[raylei50653]

Part of #465 (Phase C PR-C1). This implements owner decision C-D1: the shipping tree now carries the 27 third-party objects of the PR-12 formal run byte-for-byte, and runs without LD_LIBRARY_PATH. The entrypoint and the operator library bytes are both unchanged from PR-12.

Bundles are built and tested locally only. Nothing is distributed until nvJitLink / cuFile / nvshmem redistribution is confirmed (scope §4).

Design (followed the owner's direction: probe --library-path first, preserve bytes)

• Launcher. bin/saccade_track is a POSIX sh launcher. It runs exec /lib64/ld-linux-x86-64.so.2 --library-path <prefix>/lib/vendor --audit <prefix>/lib/saccade_loader_audit.so <prefix>/libexec/saccade_track "$@".
  • It unsets LD_PRELOAD / LD_AUDIT / LD_LIBRARY_PATH first.
  • --library-path precedes DT_RUNPATH, so the op library's libnvrtc.so.13 resolves from lib/vendor without touching saccade_track.
• Probe finding (corrects scope doc §5). torch, TensorRT and nvshmem carry DT_RPATH, which the loader searches before --library-path. A copy planted at <prefix>/nvidia/cu13/lib gets loaded silently (probe P4).
  • With the libs at lib/vendor/, every relative RPATH/RUNPATH entry expands inside the prefix. The only exception is libcusparseLt's empty entry (cwd).
• Secondary fail-closed check. shipping/src/loader_audit.c is an rtld-audit library written in C that needs only libc. It replaces the earlier /proc/self/maps idea and leaves the saccade_track bytes untouched.
  • la_objsearch: for a bundled name, it skips any candidate outside lib/vendor. If such a candidate exists on disk, it exits 127.
  • la_objopen: it checks every mapped object by realpath.
• Entrypoint pin. Rebuilding the same sources was not byte-identical: three builds gave three sha256 values (nvcc tmpxft names, .rela, build-id). So the tree carries the PR-12 binary (d7c6e0d4…), pinned in shipping/entrypoint_pin.json and installed via SACCADE_SHIPPING_ENTRYPOINT. This is the same model as the op library.
• Install. shipping/third_party_set.json pins each object by SONAME, sha256, source wheel and license files. The install copies and hash-checks every object into lib/vendor/, and puts the license files under licenses/, plus THIRD_PARTY.md.
• Tools. check_shipping_bundle.py (static / sources / runtime), export_third_party_set.py, and bundle / bundle-strace modes for run_shipping_container.sh. There are 21 unit tests, including the auditor on a real loader.

Acceptance criterion redefined (needs owner review)

G2-2 changes from "exactly one execve" to an exec chain of exactly two: the launcher, then /lib64/ld-linux-x86-64.so.2 with the launcher's arguments. Neither one is Python (docs §17.4 gate 5).

Formal run: r2 at 16233e92, PASS (docs §17.5)

The contract was committed in 51840396, before any measurement; amendment A1 is in 16233e92.

• Gates 1–2: install with all pins checked; 11/11 static checks pass.
• Gate 3, host via the launcher: EXACT (detector 5316/5316, MOT txt 7/7, graph captures 7/7). Byte-identical to the PR-12 formal run. sources: every third-party object loaded from tree/lib/vendor.
• Gate 4, clean ubuntu:24.04 with LD_LIBRARY_PATH unset: EXACT, identical to gate 3.
• Gate 5, strace: exec chain launcher → loader; no Python / Triton opens; the opened set equals the bundle. EXACT.
• Negative controls N1–N9: all caught.
  • N4 (planted libcublas): exit 127 from the auditor.
  • N5 (same, without --audit): the foreign copy is loaded and the runtime check fails. This shows it is the auditor that blocks N4.
• r1 (51840396) superseded by A1. Gates 1–5 also held in r1, but two negative controls did not run as written:
  • N3: the static checker crashed on a missing vendor file. Fixed, with a test.
  • N6: my prediction was wrong. The hostile LD_PRELOAD hit the launcher's own sh, which then exited 127. N6 is now split into N6a and N6b. The whole run was repeated.

Named limits (§17.6):

• The launcher's own sh is not protected from the caller's LD_PRELOAD (N6b observation). The entrypoint process is protected.
• The auditor checks paths, not bytes. Byte integrity comes from the install-time check and the static check, and later from the PR-C3 MANIFEST.
• The pinned entrypoint file lives in the PR-12 results directory, which is not under version control.
• Still sm_120 only, one WSL2 host, about 3.7 GiB, non-atomic install. The parity harness still passes --measurement-mutation (PR-C2).

