@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/managed_pilot.go

@@ -0,0 +1,284 @@
+package helper
+
+import (
+	"context"
+	"math"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+// B is a distinct, explicit opt-in contract. These adapters are root-owned and
+// cannot be populated by browser/package claims. No shipped bridge is installed.
+type managedPilotObservation struct {
+	Account                                    LocalAccount
+	SessionRef, BoundaryRef                    string
+	BoundaryProven, SessionsPurged, FreshLogin bool
+	CheckedAt                                  time.Time
+}
+type managedPilotBridge interface {
+	Observe(context.Context, SessionCarriers) (managedPilotObservation, Code)
+}
+
+// Durable disable must survive a failed/uncertain transaction; restart never
+// restores an enabled enrollment. Secret session carriers must never be stored.
+type managedPilotStore interface {
+	Load(context.Context) (managedPilotRecord, Code)
+	Save(context.Context, managedPilotRecord) Code
+}
+type managedPilotRecord struct {
+	Enabled         bool   `json:"enabled"`
+	Epoch           string `json:"epoch"`
+	ApprovalBinding string `json:"approvalBinding"`
+	SubjectRef      string `json:"subjectRef"`
+	Generation      string `json:"generation"`
+	SessionRef      string `json:"sessionRef"`
+	Username        string `json:"username"`
+	BoundaryRef     string `json:"boundaryRef"`
+}
+type managedPilot struct {
+	authority *GrantAuthority
+	bridge    managedPilotBridge
+	store     managedPilotStore
+	record    managedPilotRecord
+	baseline  LocalAccount
+}
+
+func newManagedPilotProvider(b managedPilotBridge, s managedPilotStore) *NativeProvider {
+	return &NativeProvider{managed: &managedPilot{bridge: b, store: s}, now: time.Now}
+}
+func (m *managedPilot) bind(a *GrantAuthority) Code {
+	if m == nil || a == nil || m.bridge == nil || m.store == nil {
+		return ErrUnavailable
+	}
+	if m.authority != nil {
+		return ErrBusy
+	}
+	m.authority = a
+	// Durably reset opt-in on every new owner. No historical enabled record is
+	// adopted, even if approval/epoch bytes survived a restart or restore.
+	ctx, cancel := context.WithTimeout(context.Background(), NativeProofFreshness)
+	defer cancel()
+	a.mu.Lock()
+	c := safeGrantCode(m.store.Save(ctx, managedPilotRecord{}))
+	if c != "" {
+		a.fenced = true
+	}
+	a.mu.Unlock()
+	return c
+}
+func pilotAccountValid(o managedPilotObservation, now time.Time) bool {
+	a := o.Account
+	return o.BoundaryProven && o.SessionsPurged && o.FreshLogin && allReferences(o.SessionRef, o.BoundaryRef) && nativeFresh(o.CheckedAt, now) && nativeFresh(a.CheckedAt, now) && a.Principal.Kind == "local" && a.Principal.InstanceRef == "" && a.Enabled && a.UID != 0 && a.Groups != nil && len(a.Groups) <= 1024 && a.Username != "" && len(a.Username) <= MaxSegmentBytes && utf8.ValidString(a.Username) && !strings.ContainsAny(a.Username, "\x00\r\n/\\")
+}
+func pilotAccountSame(a, b LocalAccount) bool {
+	return a.Username == b.Username && a.UID == b.UID && a.GID == b.GID && a.Enabled == b.Enabled && a.Admin == b.Admin && slices.Equal(a.Groups, b.Groups)
+}
+func pilotOwnedAccount(a LocalAccount) LocalAccount {
+	a.Groups = slices.Clone(a.Groups)
+	slices.Sort(a.Groups)
+	a.Groups = slices.Compact(a.Groups)
+	return a
+}
+func (m *managedPilot) enableAndApprove(ctx context.Context, admin, subject SessionCarriers, acknowledged bool) Code {
+	if !acknowledged {
+		return ErrDenied
+	}
+	if m == nil || m.authority == nil || m.bridge == nil || m.store == nil {
+		return ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	a := m.authority
+	fail := func(code Code) Code {
+		if c := m.invalidate(context.Background()); c != "" {
+			return ErrCleanupRequired
+		}
+		return code
+	}
+	// A browser flag is not admin proof. The trusted native bridge must freshly
+	// prove local admin and the unbroken managed boundary, including session reset.
