Skip to content

ExecSurface v0.1.0-alpha.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 19:47
· 981 commits to main since this release
v0.1.0-alpha.4
48e0b9a

ExecSurface v0.1.0-alpha.4

Fourth public alpha for the portable fail-closed hardening validated under M10–M12.

Reliability hardening

  • changes known clone-based fd-lifecycle ambiguity from potentially complete=true evidence to explicit incomplete / non-PASS-eligible evidence;
  • preserves the underlying shared-FD limitation rather than claiming exact attribution repair;
  • the portable ptrace guard may conservatively mark some clone/thread concurrency incomplete even when exact fd-table sharing is not proven; raw observation v2 does not retain enough CLONE_FILES detail to certify exact sharing, so this intentionally trades possible false incompleteness for preventing the known false-completeness class;
  • keeps event-budget loss and other known incomplete-evidence states fail-closed;
  • retains existing PASS / REVIEW / BLOCK / ERROR policy semantics and stable CLI exit-code behavior.

Evidence authority boundary

  • ptrace pathname observations remain pathname access-attempt metadata under the recorded observer; they are not represented as kernel-object identity;
  • adversarial PATH-TOCTOU and shared-FD counterexamples remain documented and reproduced in the M12 release review;
  • experimental/hybrid evidence capabilities remain explicit and proposition-scoped rather than silently treated as equivalent to the public ptrace path.

Compatibility and distribution

  • Linux x86_64 remains the public support scope;
  • native ptrace remains the public default/reference observer for the portable release line;
  • existing baseline-v2 serialization/digest semantics are unchanged and legacy schemas are not silently reinterpreted;
  • GitHub Release binary, crates.io package chain, and AETHERXGLOBAL/execsurface@v0.1 are the public distribution surfaces after their respective release gates complete.

Hybrid/BPF-LSM status

BPF-LSM / kernel-hook work remains managed/research-only and non-default. This alpha does not authorize automatic hybrid selection, new privilege requirements for the portable path, ptrace↔hybrid baseline interchangeability, or claims of end-to-end hybrid production readiness.

Performance scope

M12 paired hosted-CI benchmarks found no preregistered gate-blocking performance, RSS, binary-size, or event-shape regression in the tested Ubuntu 22.04 and 24.04 environments. This is engineering evidence for the release decision, not a universal performance-improvement or production-cost claim.

Product boundary

ExecSurface detects observed execution-surface drift under its recorded observer and explicit policy. It does not prove software safety, observed behavior is not all possible behavior, and incomplete evidence cannot silently become PASS.

Source commit: 48e0b9a0707553349e75e97a9dfa096d13f9ab5d

Build workflow: https://github.com/AETHERXGLOBAL/execsurface/actions/runs/36474542683

Assets 4
Loading