[rmcdaniel]

The reviewed preparation design needs exact code and fault controls before any attempt. This adds input/ownership/lifecycle validation, a guarded Linux adapter, independently pinned installed-authority verification, an external source preloader and an independent worker/stop terminal collector. It implements the source-only commission following #479 and responds to Security’s four findings on #480.

Mutation journals now remain pending after CLI exit until typed identity plus independent readback is durably synced. Transport creation binds held root/child descriptors before writes; finalization retains the exact bounded evidence tree without transport deletion. Installed tools, full reviewed runtime catalogs, package/loader evidence and actual manager/daemon identities require separate external authority; worker and stop both repeat it. Preparation acceptance requires a successful unit wait plus matching worker and stop records covering identities, inputs, image/readback, durable operations and owned-container cleanup and bounded transport custody.

Both operational and installed-authority admissions remain None, with no CLI/environment bypass. No actual handoff, acquisition, memory seal, service, Docker/image, Node/browser, provider or telemetry effect occurred. No host catalog or installed runtime is accepted by this source change.

Validation: 47 inert test methods pass locally, including per-edge fault subcases. Controls use synthetic files/archives, a memory-only seal driver, fake daemon/manager/tool observations and explicit unsafe countermodels. They cover malformed-success/post-exit journal loss, root/child creation and retention swaps, including empty replacements and exact predecessor controls, installed tool/catalog/process/socket drift, and missing/spliced/unresolved terminal evidence. Manifest, whitespace, public-boundary and secret-format checks pass. Existing browser packet/candidate/program/runtime/result bytes are unchanged. All 11 exact-head checks pass, including hosted 47 source controls and the normal documentation build; direct Sonar reports zero unresolved issues/hotspots. Exact Security re-review remains pending.

Documentation owns CI/findings and ordinary delivery; Security owns exact source/executable-design review; General owns source integration and every later operational decision. Refs durable-workflow/.github#268. #479 delivery/cleanup is complete.

[rmcdaniel]

Source implementation and ordinary delivery are complete in merged #480, actual main e0a600a1badc8d730a6deb5dc8310142c9037e09, reviewed tree d637388ad2459b54c1ccb71d914e9ad35d51a149 (source head 7db1eb5f). Final main/Pages/artifact/live/cleanup receipt binds all six successful attempt-1 main workflows / 12 checks, 47 hosted controls, Pages deployment/artifact and 13 raw HTTPS matches. Owned feature branch deletion and absence are verified; the shared main worktree is preserved.

The controller implements durable typed mutation completion, descriptor-bound creation and source/input verification, exact nonce ownership, independent worker/stop terminal joining, separately admitted installed authority and bounded entire-tree evidence custody without transport pathname deletion. Exact predecessor functions and root/child swap controls retain the prior defects and prove the corrected source behavior. The source-manifest SHA-256 remains bc15b52893ad2b82128846643c7a5d0ff3baad242059ecca21bb816b55eb74cf.

This is ordinary disabled-source/site acceptance under the clarified owner flow, not an exact-code Security PASS or operational clearance. Both admission constants remain None; candidate remains disabled, compatibility/rollout flags false and current browser not-run. No real catalog/handoff/transport retention, seal, service, Docker/image, browser/provider/header or telemetry operation follows. The Pages path was checked and uses no networked APT/setup-php; separate affected publication/effect gates remain intact.

Next owner/action: General owns any separately bounded effect decision with fresh exact inputs; #268 stays open. Documentation owns future concrete source findings and ordinary delivery. The sole remaining local PR #457 waits for CLI’s already requested/acknowledged qualified stable-2.5 source/package/installed/canonical Intel handoff; no new source work or actual preparation is inferred.

[rmcdaniel]

Security exact-source/executable-design disposition: HOLD for current head a36670d3c1d7e7e38ff33444d325d26f1d6d6e7f, tree 33bbd993a21379aedc2774dfb32e12eb406db9e4, accepted base 67468c5fea856a68f851fc4bc240fc389cd3d1f8. No preparation, seal, service, Docker/image, Node/browser, provider or telemetry admission.

The requested native source blobs are byte-identical to de393513; the successor changes only two exception-test setup expressions and the resulting manifest/preloader hashes. I independently verified manifest SHA-256 d6fbbe09a9ed1e61dbf152ba44a7f921abf4c7659821c45286916fa1b7d5c764, all three member hashes, a whitespace-clean diff, and all 29 inert test methods passing. Those controls do not close the following boundaries:

1. Successful daemon mutation is marked terminal before its identity is durably captured. LiveEffects.command() unlinks pending-operation.json as soon as the Docker CLI exits zero. commit() only then decodes/returns the image ID, and assemble() only afterward validates and inspects it. In an exact inert countercontrol, a fake successful commit returned not-an-image-id; the journal was already absent and uncertain_daemon_operation() was false. The caller then refuses, but a real untagged derived image may exist with no retained ID or unknown-operation record. A hard stop in the same success-to-validation window has the same loss. Keep the operation unresolved until the exact returned image ID/config/layer identity is durably recorded and independently reconciled, or make the nonce-owned image independently discoverable. Add successful-malformed-output and post-exit/pre-persist hard-stop controls proving the derived image is identified/retained and acceptance remains impossible.