+	approver, c := m.bridge.Observe(ctx, admin)
+	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(approver, a.now()) || !approver.Account.Admin {
+		return fail(ErrDenied)
+	}
+	user, c := m.bridge.Observe(ctx, subject)
+	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(user, a.now()) || user.BoundaryRef != approver.BoundaryRef {
+		return fail(ErrUnavailable)
+	}
+	again, c := m.bridge.Observe(ctx, admin)
+	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(again, a.now()) || again.SessionRef != approver.SessionRef || again.BoundaryRef != approver.BoundaryRef || !pilotAccountSame(pilotOwnedAccount(approver.Account), pilotOwnedAccount(again.Account)) {
+		return fail(ErrStale)
+	}
+	generation, c := randomGrantID()
+	if c != "" {
+		return fail(c)
+	}
+	subjectRef, c := randomGrantID()
+	if c != "" {
+		return fail(c)
+	}
+	a.mu.Lock()
+	if a.fenced || m.record.Enabled {
+		a.mu.Unlock()
+		return ErrFenced
+	}
+	if c = nativeContextCode(ctx); c != "" || !nativeFresh(user.CheckedAt, a.now()) || !nativeFresh(user.Account.CheckedAt, a.now()) {
+		a.mu.Unlock()
+		return fail(ErrStale)
+	}
+	record := managedPilotRecord{Enabled: true, Epoch: a.policy.Epoch, ApprovalBinding: a.policy.ApprovalBinding, SubjectRef: subjectRef, Generation: generation, SessionRef: user.SessionRef, Username: user.Account.Username, BoundaryRef: user.BoundaryRef}
+	// SAME S3 ordering mutex brackets durable opt-in and publication.
+	c = nativeObservationCode(ctx, m.store.Save(ctx, record))
+	if c == "" && (!nativeFresh(user.CheckedAt, a.now()) || !nativeFresh(user.Account.CheckedAt, a.now()) || !nativeFresh(again.CheckedAt, a.now()) || !nativeFresh(again.Account.CheckedAt, a.now())) {
+		c = ErrStale
+	}
+	if c == "" {
+		m.record = record
+		m.baseline = pilotOwnedAccount(user.Account)
+	}
+	a.mu.Unlock()
+	if c != "" {
+		return fail(c)
+	}
+	return ""
+}
+func (m *managedPilot) resolve(ctx context.Context, carriers SessionCarriers) (NativeActor, Code) {
+	if m == nil || m.authority == nil || m.bridge == nil || m.store == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	a := m.authority
+	fail := func(code Code) (NativeActor, Code) {
+		if c := m.invalidate(context.Background()); c != "" {
+			return NativeActor{}, ErrCleanupRequired
+		}
+		return NativeActor{}, code
+	}
+	if carriers.Cookie == "" {
+		return fail(ErrDenied)
+	}
+	persisted, c := m.store.Load(ctx)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return fail(c)
+	}
+	o, c := m.bridge.Observe(ctx, carriers)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return fail(c)
+	}
+	a.mu.Lock()
+	record := m.record
+	account := pilotOwnedAccount(o.Account)
+	valid := !a.fenced && record.Enabled && persisted == record && record.Epoch == a.policy.Epoch && record.ApprovalBinding == a.policy.ApprovalBinding && pilotAccountValid(o, a.now()) && o.SessionRef == record.SessionRef && o.BoundaryRef == record.BoundaryRef && pilotAccountSame(account, m.baseline)
+	if !valid {
+		a.mu.Unlock()
+		return fail(ErrSuspended)
+	}
+	account.Principal = Principal{Kind: "local", SubjectRef: record.SubjectRef, InstanceRef: record.Generation}
+	if o.CheckedAt.Before(account.CheckedAt) {
+		account.CheckedAt = o.CheckedAt
+	}
+	actor := NativeActor{managed: m, account: account, sessionRef: o.SessionRef, valid: true}
+	a.mu.Unlock()
+	return actor, ""
+}
+
+// Invalidate is sticky for the whole epoch. All grants are conservatively revoked
+// through S3 and drained through the existing S2 owner; failed R is never Q.
