Problem
The exact Polymarket Gate service runs as root with ProtectHome=true. Its real-segment preflight uploader correctly drops to hftcollector with HOME=/var/lib/hft-collector, but the subsequent root-owned immutable OSS triplet readback inherits HOME=/root. Aliyun CLI then attempts to create /root/.aliyun and exits before the Rust shadow starts.
Runtime evidence from formal Gate InvocationID 3b770d84e3b4416f998520cb8de6253b:
runuser successfully opened and closed a session for hftcollector;- the candidate uploader wrote terminal-success output;
- the root readback panicked with
mkdir /root/.aliyun: read-only file system;
- Gate failed closed in 51 seconds, shadow remained inactive, Python remained active.
Focused ECS counterexample t-jpn6sgse15pansw reproduces the same OSS command under the Gate hardening: without an explicit HOME it fails (rc=2); with HOME=/var/lib/hft-collector it passes.
Change contract
Give the Gate service the same explicit HOME=/var/lib/hft-collector already used by the production Polymarket uploader units, while retaining ProtectHome=true, NoNewPrivileges=true, AmbientCapabilities=CAP_SETUID CAP_SETGID, and RestrictSUIDSGID=true. Its locked installer may atomically replace a secure, inactive prior Gate unit and must refuse replacement while any Gate is running.
Acceptance evidence
- Focused control-plane test requires the explicit HOME and has a counterexample that removes it.
- Installer test rejects a running-Gate replacement and verifies an inactive atomic upgrade with previous-SHA evidence.
bash -n, ShellCheck, and the focused control-plane test pass.- Exact release is rebuilt and independently hash/readback verified.
- Real closed-segment preflight passes, then a fresh 900+601 second formal Gate passes before cutover.
Out of scope
Rollout / rollback
Roll out only through the exact source-bound release and formal Gate. On any failure, stop/contain shadow and retain Python. The previous Gate unit is preserved in immutable runtime evidence for rollback.
Runtime control
- Target: ECS
i-6we6afeqsvv8uo1ixmyo, Polymarket raw-ops Gate service only.
- Candidate: exact source-bound artifact produced after this issue's PR merges; hashes must be independently verified before use.
- Controller:
/root.
- Stop rule: any identity, real-segment, OSS readback, shadow health, backlog, failure, parity, or immutable evidence mismatch fails closed before cutover.
- Rollback: stop and contain Rust shadow, retain the active Python services, and restore the previous Gate unit from the immutable upgrade evidence.
Problem
The exact Polymarket Gate service runs as root with
ProtectHome=true. Its real-segment preflight uploader correctly drops tohftcollectorwithHOME=/var/lib/hft-collector, but the subsequent root-owned immutable OSS triplet readback inheritsHOME=/root. Aliyun CLI then attempts to create/root/.aliyunand exits before the Rust shadow starts.Runtime evidence from formal Gate InvocationID
3b770d84e3b4416f998520cb8de6253b:runusersuccessfully opened and closed a session forhftcollector;mkdir /root/.aliyun: read-only file system;Focused ECS counterexample
t-jpn6sgse15panswreproduces the same OSS command under the Gate hardening: without an explicit HOME it fails (rc=2); withHOME=/var/lib/hft-collectorit passes.Change contract
Give the Gate service the same explicit
HOME=/var/lib/hft-collectoralready used by the production Polymarket uploader units, while retainingProtectHome=true,NoNewPrivileges=true,AmbientCapabilities=CAP_SETUID CAP_SETGID, andRestrictSUIDSGID=true. Its locked installer may atomically replace a secure, inactive prior Gate unit and must refuse replacement while any Gate is running.Acceptance evidence
bash -n, ShellCheck, and the focused control-plane test pass.Out of scope
Rollout / rollback
Roll out only through the exact source-bound release and formal Gate. On any failure, stop/contain shadow and retain Python. The previous Gate unit is preserved in immutable runtime evidence for rollback.
Runtime control
i-6we6afeqsvv8uo1ixmyo, Polymarket raw-ops Gate service only./root.