docs(design): cross-process teardown for the embedded native-app stack (SEA-1880) - #230
Open
seal-agent wants to merge 2 commits into
Open
docs(design): cross-process teardown for the embedded native-app stack (SEA-1880)#230seal-agent wants to merge 2 commits into
seal-agent wants to merge 2 commits into
Conversation
…k (SEA-1880) Frozen-contract amendment: `compass-stack down`, invoked as a fresh process, is a silent no-op across the process boundary — the merged T4.2 embedded "Quit and stop stack" action leaves the stack running, contradicting the frozen native-app record's `down`-SIGTERMs-the-tree claim. Records Option A (DL-161): `up` persists each supervised child's process-group ID plus a start-time identity token to an atomic `stack.pgids` record beside the lockfile; a fresh `down` refuses while an `up` holds the lock, verifies each group's identity before signaling, SIGTERMs each exact persisted pgid in reverse start order with bounded SIGKILL escalation, and confirms teardown per component (server/postgres socket quiescence, runner group-ESRCH). Weighs and rejects B (control-RPC), C (foreground-supervised up), D (cgroup/systemd-scope). Red-teamed by a design-critic pass; critique folded (identity-token gate, live-`up` refusal interlock, per-component confirmation, zombie-window and partial-failure endstates). One Open Question parked for Matt: process-group signaling cannot reach conmon-detached agent containers — scoped out under assumption (a), split to SEA-1884. Refines DL-108 (stays Active); appends one DL-161 row to the Desktop shell ledger. Docs-only; no code change. Refs SEA-1880 Co-authored-by: Matt Wilkinson <matt@sealedsecurity.com>
…bie/verify-signal invariants (SEA-1880)
seal-agent
force-pushed
the
compass-native-1880-teardown-design
branch
from
August 7, 2026 23:04
55ae615 to
51fc8b0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Frozen-contract amendment:
compass-stack down, invoked as a fresh process,is a silent no-op across the process boundary — the merged T4.2 embedded
"Quit and stop stack" action leaves the stack running, contradicting the
frozen native-app record's
down-SIGTERMs-the-tree claim.Records Option A (DL-161):
uppersists each supervised child's process-groupID plus a start-time identity token to an atomic
stack.pgidsrecord besidethe lockfile; a fresh
downrefuses while anupholds the lock, verifieseach group's identity before signaling, SIGTERMs each exact persisted pgid in
reverse start order with bounded SIGKILL escalation, and confirms teardown per
component (server/postgres socket quiescence, runner group-ESRCH). Weighs and
rejects B (control-RPC), C (foreground-supervised up), D (cgroup/systemd-scope).
Red-teamed by a design-critic pass; critique folded (identity-token gate,
live-
uprefusal interlock, per-component confirmation, zombie-window andpartial-failure endstates). One Open Question parked for Matt: process-group
signaling cannot reach conmon-detached agent containers — scoped out under
assumption (a), split to SEA-1884.
Refines DL-108 (stays Active); appends one DL-161 row to the Desktop shell
ledger. Docs-only; no code change.
Refs SEA-1880
Co-authored-by: Matt Wilkinson matt@sealedsecurity.com