Repository navigation
feat(packs): preserve signed environment launch requirements through bundle admission #4225
Description
Tracking: #4222
Scope
Implement a versioned typed environment descriptor using canonical BundleMember extension; preserve compatibility and fail closed for unsupported requirements. Reuse existing workload IR and runtime admission.
Acceptance
- Contract/export/verification/install/admission changed together, deliberate schema-version decision with old-reader fixtures.
- Entrypoint, resources, volumes, logical secret slots and required capabilities survive export/install.
- Advisory BundleResources mapped explicitly to launch defaults/host policy, not treated as enforced by signature alone.
- No security semantics in labels or silently ignored sidecar fields.
- Application service processes kept distinct from broker service IDs.
- Complete embedded boot closure; empty-cache archive-only boot.
- Tamper, incompatible base/arch, unsupported descriptor and secret-boundary refusal tests.
Depends on neutral contract; coordinate #3928 and #3950.
Invariants
Reuse mvm-contract IR, mvm-sdk compiler, mvm-build jobs, mvm-client, mvm-bundler, and existing verification/admission. No second Nix generator, OCI puller, bundler, signer, or verifier. Builder/author code receives no publisher credentials. No guest NIC; existing authenticated vsock/FlowMux path only. No raw secrets in guest; preserve endpoint-side substitution. Existing lightweight packs remain compatible.
Delivery / closure
- Focused implementation PR links this issue and its dependencies.
- Tests and actual-use witnesses are recorded; missing infrastructure is reported, not marked passed.
- PR merged (or intentionally closed with disposition); only then close completed scope.
- Task-owned clean worktree removed after closure; uncommitted work preserved, never force-removed. Delta-managed worktrees use Delta lifecycle rather than manual deletion.
Activity
auser commentedon Oct 12, 2026
Taking this: typed environment descriptor as a bundle member, carried through export, verification, install and admission.
auser commentedon Oct 12, 2026
PR #4378 is in the merge queue with auto-merge on. The archive-only boot of a bundle carrying a signed environment is witnessed natively in #4399. A fresh consumer home installs the pack and runs its entrypoint. Admission enforces the environment: an earlier build that declared the authored argv instead of the image's own entrypoint was refused as an entrypoint mismatch. I will close this when #4378 merges.
auser commentedon Oct 13, 2026
Delivery disposition: #4378 merged as 8e316cf through the protected merge queue, with CI run38456129334 successful. Only the linked-PR and actual-merge delivery boxes are newly checked; this issue remains open.
Landed code preserves schema5 signed environment data, shared host required-slot validation on self/external admission, ordinary entrypoint-resolution refusal vs explicit overrides, refusal auditing and nonce semantics, and advisory launch defaults. Tests include synthetic locally signed fixtures, not released-image/native evidence.
Still unverified: complete embedded boot closure and fully empty-cache archive-only boot; current corrected pack-build native witness is pending. Services remain recorded/displayed rather than started; working-directory launch enforcement is not claimed. Portable runtime/schema6 and public release/signing evidence remain separately gated. No completed epic/PS-06, clean-worktree removal or actual-use acceptance is claimed by this merge.
auser commentedon Oct 14, 2026
Closing: implemented in PR #4378 (signed environment descriptor through export and admission). The EnvironmentDescriptor as BundleMember::Environment, checked on export, verification, install and admission, is delivered.
auser commentedon Oct 14, 2026
Correction to this session’s earlier closure: a pending/mergeable PR or an assumed post-launch deferral does not prove acceptance complete. Restoring this issue for evidence-backed reconciliation: landed implementation, required validation, and any explicit owner-approved scope decision. This is not a new regression.