statecraft.
Catalog/statecraft-cli

042-per-run-provider-configuration

Per-run provider configuration and a measured Mach-service allowlist close spec 004's two open items against IX

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Amends 004 section 3.18 to close the two items its rule 12 names as open against constitution IX. A confined provider process gets its own configuration directory inside the attempt, discarded after it, and is authenticated by a provider token the operator provisions once, so the child no longer writes any file that an unconfined process later loads. On macOS every Mach service is refused except an allowlist measured against a confined provider session. Both rest on live measurements this spec names, and the first confined provider session is the activation rule 12 defers.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "docs/adoption/042-provider-measurements.md"
}
  • extends
    {
  "nature": "additive",
  "spec": "004-execution-adapter",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-adapter/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "002-environment-lifecycle",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-home/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "006-command-surface",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-cli/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "002-environment-lifecycle",
  "unit": {
    "kind": "file",
    "path": "scripts/acceptance/managed-session.sh"
  }
}

Source headings

  1. 042: Per-run provider configuration and a measured Mach-service allowlist
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 The per-run configuration directory
  6. 3.2 The provider token
  7. 3.3 The constructed environment
  8. 3.4 The Mach-service allowlist
  9. 3.5 What closes, and what is measured
  10. 3.6 Observable negative cases
  11. 4. Out of scope
  12. 5. Resolved decisions
  13. Verification

Frozen anchors

No frozen anchors declared.