Stack merged in (10-07)

#528 (PR-C1 republish) merged into this branch; it carries #529 (PR-C2 shipping CLI, docs §18) and #530 (PR-C2 republish). Main-base CI at b73d0a65: all checks pass, including pytest.

Review fixes at b73d0a65 (docs §18.10–§18.11)

• [P1] Fail-open launcher, amendment A2. The loader ignores an --audit library it cannot load. With the auditor missing, truncated or not an auditor, the old launcher ran the entrypoint unprotected: a planted DT_RPATH copy loaded and the process exited 0. Fix in 71acc415:
  • The launcher first runs the same loader, library path and auditor on /bin/sh -c : with SACCADE_AUDIT_PROBE=1.
  • After deriving <prefix>, the auditor's la_version prints a ready line and exits.
  • If the launcher does not read that line, it exits 127. The caller's SACCADE_AUDIT_PROBE is unset.
  • G2-2 becomes three execs: launcher → loader in one process, and the probe in a child. This redefinition needs owner review.
• [P2] runtime ignored alias targets. Both runtime gates now also check the strace -yy returned-fd target (0f26d08a).
• [P2] rejected hard-coded the model root. no_model_root_open now also covers the run's own --model-root / --config / --lineage / --attestation. Relative values are resolved against the evidenced cwd; if none is evidenced, the check fails closed (0f26d08a).
  • A clean replay of the 13 existing C1/C2 reports at 0f26d08a gives identical per-check outcomes (results/465_prc1_bundle/review_fix_0f26d08a/).
• Tests: real-loader tests cover a missing, truncated, empty and non-auditor library: each exits 127 and nothing runs. With the old launcher, all four ran the planted copy. They also cover a caller-set probe variable, plus exec-chain negatives and the P2 regressions (117 tests pass in the two shipping test files).
• A2 formal run at 036d6b95 (contract §18.10 committed before measurement): PASS. It reran the whole §18.4 run (gates 1–6, M1–M6, N1–N9) on the C1+C2 head.
  • Gates 3–5 are EXACT: detector 5316/5316, MOT txt 7/7, graph 7/7, byte-identical to the PR-12 formal run.
  • The 3-exec chain passes.
  • Rejection 3×5 passes; the 7 mutation controls are caught.
  • New controls: N10–N12 (auditor missing / half / libcudart copy, with the planted copy present) each exit 127 with only launcher + probe exec'd and no output. N13 (caller SACCADE_AUDIT_PROBE=1) exits 0 with identical MOT17-05 output.
  • N5 now uses the PR-C1 launcher without --audit; the planted copy loads and the runtime gates fail, as before.
  • Results: results/465_prc2_cli/full_036d6b95/.
• Limits: probe and exec are two loader starts, so this makes no race claim; anyone who can rewrite the tree can rewrite the launcher too. The auditor's bytes are still not verified at run time (PR-C3 MANIFEST).
• Republish: stacked chore(provenance): republish the runtime coordinate for #465 PR-C1 A2 #531 (implementation e00a504c → 568c0e08; only the launcher and the auditor changed). pre_push on the combined head bc01144a: exit 0, 5212 passed. CI on this branch alone will fail the coordinate tests until chore(provenance): republish the runtime coordinate for #465 PR-C1 A2 #531 is merged.

Review fixes at 93f4de43 — amendment A3 (docs §18.12–§18.13)

After #531 merged (93f4de43), main-base CI passed all 8 checks. The review found three P2 coverage gaps. None of them was observed as a parity violation in a shipping run.

