johnandersen777.bsky.social/socialweb-computer-kcp

Switch repository

Loading…

note: >
  Plan 0006 M1-HOST-INVENTORY. Everything the control-plane container (deploy/control-plane-container/
  Dockerfile, stages tools, controlplane and k8s), the bidder's firecracker runner image
  (ts/hono-compute-provider/hono-firecracker-standalone/Dockerfile) and the code's exec call sites supplied,
  each with exactly one fate on a bare Linux host. Call sites scanned: exec.Command, exec.CommandContext,
  exec.LookPath and syscall.Exec in non-test Go of this repo, and new Deno.Command in non-test TypeScript of
  this repo: socialweb-computer-k8s and every vendored repository under ts/. A computed first
  argument is listed under indirect with every executable it resolves to.
  The runner image, its Dockerfile, the container's nodeimage stage, cmd/socialweb-nodeboot,
  cmd/socialweb-nodeimage and cmd/socialweb-nodeinit are deleted (0006 M3-FOLD); a "from" naming one of
  them records where the executable used to come from.
  Fates that name a
  decision not yet in a plan item say so in why ("decided by Claude, user may veto").

fates:
  linked: compiled into the socialweb-computer core binary as a package or verb (go:embed for data files); nothing separate ships
  embedded-server: an embedded per-GOOS_GOARCH asset (M1-ASSETS) run as its own long-running unit or HostProcess; driven_by names the CRD, or the core's local state, that starts it
  embedded-child: an embedded asset run as a child of the core unit (deno and the TypeScript closure it runs)
  embedded-tool: an embedded asset run to completion by the core or a unit's start stage
  replaced-by-go: the job moves into Go in the core binary; the executable is never needed
  download-asset: fetched and sha256-verified, never installed from a package manager (served by the door, or a guest image pinned in versions.json and built by scripts/build-guest-image.sh)
  host-file: written by `socialweb-computer install` (root, once), never by hand
  host-prerequisite: the host must supply it and check-host probes it by name; the only fate that comes from the host
  build-host: needed only on a build or development host (guest image build, market network tooling), never on a gateway, bidder or requester runtime host
  removed-legacy: deleted by design or legacy that is not ported; no runtime host needs it

entries:
  - name: socialweb-gateway
    kind: executable
    fate: linked
    owner: 0006 M1-CLI, M3-SERVE-GATEWAY-KCP
    why: the gateway becomes `socialweb-computer serve gateway`
    from:
      - "image k8s COPY"
  - name: socialweb-clusterprovider
    kind: executable
    fate: linked
    owner: 0006 M1-CLI, M3-SERVE-GATEWAY-KCP
    why: the cluster provider becomes a verb of the core binary
    from:
      - "image k8s COPY"
  - name: socialweb-cloud-controller-manager
    kind: executable
    fate: linked
    owner: 0006 M1-CLI, M3-CLUSTER-UNITS
    why: a core-binary verb run as a member unit of each cluster's slice
    from:
      - "image k8s COPY"
      - "HostProcess member unit argv via clusterstack CloudControllerManagerArgv"
  - name: socialweb-vault
    kind: executable
    fate: linked
    owner: 0006 M1-CLI, M2-OPENBAO-SERVER
    why: apply-root and prepare-root become core verbs
    from:
      - "image k8s COPY"
  - name: socialweb-tenantcredential
    kind: executable
    fate: linked
    owner: 0006 M1-CLI
    why: an internal re-exec verb of the core binary
    from:
      - "image k8s COPY"
  - name: socialweb-computer-kcp-check-host
    kind: executable
    fate: linked
    owner: 0006 M1-CLI, M2-HOST-CONTRACT
    why: becomes `socialweb-computer check-host`; its SELinux probe execs its own copy, which is the core binary
    from:
      - "image controlplane COPY"
      - "image nodeimage COPY"
      - "check-host checks.go copyPath"
  - name: container-entrypoint
    kind: executable
    fate: linked
    owner: 0006 M2-BOOTSTRAP-LAYER, M3-SERVE-GATEWAY-KCP, M5-RETIRE