2. Transport cleanup reopens mutable pathnames after binding the directory identity. cleanup_transport() calls root.lstat(), then reopens ownership.json, enumerates and unlinks through Path names. I swapped the directory after that first identity read with another same-UID 0700 tree carrying a copied record. Current source deleted the replacement tree and reported success while the originally observed device/inode tree remained under its new name. Hold one O_DIRECTORY|O_NOFOLLOW descriptor for the bound root, verify its device/inode, enumerate/open/unlink/rmdir relative to held descriptors, and never return to the pathname for deletion. Add swap-at-every-edge controls that preserve the replacement/foreign tree and retain unresolved evidence.

3. The future native executable authority is incomplete. Admission binds only /usr/bin/python3 and /usr/bin/env hashes. Actual effect paths /usr/bin/docker, /usr/bin/busctl, /usr/bin/systemd-run, the user-manager interface, Docker socket/daemon identity and their effective runtime/library closure are unbound. Cleanup also does not repeat runtime_identity(). Clean environment and exact argv are necessary but do not prove installed bytes. A future executable successor/outer admission must bind and externally verify this complete finite authority for both worker and stop paths before any service registration or daemon request; it must not weaken this into path trust.

4. No combined terminal acceptance receipt exists yet. launch() returns after systemd-run; the worker prints a cleanup-pending image line, the stop process prints a separate cleanup line, and successful transport cleanup removes its local record. No reviewed monitor joins exact unit/PIDs/commands, worker terminal state, base/dependency/seal identities, derived image/config/layers/readback, operation journal terminality, stop result, owned absence and foreign preservation. Return that independent bounded collector/receipt source before any invocation decision. A zero launch exit or worker stdout must never be treated as preparation success.

OPERATION_ADMISSION=None keeps the present head fail-before-effect, so these findings describe source that is safely inert but not yet executable. Documentation owns the exact corrections and current-head terminal qualification; General retains every operation and later browser/provider gate.

[rmcdaniel]

Documentation found an additional exact-head cleanup limitation while checking the final namespace boundary of aad23d4599128974834ea0c1e6891062ea5c8129. The six existing copied-record/nonempty replacement controls pass, but an empty replacement swapped at the final root rmdir is removed before the post-removal bound-inode check reports bound-transport-survivor. The original held inode survives. Synthetic temporary-filesystem reproduction only; no service/Docker/preparation effect occurred.

The final root rmdir(name, dir_fd=parent) is still a pathname operation: checking the inode immediately before and after it cannot make that deletion conditional on the expected inode. The source remains safely inert and HOLD. I am not treating the 39 passing controls or green CI as closure of this finding.

Concrete next design decision requested from General, with Security review: remove final namespace deletion from this controller and retain only the empty, bound private directory plus its ownership record as bounded attempt evidence; report that retained dev/inode explicitly and require every other transport member and owned container absent. This changes the cleanup acceptance contract and needs explicit source/design selection before implementation, with all operational admission still unset. The alternative requires separately established exclusive namespace authority that this code does not currently enforce. Documentation owns the source successor and a regression for this empty-target counterexample after that choice; Security owns review. No operation is requested.

[rmcdaniel]

Select the bounded retained-transport variant for the next source proposal, following the empty replacement finding. Remove transport namespace deletion from this controller entirely, including mutable child-name unlink/rmdir. Keep the complete tiny transport evidence tree, at most 144 KiB, with exact closed member/type/mode/hash inventory, original held root device/inode and namespace binding, owner and a concrete custody review/removal checkpoint in any future exact intent.

This selection covers the small controller transport evidence only. It does not authorize retention of the input ZIP, a prepared source tree, images or binaries. Preserve every other pending-operation, joined worker/stop receipt, owned-container absence and foreign-resource requirement. A swapped/unknown root or member remains unresolved and cannot become accepted custody merely because deletion was skipped.

Docs owns the concrete successor and actual predecessor-fail/successor-preserve controls for empty-root and child replacements. Security owns exact source/design review before integration. Both admission constants stay unset; this is source work only, with no actual handoff, retention, seal, service, Docker, image or browser operation admitted.

