GitHub

ADR-0069: Sovereign enveloped-image process containment

Status: accepted
Date: 2026-08-03
Decision owners: NAUX architecture and x86-64 process boundary

Context

ADR-0068 proves finite native correctness for the exact verified ADR-0067 image, but its W^X call is in-process: a malformed instruction can still fault the compiler host. The historical R1-S7b-c process stack executes a different raw-image authority and cannot become the owner of the sovereign image by reuse or renaming.

Decision drivers

  • Contain every ADR-0068 machine-code invocation in a dedicated child process.
  • Let the parent verify the complete source/image chain and target-plan oracle without mapping or executing machine code.
  • Own a new canonical, bounded, mutation-evident IPC frame for the exact 51 records; do not import historical raw/native-process/standalone protocols.
  • Enforce one reviewed worker, one child, one frame, normal exit, empty stderr, bounded capture, timeout, process-group termination, and mandatory reap.
  • Keep executable-path selection, standalone, timing, benchmark, claim, and global encoder-policy authority closed.

Considered options

Reuse the R1-S7b-c worker and process helper

Rejected. Its protocol and records bind the historical raw target rather than the fully enveloped ADR-0067 image.

Launch one fresh child per corpus case

Rejected for this gate. It repeats complete sovereign package construction 51 times and expands lifecycle authority without improving the finite claim. One child executes the ordered fixed corpus; any fault invalidates the whole frame.

One sovereign aggregate worker and an oracle-only parent verifier

Accepted for implementation. The worker regenerates ADR-0068 evidence once. The parent decodes untrusted bytes, reconstructs both complete source/image chains, re-evaluates all 51 target-plan outcomes, and admits no native call.

Decision

Introduce three locally owned components:

  1. x64_tail_enveloped_ipc defines an exact little-endian aggregate frame, independent bounded decoder, domain-separated frame hash, canonical tags, exact length, and no trailing-byte tolerance.
  2. naux-tail-enveloped-worker accepts no arguments or stdin, regenerates the ADR-0068 evidence, writes exactly one frame to stdout, and exits normally.
  3. x64_tail_enveloped_process owns spawn, isolated process group, concurrent bounded stdout/stderr capture, timeout, group kill, reap, frame decode, oracle-only verification, and a sealed process receipt.

The worker path is a caller-supplied reviewed trust anchor. This decision is not binary attestation, launch-environment attestation, sandboxing, syscall filtering, replay prevention, or hostile-input execution authority.

Frozen limits

  • Linux x86-64 only;
  • exactly one worker child and exactly 51 ordered records;
  • no worker arguments and no stdin payload;
  • at most 32 KiB stdout, zero stderr bytes, zero diagnostics;
  • 180-second child timeout, one-second bounded reap and pipe-reader join;
  • exact normal zero exit, no signal, retry, partial record, or fallback;
  • global target encoder policy remains 1.4.0.

Consequences

  • A native fault, abort, timeout, malformed frame, diagnostic, descendant pipe leak, wrong source identity, or semantic mismatch yields no process witness.
  • Parent verification no longer needs to execute the image merely to validate a child observation.
  • A compromised reviewed worker can still forge its stdout; executable attestation and OS sandboxing require later decisions.
  • Structural and process-correctness evidence is not performance evidence.

Acceptance gates

  1. The worker emits one deterministic frame whose decoded evidence has the exact accepted ADR-0068 root.
  2. Parent oracle-only replay proves all source/image identities, 51 canonical inputs, outcome bits, effects, W^X metadata, MXCSR, teardown and no fallback without importing or calling the ADR-0068 native runner.
  3. Bit mutation, truncation, trailing bytes, length/tag/count/order/hash mutation and locally resealed semantic mutation fail closed.
  4. Abnormal exit, signal, timeout, stdout/stderr overflow, diagnostics, missing/double frame, wrong worker evidence and descendant-held pipes fail closed with bounded group termination and reap.
  5. Production imports no historical raw/native-process/process-helper/ standalone/measurement module and grants no fallback or raw-byte execution.
  6. Focused, public-boundary, workspace, strict lint, governance, refinement, format/diff and static authority gates pass before acceptance.

Accepted evidence

The exact one-child process correspondence is accepted under process-evidence root e3f97622df1a3e12b99e66678654881bc521761a6b7df6ab02b6d9f459e1d7ae. Its sole canonical IPC frame is 32-KiB bounded and has raw frame hash 0bb2cbe0ebc7e425e538a6c6317815050c274bf7584386c1678407d9fc618044. The decoded correspondence retains the accepted ADR-0068 root defef43d36e6eb01d21ef5cb3a2f89d74b675fff42a819e940aec9cbbd29e3d2 and exactly 51 ordered records.

The child executes the complete sovereign corpus once. The parent maps or calls no native image: it independently reconstructs the source/image chain, regenerates all target-plan outcomes, and compares outcome bits, effects, mapping metadata, canonical MXCSR, caller restoration, teardown, and fallback=false. Every single frame-byte mutation, truncation, trailing byte, and locally resealed semantic mutation fails independent replay.

Hostile worker probes cover missing, malformed, truncated, trailing, double-frame and oversized output; diagnostics; nonzero exit; abort; timeout; valid output followed by abnormal exit; and descendant-held pipes. All fail closed under bounded capture, process-group termination, and mandatory reap. The full workspace passes 401 library tests with 0 failures and 6 ignored, the ADR-0069 public boundary passes 2/2, governance passes 22/22, strict refinement passes 8/8, and Clippy, format, shell syntax, and static authority gates pass.

This accepts process containment for one caller-selected reviewed worker path, not the identity of that executable. Binary/source attestation, launch- environment attestation, sandboxing, syscall filtering, arbitrary hostile program execution, standalone authority, timing, and performance claims remain closed.