tmk241/apsuflow-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(skill): describe kernel host contract

Browse Source
This commit is contained in:
tmk241
2026-08-09 21:00:42 +02:00
parent 22634be910
commit bb8bc5cdf6
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/apsuflow/SKILL.md
+7 -8
View File
@@ -42,14 +42,13 @@ in the same change when applicable requirements or CLI behavior change.
- Solo mode is one loopback-bound server without cluster mesh overhead. - Solo mode is one loopback-bound server without cluster mesh overhead.
- Cluster servers replicate control-plane state; agents execute workloads but do - Cluster servers replicate control-plane state; agents execute workloads but do
not add quorum votes. not add quorum votes.
- The unprivileged service daemon owns OCI children inside its delegated cgroup - One signed `apsuflow` executable runs on every supported Linux profile;
v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but profiles contain only host configuration and service scripts. The daemon never
the long-running daemon must not gain root merely to bypass a failed profile. detects a distribution, libc, or init system. Before opening its listener it
The signed artifact is proved on systemd and runit profiles; support is defined must prove its unprivileged effective UID and create/remove a child beneath a
by equivalent Linux capabilities rather than a distribution, libc, or init writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`.
brand. `doctor` must name the effective supervisor and writable delegated `doctor` reports the same kernel-observed parent-process and cgroup facts.
boundary, and apply must fail closed when that boundary is missing. Routine CLI Failure is closed: there is no root or service-manager-specific fallback.
use remains unprivileged and authenticated.
- `.apsu` contains desired workloads and infrastructure, never secret values or - `.apsu` contains desired workloads and infrastructure, never secret values or
mutable runtime state. mutable runtime state.
- Services are continuously reconciled. Jobs are finite run-to-completion work. - Services are continuously reconciled. Jobs are finite run-to-completion work.