the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md

# Install and verify the immutable Glas/rein runtime on railiance01

Proposal ID: **REINAH-WP-0008-T07-install-f599-r1**, revision **2**.
Status: **pending root review and exact founder approval; no native mutation**.
R1 remains frozen, unapproved and unexecuted. This is revision 2 of the same
proposal/trial, addressing root review of descendant cleanup. This is a
separately reviewable installation step under existing T07. It does
not require completing the paid-attempt envelope because it uses no provider,
worker credential, owner/spend configuration, catalog change or queue action.
It does not activate the artifact or complete T07, GLAS-WP-0012-T03/T04, the
current Custodian assignment migration or TSA-06.

## Exact action and target

After root retains this exact revision and the supervisor's disposition, run:

```bash
python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py --apply
```

The same file's default/`--dry-run` is read-only. `--apply` refuses any existing
local execution receipt, so a failed/uncertain attempt cannot be rerun blindly.
There is no scheduling, continuous claim loop, profile readiness override,
credential acquisition, provider request, owner renewal or service restart.

| Input | Exact value |
|---|---|
| Host | existing SSH alias railiance01; Kubernetes node must be Ready at 92.205.62.239 |
| Account | tegwick, UID/GID 1000, home /home/tegwick |
| Existing protected store | /home/tegwick/.helixforge-factory/runtimes, mode 0700, device 2049, inode 4751222 |
| New destination | /home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| Complete runtime digest | sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| Retained source artifact | /tmp/netkingdom-runtime-canonical-20261016/runtime |
| Exact new owned staging | /home/tegwick/.helixforge-factory/runtime-install-f599-r2-20261017 |
| Transfer archive | deterministic gzip/PAX tar, 109,931,109 bytes, 1,448 members |
| Transfer SHA-256 | sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7 |
| Logical regular-file bytes | 260,668,241; one retained internal relative symlink, lib64 → lib |

`action-inputs.json` freezes every executable/helper hash and archive input.
`artifact-manifest.json` binds this proposal and all retained review evidence.
Only four named payload files go into remote staging: runtime.tar.gz,
runtime.py, install-verified.py and process_supervision.py. The private
one-action watchdog and its JSON receipts exist beneath that staging only;
they create no service, schedule or persistent control plane. The workstation archive is regenerated
privately from the exact source only at execution, checked against the frozen
archive hash, transferred, and removed from its local temporary directory.
No large runtime archive or new source build is committed to this repository.

## Existing owner contract and actual observations

Sand-boxer `docs/bwrap-runtime.md` explicitly separates protected artifact
installation from profile selection, credentials, network activation and schedules.
The existing `runtime_store.install_runtime` verifies source, checks the owned
store and lock, copies symlinks/modes into its own private staging, verifies the
copy and atomically publishes under its digest. It never replaces an existing
artifact. This proposal uses that exact implementation already in f599; it does
not introduce another store or installer service. Remote owner source checkouts
are absent, so the pinned public digest reader/driver travel with the artifact.

Exact installed component hashes:

- sandboxer runtime.py: sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412
- sandboxer runtime_store.py: sha256:c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf
- rein owner_rehearsal.py: sha256:192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3

Runtime/store components match both the artifact's sandboxer `221126cb` and
current owner source `53f800c4`; the rehearsal matches artifact rein `9b88cadaa8`.
The complete build includes Glas `7357115c` and llm-connect `37436bb5` from the
previously reviewed immutable build. Reuse its actual manager/gateway proof for
isolation/workload-delivery mechanics; no deterministic proof is relabelled a
real model call. The new action proves native installation and free launch only.

Read-only target evidence verifies the expected account/node, safe home/factory/
store/lock modes and absent destination/staging. Four older digest directories
remain in the store, including b6e4e8a4; this action does not select, overwrite,
remove or execute them. Pinned native executables are /usr/bin/python3 (3.12.3),
/usr/local/bin/kubectl for the node read and /usr/bin/bwrap. No private owner/config/auth files were opened by these observations.

The R2 read-only dry-run at **2026-10-17 06:01:35 UTC** passed all guards:
123,352,678,400 free disk bytes, 7,735,549,952 available memory bytes, one-second
CPU busy fraction 0.2832 and one-minute load 1.9634 across four CPUs. The new
R2 staging and destination were absent. Earlier R1 target observations and
headroom refusal remain copied as explicitly historical evidence; only
final-readonly-dry-run.json records this R2 controller. A passing snapshot is
not a reservation. All guards run again before any approved attempt.

The target's installed **bubblewrap 0.9.0** help supports --die-with-parent.
Its installed upstream manual states that it kills all sandbox processes when
bwrap or its parent dies, using PR_SET_PDEATHSIG. The R2 dry-run records the
manual excerpt plus successful pidfd-open and PR_GET_CHILD_SUBREAPER readback.
No target namespace or runtime was launched to obtain this evidence.