    why: its sequence (root bao, kcp, apply-root, bootstrap applies, gateway, clusterprovider, socat, door) becomes the core's bootstrap layer and kcp-reconciled units; the shell script is deleted with the container path
    from:
      - "image k8s COPY of deploy/container-entrypoint.sh"
  - name: kcp
    kind: executable
    fate: embedded-server
    driven_by: the core, from local state (alternating blue/green slot units behind the core's own L4 front)
    owner: 0006 M2-KCP-SLOTS, M1-ASSETS
    why: the unpatched release v0.33.0 as a zstd asset, out of process (user decision 2026-10-12, kcp-spike.md route B)
    from:
      - "image controlplane COPY"
      - "check-host checks.go path"
  - name: kine
    kind: executable
    fate: embedded-server
    driven_by: Cluster (a member unit of each cluster's slice); the core for kcp's own store
    owner: 0006 M3-CLUSTER-UNITS, M2-KCP-STORE, M1-ASSETS
    why: each cluster's store is kine over its own postgres; kcp's store is kine over a dedicated postgres unit
    from:
      - "image controlplane COPY"
      - "check-host checks.go"
      - "HostProcess member unit argv via clusterstack KineArgv"
  - name: postgres
    kind: executable
    fate: embedded-server
    driven_by: Postgres CRD (each cluster's postgres); the core for kcp's own postgres unit
    owner: 0006 M2-POSTGRES, M2-KCP-STORE, M0-PG-SOURCE, M1-ASSETS
    why: a relocatable PostgreSQL 18 set; the build (prebuilt vs from source) is M0-PG-SOURCE's pending choice
    from:
      - "image controlplane dnf postgresql-server"
      - "internal/clusterprovider/postgres.go"
      - "check-host postgres.go"
  - name: bao
    kind: executable
    fate: embedded-server
    driven_by: OpenBaoServer CRD (root and bidder vaults); Cluster for the per-cluster bao member unit
    owner: 0006 M2-OPENBAO-SERVER, M3-CLUSTER-UNITS, M1-ASSETS
    why: OpenBao v2.6.2 as an asset
    from:
      - "image controlplane COPY"
      - "HostProcess member unit argv via clusterstack OpenBaoArgv"
  - name: k3s
    kind: executable
    fate: embedded-server
    driven_by: Cluster (a member unit of each cluster's slice, blue/green slots behind the per-cluster front)
    owner: 0006 M3-CLUSTER-UNITS, M3-CP-SLOTS, M1-ASSETS
    why: the tenant control plane
    from:
      - "image controlplane COPY"
      - "image nodeimage COPY"
      - "check-host checks.go"
      - "socialweb-nodeimage k3sdata.go"
      - "HostProcess member unit argv"
  - name: external-secrets
    kind: executable
    fate: embedded-server
    driven_by: Cluster (controller and webhook, two member units of each cluster's slice)
    owner: 0006 M3-CLUSTER-UNITS, M1-ASSETS
    why: the digest-pinned upstream binary, now an asset instead of an image copy
    from:
      - "image controlplane COPY"
      - "HostProcess member unit argv via clusterstack ExternalSecretsArgv"
  - name: dumbpipe
    kind: executable
    fate: embedded-server
    driven_by: ClusterLink (member units of each cluster's slice); the requester instance's tunnel HostProcess
    owner: 0006 M3-CLUSTER-UNITS, M1-ASSETS, 0008 M4-RUN-REQUEST
    why: the iroh transport, the only guest transport kept (user decision 2026-10-12); the requester's `which dumbpipe` lookup goes with the asset
    from:
      - "image k8s curl download"
      - "HostProcess member unit argv via clusterlink.Argv"
      - "ts/atproto-market requester-xrpc ensureDumbpipe"
  - name: firecracker
    kind: executable
    fate: embedded-server
    driven_by: ComputeVM (the VM unit, launched directly by the service manager)
    owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS
    why: no runner container; the VMM is the VM unit's own process
    from:
      - "runner image COPY"
      - "check-host checks.go"
      - "internal/vmruntime firecracker_linux.go VM unit argv (socialweb-vmexec execs it)"
  - name: pasta
    kind: executable
    fate: embedded-server
    driven_by: ComputeVM (the VM unit's network stage, in the VM's own user and network namespace)
    owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS, M1-INSTALL (AppArmor profile)
    why: from passt; the constant pasta gateway replaces the network-index allocator