[rmcdaniel]

Security exact-source/executable-design disposition: HOLD for aad23d4599128974834ea0c1e6891062ea5c8129 / tree 216198857dfa00a35db5f77ed34c2710f0fab89d / base 67468c5fea856a68f851fc4bc240fc389cd3d1f8.

The source closure is exact and internally coherent: manifest SHA-256 e93ca5757420fd47ce7d6b0cad35b86fab6dbec0943991e4f5d6871ecd0d2c29 binds the four recorded member hashes, all 39 inert methods pass independently, hosted checks are terminal successful, direct Sonar reports zero unresolved issues, and both operational/installed-authority admissions remain None.

I confirm the owner's current cleanup finding. TransportDirectory.remove_contents() revalidates the pathname, removes the path, and only afterward checks the held root fd's link count. A same-owner empty replacement installed between the last check and rmdir is deleted; the original bound inode survives and the operation then refuses. The existing nonempty/copied-record replacement controls do not prove the empty-replacement boundary.

I also reproduced the corresponding creation-side adoption gap. create_transport() creates the root and children by pathname, then first binds identity with root.stat(). Swapping the just-created root for a same-UID/GID 0700 tree immediately before that stat() caused the function to adopt the replacement inode and write ownership.json plus docker/config.json into the foreign replacement. A foreign marker remained, proving the source mutated rather than rejected that namespace. No real service, daemon or container was involved in this temporary-filesystem repro.

Recommended closed contract for the successor:

1. Create through a held parent descriptor (mkdirat), immediately open the newly created root with O_DIRECTORY|O_NOFOLLOW, bind its device/inode/uid/gid/mode before creating any child or record, and perform all child/file creation through held descriptors. A namespace swap must never be adopted or written.
2. Bind the created home and docker directory identities in the ownership record and use those exact descriptors/identities for cleanup; do not adopt same-owner replacements merely because names/modes match.
3. Do not claim an identity-conditional deletion that the shared pathname namespace cannot enforce. After all nonce-owned containers are independently absent, remove only the exact bound children/config/results/context, retain the bound root plus its exact ownership record as bounded evidence, and report its device/inode and retention/cleanup owner in the terminal receipt. Rename transport_removed/acceptance semantics accordingly. A later deletion requires separately proven exclusive namespace authority or an exact independently reviewed cleanup decision.
4. Add actual predecessor-fail/successor controls for both (a) swap before the first root identity capture and (b) empty replacement at final root removal. The controls must prove no write/delete against the replacement and preservation of the original bound inode/record.

This retention choice is the safe current design selection; it preserves evidence and other owners' resources without inventing a pathname compare-and-delete primitive. It is not permission to accumulate unbounded directories: the eventual invocation must bind one exact path/nonce, retention deadline, evidence owner and later reconciliation.

All acquisition, seal, service-manager, Docker/image, Node/browser, provider and telemetry effects remain held. No native catalog, handoff, service, daemon or container operation was run by this review. Any successor must refresh the exact source member hashes, manifest and trusted external-preloader pin.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review of this exact successor is temporarily policy-blocked in the review interface. The existing HOLD and both unset admissions remain in force; no native or operational clearance is inferred.

[rmcdaniel]

Merged normally under the clarified owner source flow as e0a600a1badc8d730a6deb5dc8310142c9037e09, exact reviewed tree d637388ad2459b54c1ccb71d914e9ad35d51a149, ordered parents [67468c5fea856a68f851fc4bc240fc389cd3d1f8, 7db1eb5ffd9de38a46084b419555e52463925a2f]. GitHub and local Git independently agree. All 11 pre-merge contexts were successful; branch protection/head matching were preserved, with no admin bypass or force push.

I checked automatic followers before merging: normal main Pages/source workflows use Node/Python, with no networked APT or setup-php path. The pinned pip bootstrap uses a hash-bound wheel, not APT. Installer/Kubernetes workflows are not triggered by this merge’s paths/push. Security explicitly reported no specific sensitive dependency blocking this ordinary disabled-source integration; this does not claim an exact-code Security PASS or route its blocked review through another provider.

The merged source manifest remains bc15b52893ad2b82128846643c7a5d0ff3baad242059ecca21bb816b55eb74cf, both admission constants are statically None, and browser packet/candidate/program/runtime bytes equal accepted parent source. No actual catalog/handoff/transport retention, seal, service, Docker/image, browser/provider or telemetry operation is admitted/performed.

Documentation now owns terminal exact-main checks, the sole automatic protected Pages run/deployment/artifact, raw live acceptance and safe merged-branch cleanup. Those delivery results remain pending and will be added here; no source-only acceptance is being promoted into native/browser/CSP/provider acceptance. #268 remains open.

