[LittleCoinCoin]

Closes items W1, E1, E2 and E3 of table C of the conformance review (__reports__/candler-v1-review/00-findings_v0.md):

• W1: the one wire breach.
• E1, E2, E3: three places where an M2b gate rested on weaker evidence than planned.

Two read-only reviews shaped the plan before any code was written. The first checked alignment with the goal of a domain-agnostic session runner, and the second hardened the plan. Six leaves then ran in parallel, each on its own task branch, and each lands here as a --no-ff merge. Every leaf that touches a persisted contract, the production recovery, a real daemon or real signals had an adversarial verifier (W1, E2, E3, E3b).

Out of scope, and untouched: E4, the planner axis, stable.in, ENTRY_PARAMS, the I1 guard, provenance names (all in M2c's amendment A2), and docs drift (the sibling session).

What lands

Item	Change	Guard	Release
W1	CatalogServer reads through object_only!. The snapshot's wire struct reads through MapOnly. A struct written as a list is refused at every level.	unit test at each level, plus a fixture-wide guard in guard_wire_shapes.rs	fix(schemas): schemas patch
E1	none (test only)	B39: environments and read-only input mounts never enter the run tree, and a marker at the workspace root empties it	none
E2	recover_job_dir / recover_job_dir_with in jobs::runtime::session replace the byte-identical ps::recover_job and session::recover_one. ps, kill, watch and reap_lost_jobs call it.	B36 recovers through the shared composition, with only the destroy half behind the test's allowlist. B42 pins reap_lost_jobs (spares its own job, recovers a lost sibling, leaves an ended one, stops on cancel).	refactor(jobs): core patch
E3 (lost half of gate 4)	none (test only)	B40: the real candler kill --all -y against real containers, through a fail-closed docker shim	none
E3 (running half of gate 4)	none (test only)	B41: the real candler kill --all -y against two live supervise_entry supervisors, which end their own jobs as killed	none
—	build(cli): candler takes candler-core/test-support on its dev-dependency edge only. Cargo.lock does not move.	—	none

The schema files are byte-identical. DRIFT is green after a bless, and git diff origin/main -- crates/candler-schemas/schema is empty.

Bite evidence

Every bite was restored with git checkout -- <file>, then git diff --quiet.

W1

• Remove remote = "Self" and object_only!(CatalogServer). Both tests go red:
  • guard_wire_shapes: bio_opentrons.json: the object at '/servers/0' written as a list was read
  • the unit test: a server as a list
• Read CatalogSnapshotWire without MapOnly. Both go red:
  • the guard: the object at '' written as a list was read
  • the unit test: a snapshot as a list
• The review's probe ["tool-catalog-snapshot/1","2026-01-01T00:00:00Z","p@1",{},{},[]] returned Ok at the base. It is now refused through from_value, from_str, from_slice and from_reader. The verifier diffed every object-form behaviour (error text and order, null optionals, unknown keys) against the base and found none changed.

E1 (B39)

• A marker that matches no output name:

  left:  ["inputs/corpusx/b.txt", "out/a.txt", "tools/env/bin/python", "tools/env/pyvenv.cfg", "tools/run.sh", "venv/lib/python3.12/site-packages/x.py", "venv/pyvenv.cfg", "venvish/pyvenv.cfg.bak"]
  right: ["inputs/corpusx/b.txt", "out/a.txt", "tools/run.sh", "venvish/pyvenv.cfg.bak"]
  

  The root case also goes red: left: ["lib/x.py", "out/a.txt", "pyvenv.cfg"], right: [].

• Input mount points dropped from the filter:

  left:  ["inputs/corpus/a.txt", "inputs/corpus/deep/b.txt", "inputs/corpusx/b.txt", "out/a.txt", "tools/run.sh", "venvish/pyvenv.cfg.bak"]
  right: ["inputs/corpusx/b.txt", "out/a.txt", "tools/run.sh", "venvish/pyvenv.cfg.bak"]
  

E2 (B36 through the shared path)

• The lost-job path skips the container sweep (jobs/lost.rs). B36 goes red at supervision_gates_e2e.rs:385:

  containers of the job remain: [<agent>, <upstream>, <gateway>]
  

  The implementer and the verifier each reproduced it once. The test's cleanup removed the bitten run's containers through the guard.