+func (m *managedPilot) invalidate(ctx context.Context) Code {
+	if m == nil || m.authority == nil {
+		return ErrUnavailable
+	}
+	a := m.authority
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	a.mu.Lock()
+	a.fenced = true
+	if a.gate != nil {
+		a.gate.fenceLocked("managed-account-uncertain")
+	}
+	clear(a.intents)
+	m.record.Enabled = false
+	disabled := safeGrantCode(m.store.Save(ctx, m.record))
+	keys := []GrantDrainKey{}
+	c := safeGrantCode(a.repository.Transact(func(p GrantPolicy, s *GrantStore) (bool, Code) {
+		if p.Inventory != a.policy.Inventory || p.Epoch != a.policy.Epoch || p.ApprovalBinding != a.policy.ApprovalBinding {
+			return false, ErrStale
+		}
+		// Compute every key before editing, so overflow cannot partially revoke.
+		for _, g := range s.Grants {
+			rev := g.Revision
+			if g.State != GrantRevoked {
+				if rev == math.MaxUint64 {
+					return false, ErrLimit
+				}
+				rev++
+			}
+			keys = append(keys, GrantDrainKey{p.Epoch, g.ID, rev})
+		}
+		changed := false
+		for i := range s.Grants {
+			g := &s.Grants[i]
+			if g.State == GrantRevoked {
+				continue
+			}
+			g.State = GrantRevoked
+			g.Reason = ErrRevoked
+			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
+			g.Revision++
+			changed = true
+		}
+		if changed {
+			if s.Revision == math.MaxUint64 {
+				return false, ErrLimit
+			}
+			s.Revision++
+		}
+		return changed, ""
+	}))
+	a.mu.Unlock()
+	complete := c == "" && disabled == ""
+	for _, key := range keys {
+		q, code := a.drain(ctx, key)
+		if code != "" {
+			complete = false
+			continue
+		}
+		if c == "" {
+			a.mu.Lock()
+			saved := safeGrantCode(a.repository.SaveQuiescence(q))
+			a.mu.Unlock()
+			if saved != "" {
+				complete = false
+			}
+		}
+	}
+	if !complete {
+		return ErrCleanupRequired
+	}
+	return ""
+}
+
+// Call BEFORE any account mutation in the managed maintenance workflow. Only a
+// successful result permits the separately authorized maintenance to proceed.
+// This does not mutate DSM accounts or establish native logout-all evidence.
+func (m *managedPilot) beginMaintenance(ctx context.Context) Code {
+	return m.invalidate(ctx)
+}
+
+// The origin is observable, but the private pointer is never serialized or
+// reconstructed. Managed generation is NOT a native account incarnation.
+func (a NativeActor) IdentityBasis() string {
+	if !a.valid {
+		return "unknown"
+	}
+	if a.managed != nil {
+		return "managed-enrollment"
+	}
+	if a.relaxed != nil {
+		return "uid-username"
+	}
+	return "native-incarnation"
+}

package/templates/native-go/backend/internal/helper/managed_pilot_repository_linux.go

@@ -0,0 +1,74 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"golang.org/x/sys/unix"
+)
+
+// Reuses the exact root-owned S3 directory, lifetime owner, protected file
+// checks, policy/grant locks and atomic fsync+rename; never a new grant owner.
+type fileManagedPilotStore struct{ repository *FileGrantRepository }
+
+func validManagedPilotRecord(r managedPilotRecord, p GrantPolicy) bool {
+	if !r.Enabled {
+		return true
+	}
+	return p.Enabled && r.Epoch == p.Epoch && r.ApprovalBinding == p.ApprovalBinding && allReferences(r.SubjectRef, r.Generation, r.SessionRef, r.BoundaryRef) && nativeDisplayName(r.Username)
+}
+func (s fileManagedPilotStore) Load(ctx context.Context) (managedPilotRecord, Code) {
+	if s.repository == nil {
+		return managedPilotRecord{}, ErrUnavailable
+	}
+	var record managedPilotRecord
+	c := s.repository.withLocks(func() Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		p, c := s.repository.readPolicy()
+		if c != "" {
+			return c
+		}
+		b, err := s.repository.read("managed-pilot.json", 0600, 4096)
+		if errors.Is(err, unix.ENOENT) {
+			return ""
+		}
+		if err != nil {
+			return ErrUnavailable
+		}
+		if c = decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
+			return c
+		}
+		if !validManagedPilotRecord(record, p) {
+			return ErrFenced
+		}
+		return nativeContextCode(ctx)
+	})
+	return record, safeGrantCode(c)
+}
+func (s fileManagedPilotStore) Save(ctx context.Context, record managedPilotRecord) Code {
+	if s.repository == nil {
+		return ErrUnavailable
+	}
+	return s.repository.withLocks(func() Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		p, c := s.repository.readPolicy()
+		if c != "" {
+			return c
+		}
+		if !validManagedPilotRecord(record, p) {
+			return ErrFenced
+		}
+		b, err := json.Marshal(record)
+		if err != nil || len(b) > 4096 {
+			return ErrInvalid
+		}
+		// Uncertainty cannot restore this process's sticky memory fence, and a new
+		// owner never loads enabled state. Grant R/Q is still attempted independently.