    from:
      - "runner image dnf passt"
      - "check-host checks.go"
      - "internal/vmruntime firecracker_linux.go VM unit argv"
  - name: deno
    kind: executable
    fate: embedded-child
    owner: 0008 M1-DENO, M1-TS-CLOSURE, 0006 M1-ASSETS
    why: deno 2.9.3 run by the core as the DenoPod runtime (door, bidder, requester); internal/denorun builds every argv; cmd/socialweb-tsbundle fills and probes the closure with it at build time
    from:
      - "image k8s curl download"
      - "internal/denorun/denorun.go"
      - "internal/tsbundle/tsbuild/build.go"
  - name: initdb
    kind: executable
    fate: embedded-tool
    owner: 0006 M2-POSTGRES, M0-PG-SOURCE
    why: part of the relocatable postgres set, run once per data dir
    from:
      - "image controlplane dnf postgresql-server"
      - "internal/clusterprovider/postgres.go"
      - "check-host postgres.go"
  - name: pg_dump
    kind: executable
    fate: embedded-tool
    owner: 0006 M2-KCP-STORE, M3-CP-SLOTS, M0-PG-SOURCE
    why: the dump taken before each kcp or k3s upgrade; joins the postgres asset set
    from:
      - "plan 0006 M2-KCP-STORE"
  - name: socialweb-vmexec
    kind: executable
    fate: embedded-tool
    owner: 0007 M2-VM-RUNTIME
    why: the VM unit's one-shot stage inside pasta's namespace (tap, bridge, pinned neighbor over netlink) that execs firecracker; no socialweb-computer code stays in the VM's process tree
    from:
      - "cmd/socialweb-vmexec"
  - name: socialweb-computer
    kind: executable
    fate: linked
    owner: 0007 M2-VM-RUNTIME
    why: the firecracker provider's vmruntime microvm runs `socialweb-computer internal vm` (one-shot prep, unit start, inspect, stop); the kcp provider's guests are booted by the ComputeVM controller in the core of the bidder's own instance (0007 M2-CONTROLLER)
    from:
      - "ts/hono-compute-provider microvm-vmruntime"
  - name: swc-userns-stage
    kind: executable
    fate: embedded-tool
    owner: 0007 M0-VM-USERNS, M2-VM-RUNTIME
    why: first word of each VM unit's ExecStart; creates the per-VM subuid user namespace through newuidmap/newgidmap and execs pasta; static, built reproducibly by scripts/build-userns-stage.sh, pinned in versions.json
    from:
      - "deploy/swc-userns-stage/stage.c"
      - "internal/vmruntime (VM unit ExecStart)"
  - name: psql
    kind: executable
    fate: replaced-by-go
    owner: 0006 M2-POSTGRES
    why: bootstrap rows and readiness go through pgx
    from:
      - "image controlplane dnf postgresql"
      - "internal/clusterprovider/bootstraprows.go"
      - "internal/clusterprovider/postgres.go"
      - "check-host postgres.go"
  - name: kubectl
    kind: executable
    fate: replaced-by-go
    owner: 0006 M2-APPLY
    why: every apply goes through internal/kcpapply (dynamic client, server-side apply)
    from:
      - "image controlplane COPY"
      - "check-host checks.go"
      - "deploy/container-entrypoint.sh"
      - "deploy/install-provider.sh"
  - name: yq
    kind: executable
    fate: replaced-by-go
    owner: 0006 M2-APPLY, M2-TEMPLATE
    why: manifest rendering and patching move into kcpapply and the template layer
    from:
      - "image k8s dnf yq"
  - name: socat
    kind: executable
    fate: replaced-by-go
    owner: 0006 M3-SERVE-GATEWAY-KCP
    why: the TLS terminator becomes a crypto/tls proxy in the core
    from:
      - "image k8s dnf socat"
      - "deploy/container-entrypoint.sh"
  - name: openssl
    kind: executable
    fate: replaced-by-go
    owner: 0006 M3-SERVE-GATEWAY-KCP
    why: certificates are minted with crypto/x509
    from:
      - "image k8s dnf openssl"
  - name: ip
    kind: executable
    fate: replaced-by-go
    owner: 0007 M2-VM-RUNTIME
    why: netlink in socialweb-vmexec; the identical per-guest address plan needs no host address scan
    from:
      - "image k8s dnf iproute"
      - "runner image dnf iproute"
      - "internal/nodevm/namespace.go"
  - name: which
    kind: executable
    fate: replaced-by-go
    owner: 0006 M1-ASSETS
