@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/grant_snapshot.go

@@ -0,0 +1,75 @@
+package helper
+
+import (
+	"math"
+	"reflect"
+	"slices"
+)
+
+// Pure snapshot invariants shared by the ordering owner and Linux persistence.
+func findGrant(s *GrantStore, id string) *Grant {
+	for n := range s.Grants {
+		if s.Grants[n].ID == id {
+			return &s.Grants[n]
+		}
+	}
+	return nil
+}
+func cloneAuthorityGrant(g Grant) Grant {
+	g.Actions = slices.Clone(g.Actions)
+	g.Scope.Segments = slices.Clone(g.Scope.Segments)
+	return g
+}
+
+func cloneAuthorityStore(s GrantStore) GrantStore { s.Grants = slicesCloneGrants(s.Grants); return s }
+func slicesCloneGrants(gs []Grant) []Grant {
+	out := make([]Grant, len(gs))
+	for i, g := range gs {
+		out[i] = cloneAuthorityGrant(g)
+	}
+	return out
+}
+
+// Root callback mistakes cannot drop tombstones, un-suspend, overwrite a grant's
+// scope/owner/actions, reuse IDs, or roll revisions back. Offline root disk
+// rollback remains outside the threat model; restart still suspends active.
+func validateGrantTransition(old, next GrantStore, p GrantPolicy) Code {
+	if reflect.DeepEqual(old, next) {
+		return ""
+	}
+	if old.Revision == math.MaxUint64 || next.Revision != old.Revision+1 {
+		return ErrStale
+	}
+	for _, before := range old.Grants {
+		after := findGrant(&next, before.ID)
+		if after == nil {
+			return ErrDenied
+		}
+		if reflect.DeepEqual(before, *after) {
+			continue
+		}
+		if before.State == GrantRevoked || before.Revision == math.MaxUint64 || after.Revision != before.Revision+1 {
+			return ErrDenied
+		}
+		if after.State != GrantRevoked && (before.State != GrantActive || after.State != GrantSuspended) {
+			return ErrDenied
+		}
+		normalized := cloneAuthorityGrant(*after)
+		normalized.Revision = before.Revision
+		normalized.State = before.State
+		normalized.Reason = before.Reason
+		normalized.RevokedAt = before.RevokedAt
+		if !reflect.DeepEqual(before, normalized) {
+			return ErrDenied
+		}
+	}
+	for _, g := range next.Grants {
+		if findGrant(&old, g.ID) == nil && (g.State != GrantActive || g.Revision != 1 || g.Inventory != p.Inventory || g.ApprovalBinding != p.ApprovalBinding || g.CapabilityDigest != p.CapabilityDigest || g.LastValidated.Epoch != p.Epoch || !p.Enabled) {
+			return ErrDenied
+		}
+	}
+	return ""
+}
+func completeQuiescence(q GrantQuiescence) bool {
+	return (q.Cohort == nil || (q.Cohort.Key == q.Key && q.Cohort.valid())) && allReferences(q.Key.Epoch, q.Key.GrantID) && q.Key.Revision > 0 && q.ChildrenReaped && q.RelayClosed && q.LeasesClosed && q.FDsClosed && q.EffectsRecorded
+}