E2 (B42)

• Remove the own filter in reap_lost_jobs:

  left:  [report …22 Recovered, report …23 Recovered]
  right: [report …23 Recovered]
  

• Remove the cancel check:

  cancelled-reports 1, cancelled-sibling Ended(Failed)
  

E3 (B40)

• kill stops only the first target:

  no single '<second lost id>: recovered (1 containers destroyed)' line in …
  

  docker ps -aq and docker network ls -q were identical before and after the bitten run.

• Shim made permissive (listed "$1" || true). Both shim tests go red:

  `container stop -t 1 OTHER` was not refused
  `rm ID` was not refused
  

E3 (B41)

• kill's Running branch skips sup.reap. B41 goes red:

  <id>: not stopped: its supervisor still holds the job
  

  The exit code was 2 instead of 0. No supervisor child survived; the verifier checked by the pids it sampled.

Safety on a shared machine

B40 and B41 follow the meta manager's binding conditions on top of the M2b safety rules.

Store scope

• Every binary call passes --store <tempdir>, with HOME, the XDG config, data, state and cache directories all inside the tempdir, and CANDLER_STORE unset.
• Before any -y, a kill --all dry run with stdin closed must be refused (exit 2). Its first line must equal exactly would stop: <the test's own ids, sorted>, or the test aborts. This pre-check passed in every run (implementers and verifiers).

B40's shim

• The binary reaches docker only through a fail-closed shim first on PATH.
• The shim bakes in the real docker's absolute path, refuses to run if that path is itself, and refuses:
  • every destroy verb on an id outside the test's own (full ids only);
  • every option before the verb;
  • any -H, --host or --context anywhere;
  • unknown verbs.
• Refusal matrix: 56 cases plus about 90 verifier cases, all against a fake docker. They cover update, exec, run, create, start, restart, pause, cp, compose, buildx, system, context use, network create/connect/disconnect, volume rm, mixed id lists, smuggled whitespace and newlines, prefixes and an empty allowlist. Every case is refused, with positive controls.
• Cleanup removes only the exact ids captured at creation, through ContainerGuard over AllowlistDriver.

B41's shim and signals

• B41's shim forwards nothing. With an empty allowlist, a fall-through to recovery cannot reach the daemon. Its matrix (destroy verbs, -H, --host and --context in every form, read controls) runs in the default suite.
• Before kill, per job:
  • the pid in job.json equals the Child::id() the test holds;
  • the child leads its own group;
  • the group holds no other process.
• Every wait is bounded. The supervisors' wait is bounded at 5 minutes, so even an abnormal death of the test cannot leave them behind. A drop guard kills and reaps every child by handle.

Local results on the merged tip

Measured on fix/v1-review-conformance with sccache and its own target dir:

Gate	Result
guard_signal, the pre-run step after cargo clean -p candler-core	9/9 pass
cargo fmt --check	clean
cargo clippy --workspace --all-targets -- -D warnings	clean
cargo nextest run --workspace	351 pass, 17 skipped (the ignored Docker guards)
RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps	clean
DRIFT (bless, then git status and git diff origin/main -- crates/candler-schemas/schema empty)	green, schema files unchanged
cog check origin/main..HEAD, subjects at most 72 characters	pass
B36 and B40 with --run-ignored only on Docker Desktop (macOS)	both pass (17.9 s, 25.4 s)
docker ps -aq and docker network ls -q before and after the e2e run	identical

The Linux container-e2e job decides B06, B08, B09, B12, B13, B17, B18, B36, B37 and the new B40.

Notes for review

• Trailers. Commits written by the Sonnet 5 implementers carry Co-Authored-By: Claude Sonnet 5.5, the model that wrote them, as CONTRIBUTING asks. Merge commits and commits the coordinator touched also carry Claude Opus 5.5.
• recover_job_dir_with is public and not gated. ContainerGuard::new was already public, and a caller supplies only a destroy half, never the guard's rules. B16 still refuses any src/ file that names DestroyDriver. Gating the seam behind test-support is an option, but it was not needed here.
• B36's sweep limit is now the production 2 minutes, up from the rig's 60 s.
• New tests in the default suite: B41 and both shims' refusal tests. They need no daemon and run in about 1 s each. shim_refusals falls under the container-e2e test group's filter, which only serializes it.
• Known, harmless gaps:
  • B40's shim passes a read verb that carries --config. Destroy verbs refuse every option they do not know.
  • B41's 5-minute body timeout path is stated, not exercised.
• Received, not in scope (the meta manager takes them to Eliott as their own follow-up):
  • the docs session's code gaps: no agent container-record/1, and legacy streams missing from import.sources[];
  • the list of 37 #[allow]/#[expect] attributes.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

🤖 Generated with Claude Code