    why: assets are resolved by their extracted path, never searched on PATH; the requester's which dumbpipe goes
    from:
      - "image k8s dnf which"
      - "ts/atproto-market requester-xrpc ensureDumbpipe"
  - name: unzip
    kind: executable
    fate: replaced-by-go
    owner: 0006 M1-ASSETS
    why: only unpacked the deno release in the image build; assets are zstd blobs the core extracts
    from:
      - "image k8s dnf unzip"
  - name: curl
    kind: executable
    fate: replaced-by-go
    owner: 0006 M1-ASSETS
    why: only fetched deno, dumbpipe and the ESO bundle at image build time; those are embedded assets now
    from:
      - "image esobundle and k8s RUN curl"
  - name: ssh-keygen
    kind: executable
    fate: replaced-by-go
    owner: 0007 M4-HOST-KEYS, 0008 M4-RUN-REQUEST
    why: ed25519 keypairs are minted in-process with golang.org/x/crypto/ssh and kept in the application's own OpenBao (every key lives there, user decision 2026-10-12); decided by Claude, user may veto
    from:
      - "ts/atproto-market requester-xrpc generateKeypair"
      - "ts/hono-compute-provider systemctl-shim"
  - name: ssh
    kind: executable
    fate: host-prerequisite
    owner: 0008 M4-RUN-REQUEST, M4-RUN-GATEWAY-SSH
    why: the person's own OpenSSH client for the interactive session on a requester host (ProxyCommand over dumbpipe); not needed on gateway or bidder hosts
    from:
      - "ts/atproto-market requester-xrpc"
      - "image k8s dnf openssh-clients"
  - name: newuidmap
    kind: executable
    fate: host-prerequisite
    owner: 0007 M2-VM-RUNTIME, 0006 M2-HOST-CONTRACT
    why: the distro's setuid helper (rootless podman's) maps each VM's subuid range; a setuid helper is never shipped as an asset; bidders only
    from:
      - "user decision 2026-10-12 per-VM subuid user namespaces"
  - name: newgidmap
    kind: executable
    fate: host-prerequisite
    owner: 0007 M2-VM-RUNTIME, 0006 M2-HOST-CONTRACT
    why: as newuidmap, for the subgid range; bidders only
    from:
      - "user decision 2026-10-12 per-VM subuid user namespaces"
  - name: useradd
    kind: executable
    fate: host-prerequisite
    owner: 0006 M1-INSTALL
    why: the distro's shadow tool creates the one system account (socialweb or swc-bidder); only install, run as root, ever execs it
    from:
      - "user decision 2026-10-12 accounts are created only by install"
  - name: userdel
    kind: executable
    fate: host-prerequisite
    owner: 0006 M1-INSTALL
    why: uninstall --purge deletes the account install created, and only that one
    from:
      - "user decision 2026-10-12 install with uninstall"
  - name: gpasswd
    kind: executable
    fate: host-prerequisite
    owner: 0006 M1-INSTALL
    why: adds the bidder account to kvm before linger, and uninstall removes the membership install added
    from:
      - "user decision 2026-10-12 kvm before linger"
  - name: apparmor_parser
    kind: executable
    fate: host-prerequisite
    owner: 0006 M1-INSTALL, M2-HOST-CONTRACT
    why: loads and unloads the socialweb-pasta profile only where AppArmor restricts unprivileged user namespaces (Ubuntu 24.04+)
    from:
      - "user decision 2026-10-11 AppArmor profile for the embedded pasta"
  - name: unshare
    kind: executable
    fate: host-prerequisite
    owner: 0007 M0-VM-USERNS, 0006 M2-HOST-CONTRACT
    why: util-linux unshare >= 2.38, required only if M0-VM-USERNS chooses it for the userns stage; check-host already probes it; cmd/socialweb-tsbundle starts every closure entry under unshare -rn at build time
    from:
      - "check-host checks.go"
      - "internal/tsbundle/tsbuild/build.go"
      - "cmd/socialweb-tsbundle/main.go"
  - name: systemd
    kind: executable
    fate: host-prerequisite
    owner: 0006 M2-HOST-UNITS, M2-HOST-CONTRACT
    why: systemd 253+ (GetUnitByPIDFD) with the user manager of a lingering account, reached over D-Bus; production installs only, the dev backend is proc
    from:
      - "user decision 2026-10-11 minimum systemd"
  - name: netsh
    kind: executable
    fate: host-prerequisite