package/templates/native-go/backend/internal/helper/grant_supervisor_linux.go

@@ -0,0 +1,134 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Fixed S1/S5 integration point. No environment/plugin/CGI installs adapters.
+// Until current account, App permission and ACL continuity are proved,
+// native/consent/operation/output adapters remain unavailable in shipped builds.
+func supervisorGrantAdapters(c Client) supervisorGrantServices {
+	if c.Expected.Protocol == DataProtocol && c.Expected.DataAccess == "relaxed" {
+		// t-0049 identifies candidates, not certified target-build adapters.
+		// Missing registration/session/state/groups/ACL proof stays unavailable.
+		return supervisorGrantServices{native: NewRelaxedNativeProvider(RelaxedAdapters{})}
+	}
+	return supervisorGrantServices{}
+}
+
+func openSupervisorGrants(c Client, binary string, cohort *operationCohort) (*supervisorGrants, *FileGrantRepository, Code) {
+	repo, code := OpenFileGrantRepository(c.StateDir, c.Expected)
+	if code != "" {
+		return nil, nil, code
+	}
+	services := supervisorGrantAdapters(c)
+	s, code := newSupervisorGrants(repo, cohort, services)
+	if code != "" {
+		repo.Close()
+		return nil, nil, code
+	}
+	if services.writes.Create && services.writeIntents == nil {
+		services.writeIntents = fileWriteIntents{repo}
+		s.services.writeIntents = services.writeIntents
+	}
+	cohort.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
+		if services.output == nil {
+			return nil, errTrust
+		}
+		out, code := services.output(b)
+		if code != "" || out == nil {
+			return nil, errTrust
+		}
+		op := cohort.operations[b.OperationID]
+		if op == nil || op.binding != b || op.work == nil && op.writeWork == nil {
+			out.Close()
+			return nil, errTrust
+		}
+		pin, ok := op.root.(*pinnedReadOnlyRoot)
+		if !ok || pin == nil {
+			out.Close()
+			return nil, ErrUnavailable
+		}
+		if op.writeWork != nil {
+			process, err := startLinuxWriteOperation(c, binary, a, b, pin, *op.writeWork, out)
+			if err != nil && process == nil {
+				out.Close()
+			}
+			return process, err
+		}
+		process, err := startLinuxReadOnlyOperation(c, binary, a, b, pin, *op.work, out)
+		if err != nil && process == nil {
+			out.Close()
+		}
+		return process, err
+	}
+	return s, repo, ""
+}
+
+// Root helper only. Verify the pinned parent both before and after connecting;
+// actual SO_PEERCRED must equal that parent. No package-side grant endpoint.
+func callSupervisorGrantRPC(c Client, request supervisorGrantRequest) (supervisorGrantResponse, Code) {
+	var res supervisorGrantResponse
+	want, err := readProcess(c.RunDir, 0)
+	if err != nil || want.PID != os.Getppid() || want.Inventory != c.Expected {
+		return res, ErrDenied
+	}
+	actual, err := inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		return res, ErrDenied
+	}
+	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(c.RunDir, "supervisor.sock"), Net: "unix"})
+	if err != nil {
+		return res, ErrUnavailable
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn)
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
+		return res, ErrDenied
+	}
+	actual, err = inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		return res, ErrDenied
+	}
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+	var nonce [32]byte
+	if _, err = rand.Read(nonce[:]); err != nil {
+		return res, ErrUnavailable
+	}
+	raw, err := json.Marshal(request)
+	if err != nil {
+		return res, ErrInvalid
+	}
+	req := supervisorRequest{Process: want, Op: "grants", Nonce: hex.EncodeToString(nonce[:]), Data: raw}
+	frame, err := json.Marshal(req)
+	if err != nil || len(frame) > MaxControlBytes {
+		return res, ErrLimit
+	}
+	if _, err = conn.Write(frame); err != nil {
+		return res, ErrUnavailable
+	}
+	if err = conn.CloseWrite(); err != nil {
+		return res, ErrUnavailable
+	}
+	if code := decodeDataObject(conn, &res, MaxControlBytes); code != "" {
+		return res, code
+	}
+	if res.Nonce != req.Nonce {
+		return supervisorGrantResponse{}, ErrDenied
+	}
+	return res, ""
+}
+
+func dispatchSupervisorGrant(ctx context.Context, s *supervisorGrants, peer operationPeer, req supervisorRequest) supervisorGrantResponse {
+	if s == nil {
+		return supervisorGrantResponse{Nonce: req.Nonce, Code: ErrUnavailable}
+	}
+	return s.dispatch(ctx, peer, req.Nonce, req.Data)
+}

package/templates/native-go/backend/internal/helper/grant_supervisor_linux_test.go

