Distillation

Date: Sep 8, 2026

• 🟡 (08:01) Updated binary SHA-256 hashes were: bin/opencode-pty-supervisor = ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2 (replacing previously reported supervisor hash); bin/opencode-pty-launcher = d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd; bin/opencode-pty-client = fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde.
• 🟡 (08:01) Service validation reported missing/non-executable installed commands: /usr/local/libexec/opencode-pty-supervisor for opencode-pty-supervisor.service and /usr/local/libexec/opencode-pty-verify-readiness for opencode-v2.service. Result counters were verify=1 security=0.
• 🔴 (08:01) User specified that /usr/local/libexec, every parent directory, and all three PTY binaries must be root-owned and never writable by byk or a group; the Node SEA service must use the reviewed fixed helper path and be unable to replace it.
• 🔴 (08:01) User specified the application invariant that the client helper never initiates a socket connection, resolves a caller path, or opens an application-selected path.
• 🔴 (08:01) User specified that the helper receives only ordinary stdio plus fd 3 (a duplicate of Node’s connected socket) and fd 4 (the approved directory), sends one bounded start frame with one SCM_RIGHTS descriptor, then exits; reviewed Go runtime metadata reads such as /sys/kernel/mm/transparent_hugepage/hpage_pmd_size are allowed only when observed on the exact Go/runtime build.
• 🔴 (08:01) User specified that both received descriptors must become close-on-exec and that no unrelated Node child may inherit the authenticated socket or helper descriptors.
• 🔴 (08:01) User specified that workspace and IPv4/IPv6 network access remain explicit pilot behavior and directed: “Never describe this PTY as a general sandbox.”
• 🔴 (08:01) User specified that same-UID ptrace, /proc descriptor access, process control, inheritance, or descriptor delegation must not allow another process to impersonate the MainPID, obtain/inherit its connected socket, or delegate work through an inherited descriptor; any unblocked same-UID delegation path blocks deployment.
• 🔴 (08:01) User specified that source changes and source tests never prove the exact-host isolation property; target-host acceptance must prove descriptor inheritance is limited to the one fixed helper invocation.
• 🔴 (08:01) User specified that exact Node 26.4 SEA must pass a deterministic inheritance probe against the final binary, passing only the connected supervisor socket and approved cwd to the fixed helper, enumerating helper descriptors before its first application operation, and proving an unrelated child inherits neither descriptor.
• 🔴 (08:01) User specified that Node 24 results never satisfy the exact Node 26.4 SEA inheritance gate.
• 🔴 (08:01) User specified that root acceptance, exact Node 26.4 SEA inheritance, same-UID delegation/ptrace isolation, target-host systemd properties, and independent reviews remain deployment blockers until performed on the final artifacts.
• 🔴 (08:01) User specified that cutover requires explicit approval because it stops the running service and must never occur while root acceptance, independent reviews, or the content-bound readiness marker remain incomplete.
• 🟡 (08:01) supervisor/ROOT-ACCEPTANCE.md requires two reproducible builds of all three binaries using CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags=-buildid=, matching both build sets and recording the content-bound source revision, Go version, dependency sums, complete commands, and SHA-256 hashes.
• 🟡 (08:01) supervisor/ROOT-ACCEPTANCE.md requires disposable-VM testing of reviewed service and slice candidates as root-owned mode 0644, systemd-analyze verify on installed files, and D-Bus inspection of every transient property, rejecting unknown, ignored, or weakened directives without altering production units.
• 🟡 (08:01) PTY smoke acceptance requires running bun /tmp/opencode/pty-plugin-smoke.ts exactly 10 times with the reviewed harness outside the auto-discovered plugin directory, then against the freshly built helper and an isolated disposable supervisor. Required checks cover permissions, source identity, ownership, deletion, in-flight deletion, reservations, JSON envelopes, regex bounds, UTF-8 write bounds, pre-listener output bounds, saturated STOP bounds, transport framing, helper transfer, notifications, timeouts, and cleanup.
• 🟡 (08:01) Readiness acceptance requires fresh independent correctness and security reviews of the exact source and hashes; review-source-hash from the unchanged source tree must equal the pty-source:sha256 embedded in verify-readiness.
• 🟡 (08:01) The reviewed root-owned mode-0755 supervisor/verify-readiness must be installed at /usr/local/libexec/opencode-pty-verify-readiness. Only after all reviews and target-host checks pass may root create /etc/opencode/pty-supervisor-verified as a root-owned mode-0644 regular file.
