lock and cleans its own temporary copy on ordinary exception, then atomically appends the verified new digest. Refuse if the destination appeared, even if somebody installed identical bytes; no existing install is silently adopted as this action's success.
6. Rehash the complete native destination. Execute only the installed artifact's existing owner_rehearsal.rehearse through its existing run= callback seam, independent of owner.json, SpendPolicy or ledger state. It launches rein-aharness --help, glas-harness --help and Claude --version inside empty-egress bwrap, each with a supervised 60-second timeout and discarded command output; the phase has a 240-second alarm and supervised 260-second outer bound. The callback adds supported --die-with-parent to the otherwise unchanged frozen owner bwrap argv. frozen-native-argv.json records all three exact command arrays without executing them. The helper refuses any missing frozen system bind before launch. Require exactly those three zero exits. No model/task command or credential route is constructed. Child environment is cleared; host HOME and credentials are not mounted. These ephemeral namespaces create no SandboxManager record, persistent worker, model session or provider lease.
7. Rehash the entire installed tree after rehearsal and remove only the exact owned staging directory only after the watchdog has stopped, been waited, and positively reported no live or waitable descendants, followed by exact device/inode/owner/mode and known-inventory checks. Missing or uncertain quiescence retains staging with failed-cleanup evidence. Capture the final structured result in this packet's execution-receipt.json. SSH closes when the foreground helper exits.

The rehearsal is the existing credential-free source API, not metered-once --rehearse against a private old owner configuration. This avoids changing pins or reading a ledger merely to validate an inactive artifact. It neither changes nor bypasses the normal future runtime/profile/spend/credential admission path.

Expected result, cost and risk

Success is installed_and_offline_rehearsal_verified, with actual install result, owner UID/store mode, extracted/installed/post-rehearsal full digest equality, three explicit launcher exit codes and staging absence. Destination remains a dormant append. Profile and credential flags stay false; provider calls are zero. No current owner/catalog/queue/definition/profile bytes are read or changed by the installation action. T07's spend acceptance, owner renewal and real-model/native approvals remain separate.

Persistent addition is about 261MB of logical file data plus filesystem metadata. Transfer is about 110MB. Extraction/copy temporarily add two artifact-sized trees plus the archive; the 2GiB free-disk requirement includes operating margin. Hashing and copy are sequential and lower priority, but a snapshot gate cannot guarantee that shared-host CPU/IO remains idle throughout execution.

Requested provider spend is USD 0: no provider API exists in this action. No new paid resource or recurring service is committed. Incremental infrastructure, energy and human recovery time in EUR are unknown, not zero. Credible EUR loss from unexpected shared single-node IO/resource interruption is also unknown. Approval must explicitly cover this small supervised append/rehearsal exposure; this proposal grants no autonomous budget or autopilot authority. Root may defer execution until the fresh headroom gate passes without weakening its thresholds.

Cleanup, rollback and uncertainty

Every phase and bwrap launcher is spawned by the single private watchdog, not by subprocess.run. It is a Linux child subreaper, starts each job in its own session/process group and binds the controller/callers with pidfds. The watchdog watches controller loss, caller loss, timeout, output bounds and orphaned children. On any of those events it stops all owned jobs for this action, including nested Runner jobs which are siblings of the phase under the watchdog. It discovers actual descendants/adopted orphans, binds each PID with a pidfd and rechecks UID/start identity before signaling only that exact process. It gives TERM 0.5 seconds, then KILL/reap up to 3 seconds. It does not use broad kill, process-name matching or kill a shared process group. Output is bounded at 64KiB and application stderr is always discarded. No private values are included in error receipts.

Each directly spawned process arms PR_SET_PDEATHSIG before exec and checks its parent. The added bwrap --die-with-parent also covers sandbox processes if bwrap/the watchdog disappears. Controller SIGKILL leaves the watchdog alive long enough to stop/reap jobs and write quiescent.json, but leaves staging: a dead controller cannot authorize cleanup. Watchdog loss or uncertain PID/UID/ start mapping is failed/unverified cleanup; the controller does not infer a successful cleanup from a leader's exit. The final controller waits for its watchdog and requires its positive quiescence receipt before deleting staging. See PROCESS-CONTRACT.md for the precise source seam and failure matrix.

A transfer/bootstrap failure before remote helper execution may leave only the exact upload directory. The conditional command is python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py --apply. It requires this proposal's revision-2 local receipt at staging_created / before_transfer, matching directory identity, only the four named regular upload files, and no supervision state or extracted runtime. It refuses every later phase. No post-execution cleanup command is authorized by that helper.

An SSH timeout or lost final reply after remote_execution_started remains an uncertain outcome; never replay --apply or delete staging. The 600-second SSH timeout is not proof that a surviving remote controller stopped. Reconcile the exact recorded stage/watchdog identity, quiescence receipt and complete installed digest read-only under the same trial; root must review any recovery mutation. Unexpected objects/mapping or absent quiescence evidence stay untouched.

The existing installer cleans its private .install-* copy on ordinary Python failure. Hard host/process loss may leave it; do not glob-delete store staging or infer ownership from the prefix. Preserve exact baseline/new-object metadata and request attended owner recovery for anything not tied to this attempt.

Rollback does not restore owner/catalog configuration because this action never changes it. Keep every older artifact and the newly installed immutable artifact as dormant evidence; removal of a published digest is not part of existing installer rollback and is not authorized here. If installation succeeds but rehearsal fails, record that partial outcome, retain the inactive artifact and staging cleanup facts, and stop. No automatic profile selection, in-place repair, artifact deletion, credential/provider retry or follow-up service action follows.

Review evidence

• action-inputs.json: fixed paths/helper hashes/archive/components/guards.
• frozen-native-argv.json: actual owner-generated three-launcher arrays plus the bounded Runner --die-with-parent addition; zero launcher executions.
• process-fixture-results.json: five actual disposable-process tests, including timeout, controller SIGKILL, session escape, nested Runner and mapping refusal.
• r1-preservation.json: all frozen R1 entries verified, complete R1 file hashes.
• retained-local-source-refusal.json and local-bytecode-refinement.json: failed preparation retained. Owner argv inspection accidentally generated one local pyc; the source gate refused before any target call. Only that generated file and empty cache directory were removed; complete f599 equality was restored. Subsequent artifact inspection uses -B. This is a refinement of this same trial, not a separate successful privileged action.
• target-readonly-observation.json and target-readonly-addendum.json: actual target/account/store/node/absence and Python/bwrap observations.
• cpu-readonly-observation.json and retained-headroom-refusal.json: earlier saturation/refusal, retained separately from the later passing snapshot.
• final-readonly-dry-run.json: actual R2 final helper's read-only result, zero writes.
• local-transfer-verification.json: deterministic archive and complete local extraction digest/mode/symlink roundtrip, removed local temporary tree.

Root must review/freeze the proposal/manifest digest, retain it in the existing supervision trial, obtain the exact founder disposition and only then invoke the --apply command. No native staging, install, launcher execution, owner change or paid call has happened during this preparation.