• Auditor alias bypass. la_objopen classified an object by its requested basename before resolving it, so payload → foreign libfoo.so ran the foreign code. It now resolves with realpath first and classifies by both the mapped name and the real name (f1d98b93). A real-loader CPU test covers it: the direct foreign copy exits 127, and the alias now exits 127 too (the old auditor printed the foreign result).
• runtime passed with unresolved opens. Unresolved records now fail the Python-open and opened-set gates.
• No -yy in the evidence. bundle-strace now records with -yy.
  • runtime and rejected require a returned-fd target on every successful open. --legacy-plain-trace evaluates historical plain logs and records that alias targets were not checked.
  • fd targets are classified by SONAME family (libstdc++.so.6.0.33 → libstdc++.so.6, 06002566). The dev trial needed this: without it, two base-system targets were reported as foreign.
• A3 formal run at 276659a8 (contract committed first): PASS. Gates 1–6, M1–M6 and N1–N13 give the same results as the A2 run.
  • The -yy container trace has 6,533 opens; all 6,028 successful ones carry an fd target, and 0 are unresolved.
  • New N14: the plain A2 trace fails without --legacy-plain-trace (6,028 unresolved) and passes with it.
  • Results: results/465_prc2_cli/full_276659a8/.
• Limit: classification is still by name (real basename, SONAME family). A renamed foreign regular file reached through a non-bundled NEEDED or dlopen is not recognized; byte integrity stays with the install-time sha256, static and the PR-C3 MANIFEST.
• Republish: stacked chore(provenance): republish the runtime coordinate for #465 PR-C1 A3 #532, merged into this branch (ff7359d4) after review. Implementation 568c0e08 → 97943682; only loader_audit.c changed. Main-base CI at ff7359d4: all 8 checks pass.

Review fixes at ff7359d4 — amendment A4 (docs §18.14–§18.15)

The review at ff7359d4 found four P2 gaps and one P3. As before, none of them was observed as a parity violation in a shipping run. Fix e6b57ac8.

• Auditor: versioned alias. payload → libcudart.so.13.1.0 matched neither the bundled SONAME libcudart.so.13 nor the real name, so it was allowed. la_objopen now compares names by SONAME family (the checker's _object_class rule). CPU real-loader test: aliases to libfoo.so.1.0.0 and libfoo.so.13 exit 127; an alias to another family still runs.
• Exec chain: whole loader argv. The checker used to compare only the first four loader arguments and test whether the entrypoint appeared anywhere. The loader argv must now equal exactly: loader options, --argv0 <launcher argv[0]>, the entrypoint in the program slot, then the launcher's own arguments.
• Incomplete exec records fail closed. An execve/execveat line that strace did not record to completion is kept as a failed exec, so the chain fails.
• Default model root. rejected simulates the entrypoint's argv parse (track_driver.hpp). When --model-root is not consumed, every evidenced cwd is protected; without cwd evidence the check is unresolved and fails. _within("/") now covers every path.
• Launcher (P3): the prefix must not contain ; either.
• A4 formal run at 1ae402c2 (contract committed first): PASS. Gates 1–6, M1–M6 and N1–N14 give the same results as A3.

  • The -yy trace has 6,485 opens; all 5,992 successful ones carry an fd target, and 0 are unresolved.

  • New controls, each also evaluated with the A3 checker as a reproduction record:

    Control	A4	A3
    N15: /bin/true in the program slot	exec chain FAIL	PASS
    N16: unfinished Python execve	exec chain FAIL	PASS
    N17a: --model-root removed	no_model_root_open FAIL	PASS
    N17b: cwd /work + engine open	no_model_root_open FAIL, attempted = the engine	PASS
    N18: tree at /opt/sac;cade	launcher exit 2	loader exit 127

  • N15–N17 are synthetic: one edit each to a copy of a real trace from this run.

  • Results: results/465_prc2_cli/full_1ae402c2/.

• Limits: the SONAME family is still a name, so a renamed foreign file outside any bundled family is not recognized. The versioned-alias control is CPU-only, because doing it on the shipping tree needs a modified pinned ELF. The default-root check depends on mirroring the entrypoint's parse rules.
• Republish: stacked chore(provenance): republish the runtime coordinate for #465 PR-C1 A4 #533 (implementation 97943682 → 7d4dc790; loader_audit.c and the launcher changed). pre_push on the combined head 1c1fe269: exit 0, 5241 passed. CI on this branch alone fails the coordinate tests until chore(provenance): republish the runtime coordinate for #465 PR-C1 A4 #533 is merged.

Scope doc

native_runtime_phase_c_scope.md gets a correction note: DT_RPATH, the launcher plus auditor design, and the entrypoint pin. It also records C-D5 = minisign (v1).

Checks

• scripts/pre_push.sh: 5100 passed, 4 failed. All 4 failures are the runtime-identity publication lag (implementation moved and was not republished). A stacked republish PR follows, the same way as chore(provenance): republish the runtime coordinate for #465 PR-12 #525.
• The attested op library is unchanged (aa84cccd).

🤖 Generated with Claude Code