@@ -0,0 +1,254 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSupervisorGrantFrameBounds(t *testing.T) {
+	req := supervisorRequest{Op: "grants", Nonce: grantRef('a'), Data: json.RawMessage(`{"epoch":"fixture"}`)}
+	b, _ := json.Marshal(req)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != "" {
+		t.Fatal(code)
+	}
+	for _, raw := range [][]byte{append(append([]byte{}, b...), b...), bytes.Replace(b, []byte(`"op":"grants"`), []byte(`"op":"grants","op":"admit"`), 1), append(bytes.Repeat([]byte(" "), MaxControlBytes), b...)} {
+		if _, code := decodeSupervisorRequest(bytes.NewReader(raw)); code == "" {
+			t.Fatal("invalid frame accepted")
+		}
+	}
+	legacy := supervisorRequest{Op: "admit", Nonce: grantRef('b')}
+	frame, _ := json.Marshal(legacy)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(frame)); code != "" {
+		t.Fatal("legacy frame", code)
+	}
+	if _, code := decodeSupervisorRequest(bytes.NewReader(append(bytes.Repeat([]byte(" "), 4096), frame...))); code == "" {
+		t.Fatal("legacy frame limit ignored leading whitespace")
+	}
+
+	req.Op = "admit"
+	b, _ = json.Marshal(req)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != ErrInvalid {
+		t.Fatal(code)
+	}
+}
+func grantVMFixture(t *testing.T) LinuxProcesses {
+	t.Helper()
+	source := os.Getenv("M2_GRANT_FIXTURE")
+	if source == "" {
+		t.Skip("requires NIC-free Linux root VM")
+	}
+	t.Setenv("M1C_HELPER_FIXTURE", source)
+	p := linuxFixture(t)
+	p.Expected.Protocol = DataProtocol
+	return p
+}
+func grantVMCall(t *testing.T, p LinuxProcesses, method string, args any) supervisorGrantResponse {
+	t.Helper()
+	record, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(args)
+	req := supervisorGrantRequest{Epoch: record.Lifecycle.Epoch, Method: method, Args: raw}
+	b, _ := json.Marshal(req)
+	os.Remove(filepath.Join(p.RunDir, "grant-result"))
+	// The owned helper polls and removes this name. Publishing with WriteFile
+	// exposed a truncated/partial control and produced intermittent ErrInvalid
+	// before the write completed. Publish the complete fixture frame by rename.
+	tmp := filepath.Join(p.RunDir, "grant-command.tmp")
+	if err := os.WriteFile(tmp, b, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(tmp, filepath.Join(p.RunDir, "grant-command")); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	var res supervisorGrantResponse
+	if waitHealthy(ctx, func(context.Context) bool {
+		b, err := os.ReadFile(filepath.Join(p.RunDir, "grant-result"))
+		return err == nil && json.Unmarshal(b, &res) == nil
+	}) != nil {
+		t.Fatal("owned helper did not complete grant RPC", method)
+	}
+	return res
+}
+func grantVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func TestLinuxGrantRPCRevokeUsesS2DrainAndIsolatesGrants(t *testing.T) {
+	p := grantVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := grantVMCreate(t, p)
+	other := grantVMCreate(t, p)
+	request := grantControl(t, g, '1', '2', '3', MaxBoundedBytes)
+	if res := grantVMCall(t, p, "operation.start", request); res.Code != "" {
+		t.Fatal(res)
+	}
+	grantVMMetadata(t, p, request)
+	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, g, '1', '4', '5', MaxChunkBytes)); res.Code != "" {
+		t.Fatal(res)
+	}
+	if res := grantVMCall(t, p, "operation.start", grantControl(t, other, '6', '7', '8', MaxBoundedBytes)); res.Code != "" {
+		t.Fatal(res)
+	}
+	grantVMMetadata(t, p, grantControl(t, other, '6', '7', '8', MaxBoundedBytes))
+	children := processChildren(proc.PID)
+	if len(children) != 3 {
+		t.Fatal("missing real operations", children)
+	}
+	for _, pid := range children {
+		if pid == supervisedPIDByMode(t, proc.PID, "serve-child") {
+			continue
+		}
+		b, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", pid))
+		if err != nil || !statusHasCredentials(b, 1001, 100, []uint32{101, 105}) {
+			t.Fatal("credentials", pid, err)
+		}
+	}
+	// A different root process knows the pinned identity but cannot mutate grants.
+	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(p.RunDir, "supervisor.sock"), Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw := grantRPC(t, "revoke", g.LastValidated.Epoch, SessionCarriers{Cookie: "fixture"}, grantRevokeArgs{g.ID, 1, 3})
