From bb8bc5cdf655b9b9f668b12998b65f05e8a67bef Mon Sep 17 00:00:00 2001 From: tmk241 Date: Sun, 9 Aug 2026 21:00:42 +0200 Subject: [PATCH] docs(skill): describe kernel host contract --- skills/apsuflow/SKILL.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/skills/apsuflow/SKILL.md b/skills/apsuflow/SKILL.md index 56abc4a..3e5cb87 100644 --- a/skills/apsuflow/SKILL.md +++ b/skills/apsuflow/SKILL.md @@ -42,14 +42,13 @@ in the same change when applicable requirements or CLI behavior change. - Solo mode is one loopback-bound server without cluster mesh overhead. - Cluster servers replicate control-plane state; agents execute workloads but do not add quorum votes. -- The unprivileged service daemon owns OCI children inside its delegated cgroup - v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but - the long-running daemon must not gain root merely to bypass a failed profile. - The signed artifact is proved on systemd and runit profiles; support is defined - by equivalent Linux capabilities rather than a distribution, libc, or init - brand. `doctor` must name the effective supervisor and writable delegated - boundary, and apply must fail closed when that boundary is missing. Routine CLI - use remains unprivileged and authenticated. +- One signed `apsuflow` executable runs on every supported Linux profile; + profiles contain only host configuration and service scripts. The daemon never + detects a distribution, libc, or init system. Before opening its listener it + must prove its unprivileged effective UID and create/remove a child beneath a + writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`. + `doctor` reports the same kernel-observed parent-process and cgroup facts. + Failure is closed: there is no root or service-manager-specific fallback. - `.apsu` contains desired workloads and infrastructure, never secret values or mutable runtime state. - Services are continuously reconciled. Jobs are finite run-to-completion work.