sealr 0.1.0-alpha.6: reduced-authority Linux preview

sealr 0.1.0-alpha.6

This sixth development preview adds an explicit reduced-authority Linux execution path, activates it across the library, CLI, wheel laboratory, and extracted-package consumer, and establishes a machine-checked assurance-promotion contract. It keeps structural planning, destination publication, and final evidence authority in the supervisor while moving payload verification, stage writes, and later non-retained member reads into an authenticated restricted worker.

It remains a preview. The default APIs still run in process, structural ZIP planning is not confined, successful supervised execution is limited to x86_64 Linux with Landlock ABI 3, and this release does not claim general process containment or production readiness.

Highlights

• LinuxWorker::load_from_manifest authenticates one fixed sibling helper from a bounded release manifest. The manifest binds release version, target, bootstrap ABI, byte length, and lowercase SHA-256. The implementation never searches PATH, reopens the supplied helper pathname after authentication, or falls back to in-process execution.
• inspect_supervised and apply_supervised preserve archive rejection as an ordinary Outcome while reporting helper, restriction, protocol, timeout, exit, reap, cleanup, source, and integrity-boundary failures as typed SupervisionError values.
• The worker reaches single-threaded, no-descendant, inherited-descriptor-closed, no_new_privs, Landlock, and seccomp readiness before receiving the source descriptor. The supervisor applies absolute monotonic deadlines and ensures termination plus reap before authorizing cleanup.
• Structural planning remains supervisor-side. The worker receives the exact immutable source, a kernel-sealed bounded plan, and, for materialization, only the supervisor-created stage root. It does not receive the destination parent or publication authority.
• After clean worker exit and reap, the supervisor treats completion and retained-content records as untrusted proposals. It independently replays the accepted plan against its retained exact source and requires canonical byte-for-byte agreement before constructing public evidence.
• Supervised materialization keeps stage setup, exact post-reap tree audit, cleanup, and native no-replace publication in the supervisor. The worker cannot publish the destination.
• A supervised VerifiedArchive returns selected retained bytes captured during the original verification pass. Every non-retained read uses a fresh restricted worker and returns no bytes until exact EOF, correlated size, CRC32, SHA-256, clean exit, and reap have all been observed.
• The Linux release archive now includes a static musl worker at libexec/sealr/sealr-worker and its fixed manifest. The macOS and Windows archives remain helper-free, and attempts to activate the Linux worker surface there fail closed.
• The CLI selects the boundary only when --worker-manifest ABSOLUTE_PATH is provided. The wheel laboratory and extracted-package consumer use the same authenticated manifest without fallback.

Security and lifecycle evidence

• A required real-kernel gate boots a SHA-256-pinned Debian 6.1 kernel under QEMU TCG, independently observes Landlock ABI 2, and proves both public supervised operations fail with RestrictionUnavailable before source transfer because the production floor is ABI 3. The gate also requires no fallback, destination creation, leaked stage, outside-sentinel mutation, or surviving child.
• A 500-iteration native bootstrap campaign covers the complete 44-case non-stall matrix. Deterministic barriers and stalls cover descriptor rejection, protocol rejection, restriction failures, transport faults, abrupt exits, and timeouts while checking child, descriptor, source, stage, sentinel, and cleanup invariants.
• A separate 500-case public materialization lifecycle oracle runs on Linux, macOS, and Windows. It models successful publication, setup collision, CRC abort, and a deterministic destination race against independently computed expected outcomes.
• The private semantic-record boundary has bounded hostile decode, exact invocation and source binding, fallible input-sized allocation, plan-native Store and Deflate execution without structural reparse, immutable original-pass retention, and a required near-limit completion-memory probe.
• Twenty-four manifest-pinned semantic shadow cases compare production planning and completion behavior. Every additive v2 case records whether its independent oracle is ordinary apply, backend parity, or supervisor reproduction.
• The exact-main on-demand fuzz gate now requires both bounded worker-protocol and semantic-record AddressSanitizer jobs.

Assurance governance

• Kani 0.67.0 checks the exact production interval, quota, and ratio scalar kernels over their stated full-width domains, explicit assumptions, solvers, and unwind bound 1. These proofs do not cover parsing, codecs, filesystem effects, worker containment, or dependencies.
• Weekly bounded mutation and source-coverage jobs retain machine-readable discovery reports. Their results are leads, not correctness percentages or release scores.
• A checked promotion ledger keeps Kani, fuzzing, native resource evidence, mutation, and coverage as five distinct categories. An eligible check needs ten distinct consecutive successful scheduled main runs plus bounded local reproduction and explicit review. Manual runs do not count, a failure resets the sequence, and mutation and coverage cannot be promoted into required CI.
• Protected main retains one stable Required CI authority. It succeeds only after the six underlying platform, quality, ZipDiff, supply-chain, and real-kernel jobs succeed on the exact commit.

Packaging and verification

The tag workflow builds and tests native archives for x86_64 Linux, Apple silicon macOS, and x86_64 Windows. The Linux archive includes the authenticated helper contract; macOS and Windows explicitly reject helper entries. Each archive contains the CLI, README, changelog, Apache-2.0 license, and a target-specific locked dependency license bundle. SHA256SUMS and GitHub build provenance accompany the archives.

Release promotion requires protected exact-main CI, both exact-commit on-demand fuzz jobs, the release-candidate contract, a clean semantic walkthrough, license closure, immutable-release protection, and readback of the staged release before publication.

Important limitations

• apply, apply_with_options, and ordinary CLI execution remain in process. The reduced-authority path is explicit and fail closed.
• Structural parsing and policy planning still run in the supervisor before the worker receives the source. The worker boundary confines payload verification, stage writes, and later non-retained reads, not interpretation.
• Successful supervised execution requires x86_64 Linux, Landlock ABI 3, and the packaged helper contract. macOS, Windows, other architectures, and lower Landlock ABIs return typed unavailability.
• The seccomp filter is a measured deny set, not a complete syscall allowlist. Sealr makes no general network, IPC, CPU, memory, same-user, kernel-compromise, or production-containment claim.
• Unicode normalization and CP437 decoding remain absent. Non-ASCII member paths fail closed.
• ZIP64, TAR, compressed TAR, gzip, zstd, and 7z are unsupported. The wheel laboratory is compatibility evidence, not a supported wheel consumer profile.
• Receipts and preview tree identities remain unsigned. There is no stable semantic lock, authenticated archive-decision attestation, external security audit, or production-supported release.

See the README, supervised boundary evidence, helper packaging contract, assurance promotion contract, and release verification commands for the exact boundary and reproducible checks.