+	conn.SetDeadline(time.Now().Add(time.Second))
+	json.NewEncoder(conn).Encode(supervisorRequest{Process: proc, Op: "grants", Nonce: grantRef('f'), Data: raw})
+	conn.CloseWrite()
+	var foreign supervisorGrantResponse
+	if code := decodeDataObject(conn, &foreign, MaxControlBytes); code != "" || foreign.Code != ErrDenied {
+		t.Fatal("foreign root admitted", foreign, code)
+	}
+	conn.Close()
+	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, 1, 3})
+	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(filepath.Join(p.StateDir, "grant-q-"+g.ID+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var q GrantQuiescence
+	if json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
+		t.Fatal("Q without actual S2 proof", q)
+	}
+	if res := grantVMCall(t, p, "operation.start", grantControl(t, g, '9', 'a', 'b', 1)); res.Code != ErrRevoked {
+		t.Fatal("work after R", res)
+	}
+	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, other, '6', 'c', 'd', 1)); res.Code != "" {
+		t.Fatal("unrelated grant fenced", res)
+	}
+	survivors := processChildren(proc.PID)
+	if len(survivors) != 2 {
+		t.Fatal("individual revoke drained unrelated grant", survivors)
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped"
+	}) != nil {
+		t.Fatal("global fence incomplete")
+	}
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(p.Client, r)
+	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 2 || proof.Cohort.Reaped != 2 || !proof.Cohort.RelaysStopped {
+		t.Fatal(proof, err)
+	}
+	for _, pid := range children {
+		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
+			t.Fatal("child survived Q/fence", pid)
+		}
+	}
+	// Restart suspends only active authority; the prior revoked tombstone stays R.
+	vmUnit(t, "start")
+	startVMHelper(t, p)
+
+	var store GrantStore
+	if waitHealthy(ctx, func(context.Context) bool {
+		b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+		if e != nil {
+			return false
+		}
+		var code Code
+		store, code = DecodeGrantStore(bytes.NewReader(b))
+		if code != "" {
+			return false
+		}
+		revoked, active := findGrant(&store, g.ID), findGrant(&store, other.ID)
+		return revoked != nil && active != nil && revoked.State == GrantRevoked && active.State == GrantSuspended
+	}) != nil {
+		t.Fatal("restart did not reconcile before grant admission", store)
+	}
+	suspended := *findGrant(&store, other.ID)
+	request = grantControl(t, suspended, 'e', 'f', '0', 1)
+	current, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Epoch = current.Lifecycle.Epoch
+	if res := grantVMCall(t, p, "operation.start", request); res.Code != ErrSuspended {
+		t.Fatal("restart admitted suspended grant", res)
+	}
+
+}
+func TestLinuxGrantProductionAdaptersFailClosed(t *testing.T) {
+	p := grantVMFixture(t)
+	// VM fixture swaps only the trusted adapters; nil is the production default.
+	if s := supervisorGrantAdapters(p.Client); s.native != nil || s.consent != nil || s.operations != nil || s.output != nil {
+		t.Fatal("shipped adapters unexpectedly installed")
+	}
+}
+
+func TestLinuxGrantWaitsForDurableActivationHandoff(t *testing.T) {
+	p := grantVMFixture(t)
+	lifecycle := vmLifecycle(t, p)
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Residual: true, Lifecycle: lifecycle})
+	if err := p.Start(p.Expected); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		(Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "disable")
+	})
+	args := grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}
+	if res := grantVMCall(t, p, "prepare", args); res.Code != ErrUnavailable {
+		t.Fatal("residual approval enabled grants", res)
+	}
+	if _, err := os.Stat(filepath.Join(p.StateDir, "grants.json")); !os.IsNotExist(err) {
+		t.Fatal("authority initialized against residual snapshot", err)
+	}
+	if err := finalizeStart(p.Client, lifecycle.Epoch); err != nil {
+		t.Fatal(err)
+	}
+	if res := grantVMCall(t, p, "prepare", args); res.Code != "" || res.Intent == nil {
+		t.Fatal("durable activation handoff fenced authority", res)
+	}
+}

