kernel: keep live audit custody private and host verifier retained - #1788
Draft
joshuajbouw wants to merge 11 commits into
Draft
joshuajbouw wants to merge 11 commits into
joshuajbouw wants to merge 11 commits into
Conversation
Provision boot audit identity and secret through CPUID-gated RDRAND, mint move-only signer and verifier custodians, and wire successful IPC EndpointCreate through one preflighted projection/audit/retire transaction before state commit. Serial emits only public custody identity and retired observation positions. Tracking #1759. Signed-off-by: Joshua J. Bouw <[email protected]>
Restore the base #1759 fragment and add a focused security fragment for the live boot custody and audited IPC grant slice. Signed-off-by: Joshua J. Bouw <[email protected]>
Enable explicit BLAKE3/zeroize erasure for provisioning and keyed custody state, bind checkpoint contexts to their live boot, forbid mixed buffered and immediate-retire relay modes, and move the IPC grant transaction into the owned audit module. Signed-off-by: Joshua J. Bouw <[email protected]>
Stage canonical audit records in chain-owned scratch and verify through a non-inlined append helper, shrinking the live runtime record frame while preserving preflighted atomic commit and verifier custody boundaries. Signed-off-by: Joshua J. Bouw <[email protected]>
Build the canonical frame directly in chain-owned storage and pass the grant event by reference, removing another frame-sized live block from the IPC audit path while preserving the same preflighted atomic transition. Signed-off-by: Joshua J. Bouw <[email protected]>
Open an explicit speculative verifier transaction before the relay authenticates the fold receipt. Commit the verifier only after successful retirement and restore its two cursor fields on failure, with a production-faithful altered-receipt regression. Signed-off-by: Joshua J. Bouw <[email protected]>
Replace reusable speculative verifier methods with consuming open and folded states, bind retirement to the transaction receipt and staged identity, and add identity/rollback falsifiers for the exactly-once transition. Signed-off-by: Joshua J. Bouw <[email protected]>
Commit a provisional verifier fold only with a live-custody checkpoint minted after relay receipt authentication, move retained-evidence folding to its own verifier type, and add API and rollback falsifiers for pre-auth commit and path substitution. Signed-off-by: Joshua J. Bouw <[email protected]>
Signed-off-by: Joshua J. Bouw <[email protected]>
Move the live verifier into kernel-private AuditChain custody and reduce native-audit-verifier to retained/offline evidence. Prepared live state is consuming and bound to identity, sequence, root, frame, and relay authentication. Excludes ABI, WIT, schema, and fixture changes. Tracking #1759 Signed-off-by: Joshua J. Bouw <[email protected]>
Live custody now consumes move-only reservations, owns the unkeyed root fold, and privately mints the receipt before independent relay authentication. Chain live staging no longer precomputes a duplicate root, stale canonical frames are rejected, and the kernel checkpoint restore constructor is removed while retained/offline host restore remains. Signed-off-by: Joshua J. Bouw <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked Issue
Tracking #1759. Related: #1790 and #1792.
Summary
Keeps live audit custody private to the kernel and retains the host verifier.
The source was independently accepted at the current head. Landing remains blocked by the Windows x86 storage-callback certification failure and by stale integration ancestry. This PR is preserved as an accepted source candidate, not as release or merge approval.
Changes
Verification
os/universalmust be re-pinned before any landing decision.AI / Tool Assistance
Assisted-by: Codex:GLM-5.3 Flash
AI assistance was used for implementation. Independent review and the final landing decision remain maintainer-owned.
Checklist