morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #59] Capture owned process trees and filesystem effects #47

New issue

Open

opened 2026-10-15 18:20:27 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-15 18:20:27 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/59

Problem

A root process can spawn workers, re-exec, and mutate files outside what PTY output reveals.

Outcome

Record owned descendant lifecycles and bounded filesystem before/after evidence inside declared roots.

Scope

Track root, children, grandchildren, reparenting, exit, and signal events.
Normalize PID/PPID while retaining raw values only in protected raw evidence.
Snapshot file type, mode, size, content hash, symlink target, and relative path.
Classify created, modified, deleted, and unchanged entries.
Isolate HOME and working roots.
Verify descendant and temporary-root cleanup.

Safety

Never inspect unrelated processes or undeclared filesystem roots. Prevent symlink escape, special-device reads, and unbounded trees. Bound depth, entries, bytes, and hashing.

Acceptance criteria

Fixtures prove child/grandchild/reexec behavior, file mutation/deletion, symlinks, escape rejection, truncation, cancellation, and cleanup. Missing observations remain unknown.

Dependencies

Parent: #48. Requires process scenario contracts, PTY adapter, and ownership.

Non-goals

System-wide syscall tracing, kernel extensions, or root-required observation.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/59 ## Problem A root process can spawn workers, re-exec, and mutate files outside what PTY output reveals. ## Outcome Record owned descendant lifecycles and bounded filesystem before/after evidence inside declared roots. ## Scope - Track root, children, grandchildren, reparenting, exit, and signal events. - Normalize PID/PPID while retaining raw values only in protected raw evidence. - Snapshot file type, mode, size, content hash, symlink target, and relative path. - Classify created, modified, deleted, and unchanged entries. - Isolate HOME and working roots. - Verify descendant and temporary-root cleanup. ## Safety Never inspect unrelated processes or undeclared filesystem roots. Prevent symlink escape, special-device reads, and unbounded trees. Bound depth, entries, bytes, and hashing. ## Acceptance criteria Fixtures prove child/grandchild/reexec behavior, file mutation/deletion, symlinks, escape rejection, truncation, cancellation, and cleanup. Missing observations remain unknown. ## Dependencies Parent: #48. Requires process scenario contracts, PTY adapter, and ownership. ## Non-goals System-wide syscall tracing, kernel extensions, or root-required observation.

bsakaguchi added the

labels

2026-10-15 18:20:27 +00:00

bsakaguchi commented

2026-10-15 18:20:29 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current main substantially delivers the filesystem side through FilesystemSnapshot, ProcessSampling, ProcessOwnership, capture effects, and tests. The remaining gap is event-complete process-tree lifecycle fidelity: polling can miss short-lived descendants and does not prove complete spawn/exit/re-exec/reparent history. The issue should remain open for that ownership-semantic gap.

@morluto commented on GitHub (Jul 17, 2026): Current main substantially delivers the filesystem side through FilesystemSnapshot, ProcessSampling, ProcessOwnership, capture effects, and tests. The remaining gap is event-complete process-tree lifecycle fidelity: polling can miss short-lived descendants and does not prove complete spawn/exit/re-exec/reparent history. The issue should remain open for that ownership-semantic gap.

bsakaguchi commented

2026-10-15 18:20:29 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current-main audit: filesystem created/modified/deleted/unchanged effects, sampled child/grandchild trees, cleanup, cancellation, and fixture coverage are delivered. Remaining scope is event-complete process-tree lifecycle fidelity: the current 50 ms procfs sampling can miss short-lived descendants and cannot prove full spawn, exit, re-exec, and reparent history. Keep open for an event-backed platform implementation and proof.

@morluto commented on GitHub (Jul 17, 2026): Current-main audit: filesystem created/modified/deleted/unchanged effects, sampled child/grandchild trees, cleanup, cancellation, and fixture coverage are delivered. Remaining scope is event-complete process-tree lifecycle fidelity: the current 50 ms procfs sampling can miss short-lived descendants and cannot prove full spawn, exit, re-exec, and reparent history. Keep open for an event-backed platform implementation and proof.

bsakaguchi commented

2026-10-15 18:20:29 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#332
#333

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #332 - [ ] #333 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:11:17 +00:00

[PR #47] [CLOSED] chore(main): release rea 0.3.0 #1812

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:40 +00:00