+		return s.repository.commit("managed-pilot.json", b)
+	})
+}

package/templates/native-go/backend/internal/helper/managed_pilot_repository_linux_test.go

@@ -0,0 +1,40 @@
+package helper
+
+import (
+	"context"
+	"os"
+	"testing"
+)
+
+func TestManagedPilotProtectedDurableStore(t *testing.T) {
+	dir, i, _ := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	p, _ := diskGrantSnapshot(t, r)
+	s := fileManagedPilotStore{r}
+	ctx := context.Background()
+	record := managedPilotRecord{Enabled: true, Epoch: p.Epoch, ApprovalBinding: p.ApprovalBinding, SubjectRef: grantRef('a'), Generation: grantRef('b'), SessionRef: grantRef('c'), Username: "normal3", BoundaryRef: grantRef('d')}
+	if c := s.Save(ctx, record); c != "" {
+		t.Fatal(c)
+	}
+	got, c := s.Load(ctx)
+	if c != "" || got != record {
+		t.Fatal(c, got)
+	}
+	st, err := os.Stat(dir + "/managed-pilot.json")
+	if err != nil || st.Mode().Perm() != 0600 {
+		t.Fatal(st, err)
+	}
+	record.Enabled = false
+	if c = s.Save(ctx, record); c != "" {
+		t.Fatal(c)
+	}
+	got, c = s.Load(ctx)
+	if c != "" || got.Enabled {
+		t.Fatal("disable not durable", c)
+	}
+	os.Remove(dir + "/managed-pilot.json")
+	os.Symlink("approval.json", dir+"/managed-pilot.json")
+	if _, c = s.Load(ctx); c == "" {
+		t.Fatal("followed pilot symlink")
+	}
+}

package/templates/native-go/backend/internal/helper/managed_pilot_test.go

@@ -0,0 +1,210 @@
+package helper
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+type pilotMemory struct {
+	record    managedPilotRecord
+	failure   Code
+	afterSave func(managedPilotRecord)
+}
+
+func (s *pilotMemory) Load(context.Context) (managedPilotRecord, Code) { return s.record, s.failure }
+func (s *pilotMemory) Save(_ context.Context, r managedPilotRecord) Code {
+	if s.failure != "" {
+		return s.failure
+	}
+	s.record = r
+	if s.afterSave != nil {
+		s.afterSave(r)
+	}
+	return ""
+}
+
+func TestManagedPilotExpiredDuringDurableApprovalRefuses(t *testing.T) {
+	p, a, _, s, _, c := pilotFixture(t)
+	now := p.now()
+	s.afterSave = func(r managedPilotRecord) {
+		if r.Enabled {
+			a.now = func() time.Time { return now.Add(3 * time.Second) }
+		}
+	}
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
+		t.Fatal("approval outlived native proof")
+	}
+	if s.record.Enabled || !a.fenced {
+		t.Fatal("stale durable approval remained enabled")
+	}
+}
+
+type pilotNativeFake struct {
+	admin, user managedPilotObservation
+	failure     Code
+}
+
+func (f *pilotNativeFake) Observe(_ context.Context, c SessionCarriers) (managedPilotObservation, Code) {
+	if c.Cookie == "admin" {
+		return f.admin, f.failure
+	}
+	return f.user, f.failure
+}
+func pilotFixture(t *testing.T) (*NativeProvider, *GrantAuthority, *memoryGrantRepository, *pilotMemory, *pilotNativeFake, SessionCarriers) {
+	t.Helper()
+	a, r, _, _, acct, _, _, now := grantAuthorityFixture(t)
+	observation := managedPilotObservation{Account: acct.value, SessionRef: grantRef('c'), BoundaryRef: grantRef('d'), BoundaryProven: true, SessionsPurged: true, FreshLogin: true, CheckedAt: now}
+	observation.Account.Principal.InstanceRef = ""
+	f := &pilotNativeFake{admin: observation, user: observation}
+	f.user.Account.Admin = false
+	store := &pilotMemory{}
+	p := newManagedPilotProvider(f, store)
+	p.now = func() time.Time { return now }
+	// Each provider binds exactly one authority and never adopts another epoch.
