[gregoryfoster]

Closes #2. Plan: docs/plans/2026-10-06-2-contain-the-child.md. Gate 2 approved 2026-10-06.

What

Layer 1: the child contains itself. src/processor/_contain.py uses stdlib ctypes only, so no new dependency.

• Landlock, on a read/execute allowlist derived from the interpreter:
  • each sys.path entry, the stdlib, the directories of the shared libraries already loaded, ld.so.cache, and the mime-types files co-core reads at import;
  • /, /etc, /home, a home directory, and any directory holding a .env are refused;
  • no TCP bind or connect;
  • abstract unix sockets and signals are scoped.
• seccomp: socket, socketpair and io_uring_* fail with EPERM, and another arch's syscalls kill the child. Landlock on 6.12 lets a connect to a pathname unix socket through (tailscaled's socket is 0666), and a test pins that gap.
• Ordering: _child contains itself before it reads its request, and exits 70 if it can't, which counts as a strike.

Layer 2: the parent is undumpable. processor run calls PR_SET_DUMPABLE 0 first. It refuses to start under CO_PROCESSOR_CHILD_CONTAINMENT=required (the default) wherever the child can't be contained. starting now logs build, child_containment and landlock_abi.

Layer 3: a dedicated user and releases. This follows the cohort standard, broker#22 as shipped in status#9 (R1–R13).

• The unit runs as processor from /srv/processor/live → releases/<build>. It takes the GCS key through LoadCredential=, and adds ProtectSystem=strict and ProtectHome=yes.
• scripts/deploy.sh:
  • builds from a commit on origin/main: git archive plus the wheelhouse, then uv sync --locked --no-editable on /usr/bin/python3.12, with REVISION written last and the release made a-w,go+rX;
  • switches live atomically and installs the unit from the release;
  • verifies the new MainPID's starting (this build, required) and then consuming, followed by the smoke run as processor through systemd-run;
  • switches back on failure: exit 1 when the old build answers, 4 when nothing does.

Evidence

• Local: 363 passed, 1 skipped (a worktree has no repo .env). Header: child containment: required (Landlock ABI 6).
• CI: green, required (Landlock ABI 7). The first run caught a real bug, fixed in 4f7a6ec: the library directories had come from sysconfig's LIBDIR, which on setup-python is not the system's, so libgcc_s was refused.
• Every denial is paired with an uncontained control:
  • reading a file outside the allowlist, the real /etc/processor/.env and GCS key, /proc/<parent>/environ, and a home file;
  • writing;
  • TCP to a live listener and to 127.0.0.1:6379;
  • a unix socket, /run/docker.sock and tailscaled.sock;
  • signalling the parent, and exec /bin/sh.
• The whole corpus (cases plus real/, 22 inputs) is identical through the contained child. It was also run from a real release built with the deploy's own steps.
• scripts/deploy.sh has 23 end-to-end tests with stubs, mutation-checked.

Rollout (gate 3; the plan's § Rollout)

• Stage A, after the FF merge: the old path (git pull && uv sync --frozen --no-dev && sudo systemctl restart processor). Layers 1 and 2 go live while the service still runs as exedev. Rollback: CO_PROCESSOR_CHILD_CONTAINMENT=off.
• Stage B, the operator's install: DEPLOYMENT.md § Install, ending with scripts/deploy.sh. Rollback: DEPLOYMENT.md § Rollback.

Follow-ups to file: processor's CI gate and drift check (status#11 and #12). The feedback for the cohort skill is in the plan's last section and is linked from Provisioner#23.

🤖 Generated with Claude Code