    owner: 0011 M0-REVISIT
    why: a Windows OS component read by internal/hostos portrange_windows.go; compiled only for GOOS=windows, outside this Linux plan
    from:
      - "internal/hostos/portrange_windows.go"
  - name: netstat
    kind: executable
    fate: host-prerequisite
    owner: 0011 M0-REVISIT
    why: a Windows OS component read by internal/portscan scan_windows.go; compiled only for GOOS=windows
    from:
      - "internal/portscan/scan_windows.go"
  - name: powershell
    kind: executable
    fate: host-prerequisite
    owner: 0011 M0-REVISIT
    why: a Windows OS component read by internal/hostos proc_windows.go; compiled only for GOOS=windows
    from:
      - "internal/hostos/proc_windows.go"
  - name: socialweb-meshd
    kind: executable
    fate: download-asset
    owner: 0006 M1-ASSETS
    why: two sha256-pinned builds (x86_64, aarch64) the door serves to market nodes
    from:
      - "versions.json asset socialweb-computer-k8s-downloads (scripts/build-web-app-downloads.sh)"
  - name: socialweb-guest-agent
    kind: executable
    fate: download-asset
    owner: 0034 W2-BIDDER-DOWNLOADS
    why: two sha256-pinned builds (x86_64, aarch64), with the opentunnel binaries, that a bidder's GuestControlPlane serves to its guests at /v1/downloads
    from:
      - "versions.json asset socialweb-guest-downloads (scripts/build-guest-downloads.sh)"
  - name: socialweb-nodeinit
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE
    why: the initramfs init of the deleted host-side image build; the pinned guest image boots root=/dev/vda with everything built in and carries no initramfs, so cmd/socialweb-nodeinit is deleted
    from:
      - "image nodeimage stage"
  - name: init
    kind: executable
    fate: download-asset
    owner: 0007 M1-GUEST-IMAGE
    why: /sbin/init inside the guest image, started by the guest kernel from root=/dev/vda
    from:
      - "cmd/socialweb-nodeinit/init.go syscall.Exec"
  - name: busybox
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE
    why: the insmod of the deleted initramfs init; the guest kernel has every driver built in
    from:
      - "cmd/socialweb-nodeinit/init.go"
  - name: socialweb-nodeimage
    kind: executable
    fate: build-host
    owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE
    why: folded into the dev-build verbs `socialweb-computer nodeimage guest-rootfs|guest-manifest` (internal/nodeimagemain, absent from a release build), run only by scripts/build-guest-image.sh on a Linux build host; cmd/socialweb-nodeimage and the bidder's node-image-firecracker exec of it are deleted, bidders fetch the pinned image
    from:
      - "image nodeimage COPY"
      - "ts/hono-compute-provider node-image-firecracker binary"
      - "scripts/build-guest-image.sh go run ./cmd/socialweb-computer nodeimage"
  - name: go
    kind: executable
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: scripts/build-guest-image.sh runs the nodeimage verbs with go run on the build host
    from:
      - "deploy/control-plane-container/Dockerfile nodeimage stage"
      - "scripts/build-guest-image.sh"
  - name: sleep
    kind: executable
    fate: build-host
    owner: 0006 M2-HOST-CONFORMANCE
    why: a stand-in unit of the hostsvc.Manager contract suite (internal/hostsvc/hostsvctest), run only by go test on a development host
    from:
      - "internal/hostsvc/hostsvctest/suite_linux.go bin"
  - name: sh
    kind: executable
    fate: build-host
    owner: 0006 M2-HOST-CONFORMANCE
    why: the stand-in shell of the contract suite's failing, restarting and setsid-descendant units, run only by go test on a development host
    from:
      - "internal/hostsvc/hostsvctest/suite_linux.go bin"
  - name: zstd
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: used only by the deleted host-side image build (cmd/socialweb-nodeimage); runtime assets are zstd blobs the core decodes in Go
    from:
      - "cmd/socialweb-nodeimage/build.go"
      - "image tools dnf zstd"
  - name: xz
    kind: executable