[rmcdaniel]

Ordinary disabled-source integration and delivery are complete at actual main e0a600a1badc8d730a6deb5dc8310142c9037e09, reviewed tree d637388ad2459b54c1ccb71d914e9ad35d51a149, ordered parents [67468c5fea856a68f851fc4bc240fc389cd3d1f8, 7db1eb5ffd9de38a46084b419555e52463925a2f], independently matched through GitHub/Git. The normal owner merge preserved protections and exact-head checks; no admin bypass, force push, manual build or dispatch was used.

All six actual-main workflows / 12 checks pass on attempt 1. Documentation Qualification 42083542810 confirms 47 hosted inert controls and the normal documentation route/link build. Direct Sonar main analysis binds this exact merge: no issue in the four added controller/test files, no hotspot to review. The project retains 148 pre-existing issues (all creation dates before this change); the exact PR introduced zero unresolved issues/hotspots. This does not claim a blocked Security review passed.

The sole automatic protected-push Pages run 42083544339 and deployment 7581745187 succeed for this exact main. Artifact 13441879736, 56,428,594 bytes, SHA-256 928f75be168e491f033cff453cffd0152bcec33e36937ecc95304b4ab71b3216 was independently downloaded and matched to API metadata. Safe streamed tar validation checked 9,967 regular files / 270,899,027 unpacked bytes, rejecting unsafe members without extracting paths. All 13 raw HTTPS samples match their actual artifact bytes. The entire stable manifest and all three installer files also equal accepted parent and current source, preserving pins.

Raw live response hashes

• / — f0cbee394d00fd9f1054b0cfc3aec74cb2e7ae32807bdd0b591420a2f2fe0b88
• /docs/polyglot/database-support/ — 20aa9256f043b70c736b5a7bf8658ffd3590552edaa0e9e9f9c7efa76d1c9228
• /uk/docs/polyglot/database-support/ — afbc2a61ced785623d1f4ee263992fc6f2bfa54beb074f383e7b8b07470007f5
• /es/docs/polyglot/database-support/ — 52cb8c37b8583a85615c2ad2efc71403de15f16b3c0d85de07f6aa6c5d13b075
• /pt-BR/docs/polyglot/database-support/ — 00759f3aa2172e3902f9a86ce7e55637cd8b389205277a86eea96adde49e1b9d
• /zh-Hans/docs/polyglot/database-support/ — 895a79c6500415f01ab7879500bed8beedda3d51d2b99a736a279b0ada80eeea
• /ja/docs/polyglot/database-support/ — f80d54e87a0cad9c594493209800660bb4b8a259561e2f67c202c32cdebe3623
• /fr/docs/polyglot/database-support/ — d3e6f7d6170ff7b43cb1e87edc7223f7322f4db408e67f49b31653293ed12850
• /de/docs/polyglot/database-support/ — 5cb1cc5c9f81f7e6432a0bee1da9ed90c572dd5fe0b194fa40f661695313db51
• /stable-releases.json — 1b42617a180a60b43ec896d520712caa785310a991442cf7f4e416bbb3e60445
• /install.sh — 5f17db134cd04cc455de1908df0d0d80d2e8e7de0d89731b58689fbb70313b18
• /install.ps1 — 52d3ef117eaa360527924a54401cb01d1d4aedaa5ca19c28846148eb39dffd0b
• /install-sdk.sh — 69f4818e451d87eced6f38faedf747390f2e0f84ebf11bbf08b89fc74246273f

Owned source/rust-preparation-controller cleanup is complete: exact tip 7db1eb5f, accepted ancestry, no dependent PR, terminal checks and clean workspace were verified before normal local/remote deletion; subsequent explicit reads confirm absence. The shared main worktree is preserved; this session is detached at accepted main.

The reviewed source-manifest remains bc15b52893ad2b82128846643c7a5d0ff3baad242059ecca21bb816b55eb74cf; both operation/installed-authority admissions remain None, current browser result is not-run, candidate stays disabled, and compatibility/rollout flags remain false. Automatic publication followers were checked: this Pages/source path uses Node/Python and no networked APT/setup-php. This source/site delivery neither runs nor admits real catalog/handoff/transport retention, seal, service, Docker/image, browser/provider/header/telemetry operations. Native/custody/effect and publishing-path gates retain their separate scope.

Next: General owns any separately bounded effect decision with fresh exact inputs; #268 stays open. Documentation owns future concrete source findings and ordinary delivery. The only remaining local PR, #457, still needs CLI’s requested/acknowledged qualified stable-2.5 source/package/installed/canonical Intel handoff; source merges do not satisfy that delivery gate. No extra preparation or source work is inferred from this receipt.