+	a.native = p
+	if c := p.managed.bind(a); c != "" {
+		t.Fatal(c)
+	}
+	return p, a, r, store, f, SessionCarriers{Cookie: "user"}
+}
+func TestManagedPilotExplicitOptInAndSeparateIdentity(t *testing.T) {
+	p, _, _, store, _, c := pilotFixture(t)
+	if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
+		t.Fatal("default enabled")
+	}
+	// A new authority is required after a denial fenced the old owner.
+	p, _, _, store, _, c = pilotFixture(t)
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, false); code != ErrDenied {
+		t.Fatal(code)
+	}
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
+		t.Fatal(code)
+	}
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" || !actor.valid || actor.IdentityBasis() != "managed-enrollment" || !store.record.Enabled {
+		t.Fatal(code, actor.IdentityBasis())
+	}
+	strict, _, _, _, _ := nativeFixture()
+	if _, code = strict.Revalidate(context.Background(), c, actor); code != ErrSuspended {
+		t.Fatal("pilot crossed strict contract", code)
+	}
+	store.record.Generation = strings.Repeat("f", 64)
+	if _, code = p.Resolve(context.Background(), c); code == "" {
+		t.Fatal("restored/substituted record accepted")
+	}
+}
+func TestManagedPilotProofFailuresNeverEnable(t *testing.T) {
+	for _, change := range []func(*pilotNativeFake){
+		func(f *pilotNativeFake) { f.admin.Account.Admin = false },
+		func(f *pilotNativeFake) { f.user.BoundaryProven = false },
+		func(f *pilotNativeFake) { f.user.SessionsPurged = false },
+		func(f *pilotNativeFake) { f.user.FreshLogin = false },
+		func(f *pilotNativeFake) { f.user.Account.Groups = nil },
+		func(f *pilotNativeFake) { f.user.Account.Enabled = false },
+		func(f *pilotNativeFake) { f.user.Account.Principal.Kind = "ldap" },
+		func(f *pilotNativeFake) { f.user.CheckedAt = f.user.CheckedAt.Add(-3 * time.Second) },
+	} {
+		p, _, _, s, f, c := pilotFixture(t)
+		change(f)
+		if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" || s.record.Enabled {
+			t.Fatal("unproved opt-in")
+		}
+	}
+	p, _, _, s, _, c := pilotFixture(t)
+	s.failure = ErrCommitUncertain
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
+		t.Fatal("uncertain enable accepted")
+	}
+}
+func TestManagedPilotUnknownRevokesAndDrainsThroughAuthority(t *testing.T) {
+	p, a, r, s, f, c := pilotFixture(t)
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
+		t.Fatal(code)
+	}
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	gstore, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	g := gstore.Grants[0]
+	g.Owner = actor.Principal()
+	g.Issuer = actor.Principal()
+	r.store.Grants = []Grant{g}
+	f.user.Account.UID++
+	if _, code = p.Resolve(context.Background(), c); code == "" {
+		t.Fatal("mutation accepted")
+	}
+	if !a.fenced || s.record.Enabled || r.store.Grants[0].State != GrantRevoked || !completeQuiescence(r.q) {
+		t.Fatal("missing R/Q fence", r.store, r.q)
+	}
+	if code = a.WithGrantAdmission(GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}, func(Grant, NativeActor) Code { t.Fatal("reserved after fence"); return "" }); code == "" {
+		t.Fatal(code)
+	}
+	if code = p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
+		t.Fatal("fenced epoch re-enabled")
+	}
+}
+
+func TestManagedPilotCleanupFailureNeverClaimsQuiescence(t *testing.T) {
+	p, a, r, s, f, c := pilotFixture(t)
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
+		t.Fatal(code)
+	}
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	store, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	g := store.Grants[0]
+	g.Owner = actor.Principal()
+	g.Issuer = g.Owner
+	r.store.Grants = []Grant{g}
+	r.qFailure = ErrBusy
+	f.user.BoundaryProven = false
