Add research/0002: virtualisation and containment prior art

[MatejGomboc]

What

The second prior-art review — the goldmine you called: what virtualisation and containerisation learned under production fire, mined for Setonix. Six research sweeps (four planned domains + two gaps a completeness critic found by checking coverage against all twenty obligations), 69 lessons, primary sources only — papers, official design docs, CVE analyses, maintainer postmortems. Every lesson carries a verdict (adopt / adapt / reject / validates-existing) and names the pillar, obligation, or RFC it feeds.

Headline findings

16 lessons are validation with production numbers — the container era's survivors each rebuilt part of Setonix's architecture as a retrofit, at retrofit prices: gVisor (a second kernel in Go to get a narrow interface), Kata (a VM per pod — the industry's confession that shared-kernel isolation failed), the runc maintainer's ~14 path-string CVEs ending at handle-not-path, Kubernetes re-deriving capability-shaped grants (KEP-1205's object-bound tokens are RFC-0003 §8's generation check, reinvented).

The decision-forcing findings:

• Store (RFC-0001): the naming scheme — Merkle root over fixed-size chunks — must be decided before the store is built; ostree's composefs retrofit shows naming is the decision that cannot be changed cheaply. Resolves open questions 1–3 (signed compound closure root, detached signatures, references-graph GC).
• Broker RFC: a decade of confused-deputy CVEs (CVE-2018-1002105, CVE-2020-8559, RBAC escalate, Trail of Bits audit) distilled into design rules + three proposed obligations: O-21 mediation auditability, O-22 broker compromise containment, O-23 fail-closed mediation. Plus: the bootstrap grant graph must be provably acyclic, and system:masters-style bootstrap superusers are rejected by name.
• Scheme registry (pillar 5 / O-11): Capsicum + openat2 arrive as the specification — resolve once to a held capability, bounded during resolution, no alias nodes — expressible entirely within RFC-0003's existing calculus (O-11 falls out of O-2).
• Scheduler/RFC-0004: seL4 MCS ships with a named budget-expiry-inside-server hole; proposed RFC-0004 amendment adopts the budget-threshold prevention + defined recovery, beside the withheld-reply denial it already names.
• Rejected by name: eBPF-style in-kernel extensibility (an unreviewable trusted compiler in ring 0), command-keyed build caches (poisonable), bootstrap superusers.

Flagged for the maintainer, not taken: three proposed §3 graves (drivers pulled into the kernel for the fast path — vhost-net; compiled-in unused device paths — VENOM; the catch-all right — CAP_SYS_ADMIN). Constitution text is yours; wording ready on request.

Method note

Four domain researchers ran in parallel; a completeness critic then checked the combined lessons against O-1…O-20 and found exactly two load-bearing holes — O-10 was the only unfed obligation, pillar 5 the thinnest — which two follow-up sweeps closed. Logged in docs/CHANGELOG.md.

Follow-ups this proposes (each its own future PR, per §5.3)

1. Threat-model amendments (O-21…O-23, TUF attack obligations, A5's userspace half, spawn inheritance)
2. RFC-0004 amendment (budget-expiry protocol)
3. Constitution §3 graves — your verdict
4. The bootstrap/initial-object-set RFC now has substantial input (acyclic grant graph, no superuser, single-use detectable first-grant delivery)

Markdown and British-spelling gates clean (66 files).

🤖 Generated with Claude Code