10. Privilege

Decision: authority before effect

Effectful initialization refuses effective UID 0; root may inspect a zero-effect dry run but does not acquire initialization authority. Host mutation belongs to the invoking user, its user manager, and rootless Podman/Quadlet. Layout owns which paths may exist or be retired.

Host tools are never trusted from spelling alone. Discovery accepts only an executable regular file that is UID-0-owned or lies on a kernel-reported read-only filesystem. Neither the file nor any ancestor may be group/other-writable or writable by the caller; the resolved absolute path, device, and inode remain in the authority token. The systemd user-generator search follows directory priority: the first matching entry wins, and an unsafe, empty, non-executable, or /dev/null-linked entry masks every lower-priority copy.

Binding sites are real non-symlink, invoking-user-owned safe directories. All real initialization, binding, deletion, direct-systemd actuation, and Host Reactor consumption share one non-blocking lifecycle lock under /tmp. It is opened without following symlinks and must be a regular caller-owned 0600 file. Dry runs do not acquire or create it; contention is a no-effect refusal.

Foundation, desired bytes, source and secret generation, tool/site identities, and live configuration are revalidated under that lock immediately before mutation. A state mismatch is a no-effect refusal.

TransitionIntent is frozen, extra="forbid" data: a 32-hex correlation ID, forward or exact compensation operation, configuration digest, canonical AnimatorModel RuntimeModel Runtime and capability, ordered evict/launch sets, and exact expected active world. It carries no command, unit name, path, environment, or arbitrary payload. A host consumer or extension escalation needs an equally closed typed class, trusted producer and consumer, configuration owner, recovery states, and boundary tests; extension import grants no host authority.

The physical transaction

Physical truth comes from observed state. For an admissible transition, the actuator first validates the word and policy, preflights and attests the loaded Scribe-owned topology, rejects relevant pending jobs, and compares the exact observed pre-world. It records intent before actuating generated AnimatorModel RuntimeModel Runtime targets, then obtains terminal readback and attests the result. Client exit status cannot supply that proof: a successful receipt requires the observed desired state, making the effect accountable.

The direct systemd actuator uses only the injected, attested absolute systemctl under the lifecycle lock. It submits only generated target identities and observes both target reservations and services. Cancellation and partial failure obtain one bounded inverse transaction. The prior world reopens admission only when exact readback proves it.

The caged host-reactor default gives the VesselEngine RoomEngine Room a write-only owner-mode inbox and a read-only host journal. It publishes one bounded typed JSON intent; the host claims it before parsing through a no-follow descriptor, independently rechecks schema, ownership, topology, policy, digest, and world, then acts. The journal distinguishes no-effect decline, completed desired state, proved restoration, malformed rejection, processing uncertainty, and containment. Claimed work and containment keep admission closed; terminal filenames never form a writable reply command. This local file boundary is not remote authentication.

Claim first moves producer bytes into .acquiring.json, which never authorizes an effect or recovery. The host captures a bounded no-follow read into a new private 0600 inode and writes a separate host-owned, versioned custody companion binding its exact content digest. Both are durable before .processing.json can authorize actuation. A producer-held descriptor or hard link therefore cannot rewrite admitted or completed evidence. Processing and compensation reads require matching custody; a marker inside producer-supplied JSON is not custody proof. Interrupted acquisition without processing is rejected without effect. Missing, legacy, or mismatched processing custody remains fenced for operator reconciliation; old completed files without proof cannot authorize compensation and are never automatically certified or replayed.

Materialization and retirement

Scribe's ownership receipt bounds every Quadlet/plain user-unit file that binding may write. Under the lifecycle lock, binding stages and validates the full generation, rechecks foundation/sites/secrets/generations, replaces exactly the declared set, and reloads systemd. Failure restores the previous set. Foreign units, ambiguous ownership, unsafe names, changed identities, and unknown files cause refusal rather than deletion.

Deletion is a separately fingerprinted, revalidated sequence—quiesce, runtime, storage, unbind, secrets, filesystem, package, verify. It stops only exact owned units and recursively retires only init-attested dedicated roots through pinned no-follow descriptors. An exact, init-created PhylacteryMemory VaultMemory Vault Btrfs subvolume may need root; LychD proves mount/device/filesystem/subvolume identity, prints a narrow trusted root handoff, writes a protected continuation receipt, and never invokes sudo itself. Any ambiguous mount, replacement, interruption, or root outcome preserves evidence and blocks continuation.

Containment rule and delivery boundary

Compensation can reopen the prior world only after exact proof of its restoration. When the physical result remains indeterminate, containment latches and recovery is required; another retry cannot supply that recovery. Signal authority stays equally narrow: the trusted VesselEngine RoomEngine Room alone writes the Reactor inbox, and the host consumer alone claims it. Tombs, SoulstonesLocal ModelsLocal Models, and untrusted extensions receive neither inbox nor journal.

The mediated protocol and its isolated receipts are available within their stated boundary, but no repository test proves an operator's Quadlet/Podman/GPU host. State of Work and its systemd/Podman embodiment record own that delivery distinction.

Consequences

Host mutation remains attributable and recoverable, but an uncertain physical outcome deliberately costs availability until an operator establishes a safe recovery boundary.