## Exact execution and refusal behavior

1. Verify every local helper hash and the complete source artifact digest.
   Read target metadata only; require the exact existing store device/inode,
   expected UID/GID/modes and Ready node/IP. Require both new paths absent,
   at least 2GiB free disk and 1GiB available memory, one-minute load ≤8 on four
   CPUs, and CPU busy ≤85% in one bounded one-second sample. Refuse on drift;
   no polling or mutation follows a failed gate.
2. Write the local attempt intent before native staging. Recreate and verify
   the exact deterministic archive locally. Recheck CPU and exact store metadata
   before exclusive creation of the named 0700 remote staging directory. Record
   its actual device/inode in the local receipt before uploading anything.
3. SCP only the archive and three public helpers. The fixed SSH bootstrap verifies
   the exact directory identity, complete four-file inventory, regular-file
   owner and all four payload hashes; it sets those owned public payload files
   to 0600. Then it execs the hashed install helper with a cleared application
   environment. Existing SSH authentication is transport only; no key is fetched,
   copied into the workload or exposed in evidence.
4. After exact staging identity verification, the helper lowers priority to nice
   19 before starting its private process supervisor, so descendants inherit it.
   The helper rechecks identity/headroom and verifies archive hash/size and every member name/type/mode/count/size,
   rejects hardlinks/special/escaping members, extracts directories/files before
   internal relative symlinks and checks the complete extracted digest. It does
   not restore archive owners or execute a tar-supplied command. All created
   files belong to tegwick. A local temporary roundtrip independently passed
   that extraction and the exact final runtime digest, with modes/symlink intact.
5. The staged candidate interpreter with `-I -B` imports and hash-checks its
   existing owner runtime/store modules, then calls existing install_runtime
   under a 180-second alarm and a supervised 200-second outer phase bound. No new package resolution/download occurs. The
   existing helper holds its normal lock and cleans its own temporary copy on
   ordinary exception, then atomically appends the verified new digest. Refuse
   if the destination appeared, even if somebody installed identical bytes;
   no existing install is silently adopted as this action's success.
6. Rehash the complete native destination. Execute only the installed artifact's
   existing owner_rehearsal.rehearse through its existing run= callback seam,
   independent of owner.json,
   SpendPolicy or ledger state. It launches rein-aharness --help,
   glas-harness --help and Claude --version inside empty-egress bwrap, each with
   a supervised 60-second timeout and discarded command output; the phase has
   a 240-second alarm and supervised 260-second outer bound. The callback adds
   supported --die-with-parent to the otherwise unchanged frozen owner bwrap
   argv. frozen-native-argv.json records all three exact command arrays without
   executing them. The helper refuses any missing frozen system bind before
   launch. Require exactly those three zero exits. No model/task command or
   credential route is constructed. Child environment is cleared; host HOME
   and credentials are not mounted. These ephemeral namespaces create no
   SandboxManager record, persistent worker, model session or provider lease.
7. Rehash the entire installed tree after rehearsal and remove only the exact
   owned staging directory only after the watchdog has stopped, been waited,
   and positively reported no live or waitable descendants, followed by exact
   device/inode/owner/mode and known-inventory checks. Missing or uncertain
   quiescence retains staging with failed-cleanup evidence. Capture the final structured result in this packet's
   execution-receipt.json. SSH closes when the foreground helper exits.

The rehearsal is the existing credential-free source API, not metered-once
--rehearse against a private old owner configuration. This avoids changing pins
or reading a ledger merely to validate an inactive artifact. It neither changes
nor bypasses the normal future runtime/profile/spend/credential admission path.

## Expected result, cost and risk

Success is `installed_and_offline_rehearsal_verified`, with actual install result,
owner UID/store mode, extracted/installed/post-rehearsal full digest equality,
three explicit launcher exit codes and staging absence. Destination remains a
dormant append. Profile and credential flags stay false; provider calls are zero.
No current owner/catalog/queue/definition/profile bytes are read or changed by the
installation action. T07's spend acceptance, owner renewal and real-model/native
approvals remain separate.

Persistent addition is about 261MB of logical file data plus filesystem metadata.
Transfer is about 110MB. Extraction/copy temporarily add two artifact-sized trees
plus the archive; the 2GiB free-disk requirement includes operating margin. Hashing
and copy are sequential and lower priority, but a snapshot gate cannot guarantee
that shared-host CPU/IO remains idle throughout execution.

