Execute one sealed filesystem ELF from real Zsh #148

Outcome

Implement the owner-approved #12 design: real Zsh executes one sealed 1..4096-byte native Rust ELF acquired from live OpenZFS through the existing Rust Owner, validates startup/READY, returns23, prints23 and returns to the prompt. Then exit normally with engine export/mode restoration/reclamation and known host cleanup.

Authority and selected delivery

Cam approved the exact reviewed proposal in this chat on2026-11-04; decision record. #12 owns completed design acceptance; this issue alone owns implementation/verification/delivery. Lead: root. Responsibilities: kernel enforcement and userland filesystem/runtime. Public base main e55ce33, tree4f1290b1fc96b8831f7f1b219d457135b05a67a3. Preserve the existing branch and all foreign WIP; publish only reviewed changes on public main. Runtime role/model routing remains unverified.

Scope and exclusions

Default-off native-zsh-file-exec composition; only actual Rust Owner lifetime may use new0x2300B with exact frozen helper and complete snapshot. Provision/seal existing /home/probe with one ELF write; retain namespace custody and deny all untrusted mutations. Save672-byte request, EOF-first/exact-read/post-stat/checked-close into existing4096 workspace. Reuse eager loader and query/publish with C004 receipt; clear private scratch and deny all three C003 fallback routes. Keep old profiles exact. No generic VM/pager/dynamic linker, PATH runner, package activation, login, arbitrary exec or R1 acceptance.

Acceptance

• Record the exact approved authority/fit/checkpoint decision in canonical policy before code.
• Implement scoped kernel snapshot/install, complete preflight before destruction, old-child/receipt preservation on known failure, C004 query/publication and all three boot-cache denials.
• Implement sealed actual-object acquisition in Rust Owner, disjoint request/workspace lifetimes, failed/unknown close/read no-exec/no-replay and old-profile compatibility.
• Produce actual complete tiny Rust ELF<=4096 validating336-byte startup and native identity before READY/exit23; fresh affected code/data/stack/backing/request fits stay within all existing ceilings.
• Focused authority/loader/Owner failure and positive/omission controls pass; separate integrated source/artifact review resolves findings.
• One reviewed bounded real-Zsh44-byte trial proves helper23/status23/prompt, READY/C004, parent-only MODE/SIGINT, normal parent/engine export, mode restore, three reclaims and known host cleanup.
• Required protected CI and separate final review pass; reviewed public PR merges, exact tree verified, issues/parents reconciled, owned generated outputs disposed with compact retained results/failures.

Bounds, tests and stopping

Keep bootstrap2+terminfo4+ELFwrite1=7/9 mutations,96 requests; Owner73728 RX,12288 mapped/12280 usable stack,4096 Runtime/workspace each,128 backing pages; existing app/engine/task/channel/worker/capture bounds. No numerical increase. Fresh actual tiny ELF/Owner/kernel/loader fits, disjointness and separate source/artifact review precede image. Reuse unchanged evidence only by source/input/impact proof.

Use focused existing actual-body/parser/Owner checks for caller/profile/object/epoch/child/freeze, all3C003 fallback denials before/after bad scratch,0/4096/4097/inaccessible trailing range, malformed ELF/W^X/overlap/BSS/table/backing, scratch cleanup/old-state preservation, C004/publication/startup, sealed alias denial, EOF/short/unknown/failed-close and no-exec/no-replay; retain old C003/#143/#145 positives. Do not add generic runner/host attestation/other-OS campaigns.

Approved fixed guarded workload evidence and focused delivery exception apply only here while #141 remains open:60s writer/120s total/6000ticks, disposable media, no network, finite attempts, once-only input, no automatic retry, exact source/artifact/media binding and known cleanup. Preserve every failed attempt; diagnose and obtain a fresh reviewed candidate before another run. Unknown effect, repeated unexplained failure, fit failure or consequential new design/authority/resource choice stops dependent work for replan. Routine accepted builds/checks/reviewed tests/GitHub delivery retain standing approval. No full-root pass or release claim.

Documentation and maintenance

Update affected kernel/userland references, selected profile/build entry points and docs/workflow.json for any added native references/scripts. Preserve machine protocols, pins, private standards/evidence and licenses. Use the whole-file snapshot plus existing eager transaction instead of streamed staging or general VM. Reuse the existing probe and exact-seven engine after impact proof; no new create/exact-eight provider. No obsolete production path is removed in this slice.

Completed —2026-11-04

Delivered by PR149, protected squash merge 8e944fdf61fff31f48fd5de686e67958f030e592. Tree 2138960f801035181ccb8c928d63aaede3ac83e4 exactly matches separately reviewed head 5da8a7959ef8e22bd1cea5a93119c8dcb18eebfe. Required Source integrity and Kernel models pass on that exact head (PR run41882786862); normal commit/push hooks were not bypassed.

One actual reviewed no-network/disposable-media Zsh trial passed in38.678s: the3548-byte filesystem ELF used17 backing pages, validated full336 startup/native identity, reported READY/C004, exited23, and Zsh printed23 and returned to its prompt. Normal parent/exact-seven engine exit/export, source close, mode restoration,21 cleanup phases and three reclamations passed at halt3225/6000 ticks using42/96 requests. Both original host holders and all five Screen clients have known cleanup. Exact execution hash 92deb0b1e5e942674db11e0661401678b8479e21ddf91857f9874cbd5c0b8d4a; separate native-result and final export reviews found no findings.

Fresh fits retain all ceilings: Owner73552/73728 RX,3968/4096 Runtime,4096 workspace,10208/12280 conservative stack,23/128 backing pages; tiny ELF3548/4096 and compiled stack1680; selected kernel normal/recoverable chain61440/65536. Focused authority/loader/acquisition/close/receipt/READY/fallback/old-profile and semantic omission controls pass. Earlier failed setup, initial non-LTO size, harness and aggregate-timing attempts remain distinct; later narrowed existing-artifact analysis resolved selected stack coverage without a rebuild, limit increase or gate waiver. General fatal-panic/IRQ/peak proof is not claimed.

Exactly seven known-settled generated roots, ISO/kernel/ELF/cache copies, vars and disposable media were removed after retaining compact commands/hashes/failures and small serial/prompt records. Current sealed inputs/dependencies, private history, public branch, foreign WIP and the old UNKNOWN quarantine remain. Parents #5/#8/#10/#11 and system navigation are reconciled.

This completes only the approved fixed filesystem-exec checkpoint. #141, general execution/pipelines/redirection/job behavior, assembled sys-init/login, cold boot-to-program, packages and R1 remain separate gates. No new implementation batch or guest campaign is selected by completion.