admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Milestone 6: hard-refuse flip, scoped to INVALID only -- closes Milestone 6

Browse Source 
Before flipping, found CAPSULE_SIG_MISSING (no signature at all) is the
normal state everywhere except this machine -- CI and any other
checkout have no access to the offline key, by design. Refusing on
MISSING the same as INVALID would brick boot everywhere but here.
Decided (on request): enforce ONLY on CAPSULE_SIG_INVALID (a signature
that IS present but doesn't verify -- unambiguous tampering/corruption
evidence). MISSING/NO_ROOT_KEY stay WARN-only permanently.

All three capsule_birth.c call sites now return CAPSULE_RUN_ERR_INVALID
on CAPSULE_SIG_INVALID, after logging the same WARN as before.

Verified on all three architectures, both directions, per the original
rollout commitment: positive case (real signed capsules) reboots clean
with zero warnings on amd64/aarch64/riscv64. Negative case (same
one-byte signature corruption used for the WARN-only proof, on Mama's
own init.4th) now genuinely refuses identically on all three:
"capsule sig: init.4th: INVALID" then "Init: Mama birth FAILED". The
feared "no ok> at all" blast radius didn't materialize -- kernel_main.c
already had graceful error handling for a failed Mama birth (log and
continue, pre-existing code); the kernel reaches a degraded ok> rather
than crashing, on all three architectures. Final acceptance pass (real
signed capsules, tampering reverted) clean on all three.

Milestone 6 is now fully closed except magic-number content-type
detection (shared with Milestone 4, separate scope, not started).
Documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd
This commit is contained in:
Robert Allan James
2026-08-26 22:08:20 -04:00
co-authored by Claude Sonnet 5
parent c640f99211
commit 030a3e6dc0
11 changed files with 63302 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.md
+26
View File
@@ -823,6 +823,32 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
magic-number content-type detection (Section U item 14, shared with Milestone 4, not
started) and the hard-refuse flip (deliberately deferred).**
**Hard-refuse flip, done 2026-08-26 -- and it landed narrower than the original plan
assumed.** Before flipping, found that `CAPSULE_SIG_MISSING` (no signature at all) is the
*normal* state on every machine except this one -- CI and any other checkout have no access
to the offline key, by design. Refusing on `MISSING` the same as `INVALID` would brick boot
everywhere but here, not catch anything real. **Decided (on request): enforce ONLY on
`CAPSULE_SIG_INVALID`** (a signature that IS present but doesn't verify -- unambiguous
tampering/corruption evidence, safe to refuse on regardless of who's building).
`MISSING`/`NO_ROOT_KEY` stay WARN-only permanently, not as a transitional state.
All three `capsule_birth.c` call sites now `return CAPSULE_RUN_ERR_INVALID` on
`CAPSULE_SIG_INVALID`, after logging the same WARN as before. **Verified on all three
architectures, both directions, exactly per the original rollout commitment:** the positive
case (real signed capsules) reboots clean with zero warnings on amd64/aarch64/riscv64,
identical to before this flip. The negative case (the same one-byte signature corruption
technique used for the WARN-only proof, on Mama's own `init.4th`) now genuinely refuses --
`capsule_birth_mama()` returns the error -- on all three architectures identically:
`capsule sig: init.4th: INVALID` followed by `Init: Mama birth FAILED`. **The feared "no
ok> at all" blast radius didn't materialize**: `kernel_main.c` already had graceful
error handling for a failed Mama birth (log and continue, pre-existing code, not written for
this feature) -- the kernel reaches a degraded `ok>` rather than crashing or hanging, on all
three architectures. Final acceptance pass (real, correctly-signed capsules, all tampering
reverted) clean on all three, zero warnings, conservation intact, real disk untouched.
**Milestone 6 is now fully closed** except magic-number content-type detection (shared with
Milestone 4, genuinely separate scope, not started).
### From FABRIC-2.md §X, Milestone 7 — Contributor capsules / trust tiers
- [ ] Create the `capsules/contrib/` directory (mechanically trivial, matches existing