• 🟡 (08:01) /etc/opencode/pty-supervisor-verified must contain exactly 4 newline-terminated lines in fixed order: 1. revision=opencode-v2-pilot:git:<reviewed-40-hex-commit>;pty-source:sha256:<reviewed-source-manifest-hash> exactly as embedded in verify-readiness; 2. standard sha256sum record for /usr/local/libexec/opencode-pty-supervisor; 3. standard record for /usr/local/libexec/opencode-pty-launcher; 4. standard record for /usr/local/libexec/opencode-pty-client. Duplicate or trailing lines are invalid, and arbitrary revision hex, absent/symlinked/empty/stale/writable/wrong-owner/wrong-mode markers, or hash/source-manifest mismatches cannot grant readiness.
• 🟡 (08:01) supervisor/PROTOCOL.md specifies one Unix SOCK_STREAM connection per PTY, retained by the Node SEA process and authenticated by the supervisor using immutable peer credentials against the exact opencode-v2.service MainPID.
• 🟡 (08:01) The transient launcher protocol uses the PTY stream as stdin/stdout and the approved cwd descriptor as stderr; it calls fchdir(2), replaces stderr with stdout, accepts only canonical a[A-Za-z0-9_-]* URL-safe unpadded base64 arguments, clears the environment, binds its reviewed executable to fd 3, and passes bounded encoded argv through one temporary environment value.
• 🟡 (08:01) The launcher executes /usr/bin/script -q -e -f -c "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'" /dev/null; the inner launcher decodes argv, clears the temporary value, restores the fixed environment, closes fd 3, and directly calls execve with the original argv vector. The design states that command arguments are not evaluated as shell syntax and retain argv boundaries.
• 🟡 (08:01) Git status showed modified files: packages/core/src/plugin/host.ts, packages/core/test/plugin.test.ts, packages/core/test/plugin/fixture.ts, packages/core/test/plugin/host.ts, packages/plugin/src/effect/permission.ts, packages/plugin/src/promise/adapter.ts, and packages/plugin/src/promise/permission.ts. Untracked directories were packages/cli/dist-v2-pilot-final/, packages/cli/dist-v2-pilot-next/, and packages/cli/dist-v2-pilot/.
• 🟡 (08:01) Diff statistics across 7 tracked files were 220 insertions and 62 deletions: packages/core/src/plugin/host.ts 1 added line; packages/core/test/plugin.test.ts 102 lines changed; packages/core/test/plugin/fixture.ts 114 lines changed; packages/core/test/plugin/host.ts 1 added line; packages/plugin/src/effect/permission.ts 12 added lines; packages/plugin/src/promise/adapter.ts 41 lines changed; and packages/plugin/src/promise/permission.ts 11 added lines. Current commit was 2ac698d65a feat(ai): add Moonshot provider (#47851).
• 🟡 (08:01) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go lines 93–111 define TestClientIdentityUsesRealSystemdInterfaces: decodeClientIdentity accepts ActiveState, SubState, and a 16-byte InvocationID from the Unit properties plus MainPID=42 and ControlGroup=expectedClientCgroup from Service properties, while rejecting ControlGroup supplied through the Unit interface.
• 🟡 (08:01) TestSystemd255IntrospectionPlacesPropertiesOnExactInterfaces in systemd_test.go lines 113–142 queries dbus.service; it requires Unit properties ActiveState, SubState, and InvocationID, Service properties MainPID and ControlGroup, and rejects unexpected exposure of ControlGroup through Unit.
• 🟡 (08:01) TestForgedUnitRemovedSignalCannotProveCleanup in systemd_test.go lines 144–164 injects a forged org.freedesktop.systemd1.Manager.UnitRemoved signal from sender :1.999 for opencode-pty-0123456789abcdef0123456789abcdef.service; verifiedStopped must still perform exactly 1 cleanup query and return stopped=false.
• 🟡 (08:01) TestBoundedSignalHandlerDropsFlood in systemd_test.go lines 166–174 delivers 10,000 signals to newBoundedSignalHandler(1) and requires the signal queue length to remain exactly 1.
• 🟡 (08:01) TestReadinessVerifierBindsExactSourceAndCondition in systemd_test.go lines 176–199 reads ../../verify-readiness, runs ../../review-source-hash, requires a 64-character digest embedded as ;pty-source:sha256:<digest>', requires ../../../opencode-v2.service to contain ExecCondition=/usr/local/libexec/opencode-pty-verify-readiness, and validates verifier shell syntax with /bin/sh -n ../../verify-readiness.