docs(skill): describe kernel host contract

2026-08-09 21:00:42 +02:00
parent 22634be910
commit bb8bc5cdf6
1 changed files with 7 additions and 8 deletions
@@ -42,14 +42,13 @@ in the same change when applicable requirements or CLI behavior change.
 - Solo mode is one loopback-bound server without cluster mesh overhead.
 - Cluster servers replicate control-plane state; agents execute workloads but do
  not add quorum votes.
- The unprivileged service daemon owns OCI children inside its delegated cgroup
-  v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but
-  the long-running daemon must not gain root merely to bypass a failed profile.
-  The signed artifact is proved on systemd and runit profiles; support is defined
-  by equivalent Linux capabilities rather than a distribution, libc, or init
-  brand. `doctor` must name the effective supervisor and writable delegated
-  boundary, and apply must fail closed when that boundary is missing. Routine CLI
-  use remains unprivileged and authenticated.
+- One signed `apsuflow` executable runs on every supported Linux profile;
+  profiles contain only host configuration and service scripts. The daemon never
+  detects a distribution, libc, or init system. Before opening its listener it
+  must prove its unprivileged effective UID and create/remove a child beneath a
+  writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`.
+  `doctor` reports the same kernel-observed parent-process and cgroup facts.
+  Failure is closed: there is no root or service-manager-specific fallback.
 - `.apsu` contains desired workloads and infrastructure, never secret values or
  mutable runtime state.
 - Services are continuously reconciled. Jobs are finite run-to-completion work.