GitHub

ADR-0072: Reviewed worker dependency-declaration admission

Status: accepted
Date: 2026-08-09
Decision owners: NAUX architecture and x86-64 dependency boundary

Context

ADR-0071 independently inventories the interpreter, ordered DT_NEEDED declarations, and dynamic flags of the exact sealed ADR-0070 worker. Inventory alone grants no authority: an artifact can truthfully declare a new dependency without that dependency having been reviewed.

Decision drivers

  • Require an expectation supplied from review outside the admission call; deriving it from the candidate inventory inside admission is measurement, not trust.
  • Match the absolute interpreter, ordered unique dependency names, DT_FLAGS, and DT_FLAGS_1 exactly.
  • Bind admission to the accepted ADR-0071 policy root, exact sealed artifact, exact inventory evidence, and exact reviewed expectation.
  • Reject noncanonical paths/names, duplicate or reordered dependencies, missing/extra declarations, relaxed hardening flags, stale roots, and locally resealed evidence.
  • Do not resolve, open, hash, map, load, or execute any dependency.

Decision

Introduce a sealed caller-reviewed dependency expectation and a proof-only admission record. The expectation contains one canonical absolute interpreter, one ordered nonempty dependency vector, and the exact required dynamic flags. Its hash is domain-separated from policy and evidence.

Admission first validates the expectation and compares every declaration to the provided ADR-0071 evidence. Success then requires independent ADR-0071 replay from the opaque sealed ADR-0070 artifact. Evidence binds the artifact, inventory policy/evidence root, expectation root, dependency count, and both flag words. Verification preflights stale fields, then independently regenerates the complete admission result from the original three authorities.

Frozen limits

  • Linux x86-64 dynamic worker profile only;
  • one canonical absolute interpreter, with no empty, . or .. component;
  • 1 through 64 ordered unique dependency names;
  • at most 256 printable non-space ASCII bytes per name;
  • dependency names contain no slash or backslash;
  • exact DT_FLAGS = 0x8 (BIND_NOW);
  • exact DT_FLAGS_1 = 0x08000001 (NOW | PIE);
  • accepted ADR-0071 policy root 1a6c96c8b47a2001d9969488785c6bb2b846c378280b0498f2c16b0f14fd3bbf;
  • proof-only admission; global target encoder policy remains 1.4.0.

Consequences

  • An independently reviewed deployment manifest can prevent silent interpreter, dependency-name, order, or hardening-flag drift.
  • A self-measured expectation is not trusted merely because it has a valid hash; authority still originates outside the admission call.
  • Matching a name does not identify the file selected by the dynamic loader. Resolution semantics, transitive dependencies, file digests, loader code, mapping state, sandboxing, and syscall authority remain open.
  • Static or freestanding workers require a separate profile rather than an empty dynamic manifest.

Acceptance gates

  1. The exact reviewed acceptance manifest admits against the exact replayed ADR-0071 worker inventory and independently verifies.
  2. Interpreter, dependency count/order/name, duplicate, path, and flag drift fail closed before authority is minted.
  3. Stale artifact/inventory/expectation/policy roots, field mutation, seal mutation, and locally resealed evidence fail independent replay.
  4. Production imports no filesystem resolver, loader, process launcher, native emitter, historical standalone parser, measurement, or target raw authority.
  5. Focused, workspace, strict lint, governance, refinement, format, shell, and static authority gates pass before acceptance.

Accepted evidence

The declaration-admission policy is accepted under root 5a69470530ec8f65be018f53927379381a6d20cec7ca9076a69441a80183ec22. It binds schema/policy 1.0.0, the accepted ADR-0071 policy root, exact name and count caps, and exact BIND_NOW plus NOW | PIE flag requirements.

The reviewed acceptance expectation is sealed as b9b550ccffdfd72a6b2e67da466590235aadf4f177bdc8951653d67080495875. It names /lib64/ld-linux-x86-64.so.2, then the exact ordered vector libgcc_s.so.1, libc.so.6, ld-linux-x86-64.so.2, with DT_FLAGS = 0x8 and DT_FLAGS_1 = 0x08000001. Missing, extra, reordered, duplicate, path-bearing, or noncanonical names and either relaxed flag word fail closed.

Focused ADR-0072 tests pass 2/2 and ADR-0071 replay passes 2/2. The complete workspace passes 408 library tests with zero failures and six explicit release-only ignores plus every integration and doc test. Governance passes 22/22, shell syntax 9/9, focused refinement 13/13, Markdown links 270/270, strict Clippy, format, diff hygiene, native/process/standalone parity, and static import gates all pass.

Admission remains proof-only. It does not prove which files the host loader resolves, does not admit transitive objects, and grants no loading, execution, sandbox, timing, claim, or global encoder-policy authority.