+	if _, code = p.Resolve(context.Background(), c); code != ErrCleanupRequired {
+		t.Fatal(code)
+	}
+	if !a.fenced || s.record.Enabled || r.store.Grants[0].State != GrantRevoked {
+		t.Fatal("failed cleanup restored authority")
+	}
+}
+
+func TestManagedPilotMaintenanceFencesSharedReservationOrder(t *testing.T) {
+	p, a, r, _, _, c := pilotFixture(t)
+	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
+		t.Fatal(code)
+	}
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	store, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	g := store.Grants[0]
+	g.Owner = actor.Principal()
+	g.Issuer = g.Owner
+	r.store.Grants = []Grant{g}
+	gate := newAdmission(Binding{Boot: "b", Install: "i"})
+	gate.observe(gate.binding, 1, true, a.now())
+	a.mu = &gate.mu
+	a.gate = gate
+	if code = p.managed.beginMaintenance(context.Background()); code != "" {
+		t.Fatal(code)
+	}
+	if gate.allow(a.now()) {
+		t.Fatal("lifecycle/relay gate remained open")
+	}
+	if code = a.WithGrantAdmission(GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}, func(Grant, NativeActor) Code { t.Fatal("reservation after maintenance"); return "" }); code == "" {
+		t.Fatal(code)
+	}
+}

package/templates/native-go/backend/internal/helper/management.go

@@ -0,0 +1,79 @@
+package helper
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// A different build cannot acquire authority from this record. Management only
+// consumes the old owner's terminal publication; it never rewrites approval or
+// starts/signals a process. Private completion contents stay private to root.
+func (c Client) staleManagementStopped() bool {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || !r.Enabled || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
+		return false
+	}
+	if !c.canonicalApproval(r) || !c.completionPublished(r) {
+		return false
+	}
+	if err := protected(c.RunDir, c.Owner, true); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return false
+	}
+	// Bind the historical lifetime witness even for package-user hooks that
+	// cannot read mode-0600 files. The sealed terminal publication attests that
+	// this epoch has exited; it is not inferred from missing /run files alone.
+	lease, err := os.Lstat(leasePath(c, r.Lifecycle))
+	if err != nil {
+		return false
+	}
+	stat, ok := lease.Sys().(*syscall.Stat_t)
+	if !ok || !lease.Mode().IsRegular() || lease.Mode().Perm() != 0600 || lease.Size() != 64 || stat.Uid != c.Owner || stat.Nlink != 1 || uint64(stat.Dev) != r.Lifecycle.Lease.Device || stat.Ino != r.Lifecycle.Lease.Inode {
+		return false
+	}
+	proof, err := os.Lstat(filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json"))
+	if err != nil {
+		return false
+	}
+	st, ok := proof.Sys().(*syscall.Stat_t)
+	if !ok || st.Nlink != 1 || proof.Size() == 0 || proof.Size() > 4096 {
+		return false
+	}
+	if uint32(os.Geteuid()) == c.Owner {
+		// The owner additionally verifies private bytes and kernel quiescence.
+		lock, err := acquireLifetime(c, r.Lifecycle)
+		if err != nil {
+			return false
+		}
+		defer lock.Close()
+	}
+	// Recheck the exact protected publication after inspecting proof and runtime.
+	return runtimeAbsent(c) && c.canonicalApproval(r)
+}
+
+func (c Client) canonicalApproval(r Record) bool {
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "approval.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return false
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != 0644 || stat.Uid != c.Owner || stat.Nlink != 1 || st.Size() > 4096 {
+		return false
+	}
+	got, err := io.ReadAll(io.LimitReader(f, 4097))
+	if err != nil {
+		return false
+	}
+	want, err := json.Marshal(r)
+	return err == nil && bytes.Equal(got, want)
+}