From 22634be9103eda6de26c6b02aa32f3320bc44034 Mon Sep 17 00:00:00 2001 From: tmk241 Date: Sun, 9 Aug 2026 18:22:35 +0200 Subject: [PATCH] docs(skill): document portable isolation profiles --- skills/apsuflow/SKILL.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/skills/apsuflow/SKILL.md b/skills/apsuflow/SKILL.md index 5cf32cc..56abc4a 100644 --- a/skills/apsuflow/SKILL.md +++ b/skills/apsuflow/SKILL.md @@ -43,12 +43,13 @@ in the same change when applicable requirements or CLI behavior change. - Cluster servers replicate control-plane state; agents execute workloads but do not add quorum votes. - The unprivileged service daemon owns OCI children inside its delegated cgroup - v2 subtree. A supervisor may prepare root-owned host networking/firewall state, - but the long-running daemon must not gain root merely to bypass a failed - profile. Stable host support is defined by Linux capabilities rather than a - distribution, libc, or init brand; advertise a concrete profile only after its - complete isolation and golden path pass. Routine CLI use remains unprivileged - and authenticated. + v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but + the long-running daemon must not gain root merely to bypass a failed profile. + The signed artifact is proved on systemd and runit profiles; support is defined + by equivalent Linux capabilities rather than a distribution, libc, or init + brand. `doctor` must name the effective supervisor and writable delegated + boundary, and apply must fail closed when that boundary is missing. Routine CLI + use remains unprivileged and authenticated. - `.apsu` contains desired workloads and infrastructure, never secret values or mutable runtime state. - Services are continuously reconciled. Jobs are finite run-to-completion work.