Requested provider spend is USD 0: no provider API exists in this action. No new
paid resource or recurring service is committed. Incremental infrastructure,
energy and human recovery time in EUR are **unknown**, not zero. Credible EUR
loss from unexpected shared single-node IO/resource interruption is also unknown.
Approval must explicitly cover this small supervised append/rehearsal exposure;
this proposal grants no autonomous budget or autopilot authority. Root may defer
execution until the fresh headroom gate passes without weakening its thresholds.

## Cleanup, rollback and uncertainty

Every phase and bwrap launcher is spawned by the single private watchdog,
not by subprocess.run. It is a Linux child subreaper, starts each job in its own
session/process group and binds the controller/callers with pidfds. The watchdog
watches controller loss, caller loss, timeout, output bounds and orphaned
children. On any of those events it stops **all owned jobs for this action**,
including nested Runner jobs which are siblings of the phase under the
watchdog. It discovers actual descendants/adopted orphans, binds each PID with
a pidfd and rechecks UID/start identity before signaling only that exact
process. It gives TERM 0.5 seconds, then KILL/reap up to 3 seconds. It does not
use broad kill, process-name matching or kill a shared process group. Output is
bounded at 64KiB and application stderr is always discarded. No private values
are included in error receipts.

Each directly spawned process arms PR_SET_PDEATHSIG before exec and checks its
parent. The added bwrap --die-with-parent also covers sandbox processes if
bwrap/the watchdog disappears. Controller SIGKILL leaves the watchdog alive
long enough to stop/reap jobs and write quiescent.json, but **leaves staging**:
a dead controller cannot authorize cleanup. Watchdog loss or uncertain PID/UID/
start mapping is failed/unverified cleanup; the controller does not infer a
successful cleanup from a leader's exit. The final controller waits for its
watchdog and requires its positive quiescence receipt before deleting staging.
See PROCESS-CONTRACT.md for the precise source seam and failure matrix.

A transfer/bootstrap failure before remote helper execution may leave only the
exact upload directory. The conditional command is
`python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py --apply`.
It requires this proposal's revision-2 local receipt at staging_created /
before_transfer, matching directory identity, only the four named regular
upload files, and no supervision state or extracted runtime. It refuses every
later phase. No post-execution cleanup command is authorized by that helper.

An SSH timeout or lost final reply after remote_execution_started remains an
uncertain outcome; never replay --apply or delete staging. The 600-second SSH
timeout is not proof that a surviving remote controller stopped. Reconcile the
exact recorded stage/watchdog identity, quiescence receipt and complete installed
digest read-only under the same trial; root must review any recovery mutation.
Unexpected objects/mapping or absent quiescence evidence stay untouched.

The existing installer cleans its private `.install-*` copy on ordinary Python
failure. Hard host/process loss may leave it; do not glob-delete store staging
or infer ownership from the prefix. Preserve exact baseline/new-object metadata
and request attended owner recovery for anything not tied to this attempt.

Rollback does not restore owner/catalog configuration because this action never
changes it. Keep every older artifact and the newly installed immutable artifact
as dormant evidence; removal of a published digest is not part of existing
installer rollback and is not authorized here. If installation succeeds but
rehearsal fails, record that partial outcome, retain the inactive artifact and
staging cleanup facts, and stop. No automatic profile selection, in-place repair,
artifact deletion, credential/provider retry or follow-up service action follows.

## Review evidence

- action-inputs.json: fixed paths/helper hashes/archive/components/guards.
- frozen-native-argv.json: actual owner-generated three-launcher arrays plus the
  bounded Runner --die-with-parent addition; zero launcher executions.
- process-fixture-results.json: five actual disposable-process tests, including
  timeout, controller SIGKILL, session escape, nested Runner and mapping refusal.
- r1-preservation.json: all frozen R1 entries verified, complete R1 file hashes.
- retained-local-source-refusal.json and local-bytecode-refinement.json: failed
  preparation retained. Owner argv inspection accidentally generated one local
  pyc; the source gate refused before any target call. Only that generated file
  and empty cache directory were removed; complete f599 equality was restored.
  Subsequent artifact inspection uses -B. This is a refinement of this same
  trial, not a separate successful privileged action.
- target-readonly-observation.json and target-readonly-addendum.json: actual
  target/account/store/node/absence and Python/bwrap observations.
- cpu-readonly-observation.json and retained-headroom-refusal.json: earlier
  saturation/refusal, retained separately from the later passing snapshot.
- final-readonly-dry-run.json: actual R2 final helper's read-only result, zero writes.
- local-transfer-verification.json: deterministic archive and complete local
  extraction digest/mode/symlink roundtrip, removed local temporary tree.

Root must review/freeze the proposal/manifest digest, retain it in the existing
supervision trial, obtain the exact founder disposition and only then invoke the
--apply command. No native staging, install, launcher execution, owner change or
paid call has happened during this preparation.