package/templates/native-go/backend/internal/helper/lease.go

@@ -0,0 +1,112 @@
+package helper
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// Lease binds the unreplaceable lifetime witness to an approved epoch. Both
+// supervisor and child retain the same flock description until kernel exit.
+type Lease struct {
+	Device uint64 `json:"device"`
+	Inode  uint64 `json:"inode"`
+}
+
+func leasePath(c Client, l *Lifecycle) string {
+	return filepath.Join(c.StateDir, "lifetime-"+l.Epoch+".lock")
+}
+
+func createLifetime(c Client, l *Lifecycle) error {
+	if l == nil || !l.valid() || l.Lease != nil {
+		return errTrust
+	}
+	f, err := os.OpenFile(leasePath(c, l), os.O_CREATE|os.O_EXCL|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if _, err = f.WriteString(l.Epoch); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	st, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errTrust
+	}
+	l.Lease = &Lease{Device: uint64(stat.Dev), Inode: stat.Ino}
+	if err = validateLifetime(c, l, f); err != nil {
+		return err
+	}
+	return syncDirectory(c.StateDir)
+}
+
+func syncDirectory(path string) error {
+	d, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer d.Close()
+	return d.Sync()
+}
+
+func validateLifetime(c Client, l *Lifecycle, f *os.File) error {
+	if l == nil || !l.valid() || l.Lease == nil || l.Lease.Inode == 0 {
+		return errTrust
+	}
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	st, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || stat.Uid != c.Owner || stat.Nlink != 1 || st.Size() != 64 || uint64(stat.Dev) != l.Lease.Device || stat.Ino != l.Lease.Inode {
+		return errTrust
+	}
+	path, err := os.Lstat(leasePath(c, l))
+	if err != nil {
+		return err
+	}
+	if !path.Mode().IsRegular() || !os.SameFile(st, path) {
+		return errTrust
+	}
+	var b [64]byte
+	n, err := f.ReadAt(b[:], 0)
+	if (err != nil && !errors.Is(err, io.EOF)) || n != 64 || string(b[:]) != l.Epoch {
+		return errTrust
+	}
+	return lifetimeFilesystem(f)
+}
+
+func acquireLifetime(c Client, l *Lifecycle) (*os.File, error) {
+	if l == nil || !l.valid() || l.Lease == nil {
+		return nil, errTrust
+	}
+	// Never create on open: a missing historical witness cannot be repaired.
+	f, err := os.OpenFile(leasePath(c, l), os.O_RDWR|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, err
+	}
+	if err = validateLifetime(c, l, f); err == nil {
+		err = syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+	}
+	if err == nil {
+		err = validateLifetime(c, l, f)
+	}
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+	// Closing our independently opened description releases only our lock.
+	return f, nil
+}

package/templates/native-go/backend/internal/helper/lease_linux.go

@@ -0,0 +1,44 @@
+package helper
+
+import (
+	"os"
+	"syscall"
+)
+
+// Network filesystems have different flock semantics and are not supported.
+func lifetimeFilesystem(f *os.File) error {
+	var s syscall.Statfs_t
+	if err := syscall.Fstatfs(int(f.Fd()), &s); err != nil {
+		return err
+	}
+	switch uint64(s.Type) {
+	case 0xef53, 0x9123683e, 0x58465342, 0x01021994, 0x858458f6, 0x794c7630: // ext, btrfs, xfs, tmpfs, ramfs, overlayfs
+		return nil
+	}
+	return errTrust
+}
+
+// These descriptors deliberately have process lifetime. No defer Close or
+// LOCK_UN: release before child kernel exit would create a false death proof.
+var processLifetime *os.File
+
+func inheritLifetime(c Client) error {
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || r.Inventory != c.Expected || !r.Enabled || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	f := os.NewFile(3, "inherited-lifetime")
+	if f == nil {
+		return errTrust
+	}
+	if err = validateLifetime(c, r.Lifecycle, f); err == nil {
+		err = syscall.Flock(3, syscall.LOCK_EX|syscall.LOCK_NB)
+	}
+	if err != nil {
+		f.Close()
+		return err
+	}
+	syscall.CloseOnExec(3)
+	processLifetime = f
+	return nil
+}

package/templates/native-go/backend/internal/helper/lease_other.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package helper
+
+import "os"
+
+// Non-Linux hosts run fixture tests only; RunLinux refuses production control.
+func lifetimeFilesystem(*os.File) error { return nil }