From ff20cb6159db95483004fae73e8f3c15259fabc0 Mon Sep 17 00:00:00 2001 From: Matej Gomboc Date: Sat, 1 Aug 2026 11:47:48 +0200 Subject: [PATCH] Amend Constitution: three graves, and reconcile the broker's phasing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both on the maintainer's authorisation. §3 gains three graves from the second prior-art review, each a documented production disaster mapped to a Setonix decision: drivers pulled into the kernel for the fast path (vhost-net, CVE-2019-14835), compiled-in but unused device paths (VENOM, CVE-2015-3456), and the catch-all right that decays into root (CAP_SYS_ADMIN). §10 is clarified to state that scheme mediation begins in Phase 2 (the scheme registry is the first broker-shaped component) while the full broker pillar - grant policy, prompt surface, revocation - lands in Phase 3. This removes a disagreement the research/0002 follow-through exposed: the threat model's §8 binds O-10 (confused deputy) and O-11 (scheme escape) in Phase 2, correct because mediation exists from the registry, yet §10 had grouped the whole broker under Phase 3 so §8 appeared to contradict the roadmap it maps against. §8 gains a paragraph stating the split, and now the two documents agree: mediation starts in Phase 2, the broker pillar and O-21..O-23 land in Phase 3. Logged in docs/CHANGELOG.md, as constitutional amendments always are. Co-Authored-By: Claude Fable 5 --- CONSTITUTION.md | 13 +++++++++---- docs/CHANGELOG.md | 17 +++++++++++++++++ docs/threat-model.md | 7 +++++++ 3 files changed, 33 insertions(+), 4 deletions(-) diff --git a/CONSTITUTION.md b/CONSTITUTION.md index 88725f4..e275b2c 100644 --- a/CONSTITUTION.md +++ b/CONSTITUTION.md @@ -82,7 +82,9 @@ The kernel is hand-written and minimal. It provides mechanism, never policy. *(Fuchsia/Zircon)* - **Known graves to avoid:** multi-copy IPC (Mach), policy in the kernel (early microkernels), baroque capability hierarchies (KeyKOS), bolted-on - multicore support. + multicore support, drivers pulled into the kernel for the fast path + (vhost-net), compiled-in but unused device paths (VENOM), and the catch-all + right that decays into root (CAP_SYS_ADMIN). ## 4. The Borrow Ledger @@ -282,9 +284,12 @@ replacing Linux, supporting every board on earth. IPC fast path, capability tables, MMU, UART console. Then the same kernel on QEMU x86_64 `q35`, proving the HAL boundary. - **Phase 2 — Voice.** Scheme registry, first userspace driver (virtio), - minimal runtime; port first Redox drivers. -- **Phase 3 — Soul.** The pillars: broker, signed content-addressed app - format, updater. First real app runs confined. + minimal runtime; port first Redox drivers. Scheme mediation begins here — the + registry is the first broker-shaped component — so the confused-deputy and + scheme-escape obligations bind from this phase, ahead of the full broker. +- **Phase 3 — Soul.** The pillars: the full broker (grant policy, prompt + surface, revocation), signed content-addressed app format, updater. First + real app runs confined. - **Phase 4 — Company.** Publish, write the show-don't-tell posts, open to contributors. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index eb29580..3fd275e 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -127,6 +127,23 @@ recorded is indistinguishable from law that was never agreed. ### Changed +- **Constitution §3 amended, on the maintainer's authorisation (2026-08-01): three graves added from + the second prior-art review.** The "known graves to avoid" list gains *drivers pulled into the + kernel for the fast path* (vhost-net's CVE-2019-14835 guest-to-host-kernel escape, the userspace- + driver doctrine argued by counterexample), *compiled-in but unused device paths* (VENOM, + CVE-2015-3456 — a floppy controller exploitable with no floppy configured; "absent beats disabled"), + and *the catch-all right that decays into root* (CAP_SYS_ADMIN — a standing review rule on `Rights` + growth). All three are documented production disasters the review mapped to Setonix decisions; + taking them as graves makes the doctrine list say so. +- **Constitution §10 clarified, and the threat model's §8 reconciled with it (2026-08-01): where the + broker binds.** The roadmap's Phase 2 — Voice now states that scheme mediation begins there (the + scheme registry is the first broker-shaped component), and Phase 3 — Soul names the *full* broker + (grant policy, prompt surface, revocation). This removes a disagreement the second prior-art + review's follow-through exposed: the threat model's §8 binds O-10 (confused deputy) and O-11 (scheme + escape) in Phase 2, which is correct because mediation exists from the scheme registry — but §10 had + grouped the whole broker under Phase 3, so §8 appeared to contradict the roadmap it maps against. + Both documents now agree: *mediation* (the O-10 surface) starts in Phase 2; the *broker pillar* and + its own obligations O-21..O-23 land in Phase 3. §8 gains a paragraph stating the split explicitly. - **Threat model amended (2026-08-01): seven obligations from the second prior-art review, and a fast-forward clause on O-15.** The [virtualisation and containment review](research/0002-virtualisation-and-containment-prior-art.md) surfaced gaps that no existing obligation covered; per §11's "new surface, new obligation" rule they diff --git a/docs/threat-model.md b/docs/threat-model.md index 745ed74..777045f 100644 --- a/docs/threat-model.md +++ b/docs/threat-model.md @@ -320,6 +320,13 @@ hidden. | **Phase 2 — Voice** | scheme registry, first userspace driver | O-9, O-10, O-11, O-17 bind; O-26 binds with the first multiplexing server; O-18 becomes relevant as soon as a driver can DMA | | **Phase 3 — Soul** | broker, signing, store, updater | O-12, O-14, O-15, O-16 bind; O-21, O-22, O-23 bind with the broker; O-24, O-25 bind with the store and updater; O-13's W^X becomes load-path-enforced | +The broker's obligations bind across two phases on purpose, and the constitution's §10 was clarified +to match: O-10 and O-11 bind in **Phase 2** because the scheme registry that lands then is itself the +first broker-shaped mediator, so the confused-deputy and scheme-escape disciplines apply the moment +mediation exists — while the full-broker obligations O-21..O-23 bind in **Phase 3** with the broker +pillar (grant policy, prompt surface, revocation). "Broker" is therefore a Phase-3 deliverable, but +*mediation* — the surface O-10 guards — is not deferred to it. + Today, three of twenty-seven obligations are Built. That ratio is the honest status of a Phase-1 kernel, and stating it is the point: this document is the specification the ratio is meant to climb against, not a description of a system that already holds the line. The seven obligations the second