Repository navigation
REQ 117
The lane executor shall run every tool probe, candidate extraction, and workload step as an unprivileged account created for that run, never as root.
This is the execution-privilege obligation extracted from REQ-107 to keep each normative statement singular. The key-bound root channel is reserved for controlled setup, not execution of the untrusted candidate. Root execution of candidate work could rewrite the supervisor, launcher, or phase specification protected by REQ-106. The split preserves both channel and execution safeguards and their existing verification links.
The run creates pb-workload with nonzero user/group IDs, no login shell, and no cron or at access; an already existing account is refused. Every probe, extraction, fetch, and build step executes under that account's user ID. The supervisor, launcher, specification, and secrets file remain root-owned in the run directory created by root; checks cover owner, mode, link count, size, and SHA-256 except for the secrets file, as specified in REQ-107. A pre-existing /run/projectbuddy-lane, mismatching placed file, submodule, or non-UTF-8 candidate path stops execution before workload launch. Workload attempts to modify the protected directory/files, read the secrets file directly, or schedule cron/at jobs fail; only the declared build-phase standard-input secret delivery in REQ-093 is permitted. Root SSH for verified setup does not authorize root execution of any candidate-controlled step. The remaining channel readiness and instance-binding checks stay in REQ-107.
Planned live observations in TEST-109 are unchanged. Existing offline placement/channel fixtures are the previously documented basis, not newly executed proof; the authoring split does not upgrade the baseline status.
SYS-REQ-027; extracted from REQ-107 and constrained by REQ-106
High
Existing scripts/tests/test_lane_placement.py workload-account and protected-file cases, scripts/tests/test_lane_channel.py channel fixtures, and scripts/tests/test_lane_docs.py placement/procedure correspondence; planned TEST-109 live isolation observations remain required.
scripts/lane/plan.py (create-account and placement steps), scripts/lane/placement.py (workload account and protected placed files), and scripts/lane/supervisor.py (workload phase execution), with docs/vm-provisioning/ubuntu-lane.md. Root-session identity and instance binding remain allocated to REQ-107.
Planned; extracted existing obligation, baseline offline fixture evidence only and no live proof