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: scripts/build-guest-image.sh decompresses the pinned kernel source and base root tarball
    from:
      - "cmd/socialweb-nodeimage/build.go"
      - "image tools dnf xz"
      - "scripts/build-guest-image.sh"
  - name: cpio
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: packed the initramfs of the deleted host-side image build; the guest image has no initramfs
    from:
      - "cmd/socialweb-nodeimage/build.go"
      - "image tools dnf cpio"
  - name: du
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: sized the rootfs of the deleted host-side image build; nodeimage guest-rootfs reports the data size in Go
    from:
      - "cmd/socialweb-nodeimage/rootfs.go"
  - name: chroot
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: ran the preinstall of the deleted host-side image build; nodeimage guest-rootfs composes the rootfs tar in Go
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
  - name: mount
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: used only by the deleted host-side image build
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
  - name: umount
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: used only by the deleted host-side image build
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
  - name: unsquashfs
    kind: executable
    fate: removed-legacy
    owner: 0006 M3-FOLD
    why: unpacked the squashfs base of the deleted host-side image build; the pinned base is a root tarball
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
      - "image tools dnf squashfs-tools"
  - name: cp
    kind: executable
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: scripts/build-guest-image.sh copies the kernel config and outputs on the build host
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
      - "scripts/build-guest-image.sh"
  - name: mkfs.ext4
    kind: executable
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE, M2-VM-RUNTIME
    why: mke2fs builds the rootfs image inside the pinned builder container of scripts/build-guest-image.sh; no runtime use, the guest seed is a pure-Go NoCloud cidata drive (user decision 2026-10-12)
    from:
      - "cmd/socialweb-nodeimage/rootfs.go name"
      - "internal/nodevm/disk.go"
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
      - "scripts/build-guest-image.sh mke2fs"
  - name: git
    kind: executable
    fate: build-host
    owner: 0008 M1-MARKET-NETWORK-PARALLEL, M1-TS-CLOSURE
    why: internal/marketnetwork records the vendored deno-kcp commit of a market network; cmd/socialweb-tsbundle records each staged repo's commit and refuses a dirty one for a release; development and build hosts only
    from:
      - "internal/marketnetwork/record.go"
      - "internal/tsbundle/tsbuild/build.go"
  - name: debugfs
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME
    why: deleted by design; the guest seed is a separate pure-Go cidata drive (user decision 2026-10-12), internal/guestseed, attached by nodeboot since M1-GUEST-IMAGE
    from:
      - "cmd/socialweb-nodeboot/main.go"
  - name: e2fsck
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME
    why: deleted by design; the rootfs is copied as-is and the guest grows its own root (gone from nodeboot since M1-GUEST-IMAGE)
    from:
      - "cmd/socialweb-nodeboot/main.go"
  - name: resize2fs
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME
    why: deleted by design; the guest grows its own root (growpart and resizefs in the guest; gone from nodeboot since M1-GUEST-IMAGE)
    from:
      - "cmd/socialweb-nodeboot/main.go"
  - name: socialweb-nodeboot
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME
    why: cmd/socialweb-nodeboot is deleted; the VM unit runs socialweb-vmexec, pasta and firecracker directly
    from:
      - "runner image COPY"
      - "ts/hono-compute-provider microvm-firecracker"
  - name: entrypoint.sh
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME
    why: the runner container's entrypoint (chmod /dev/kvm, runuser nodeboot); no runner container on a bare host
    from:
      - "runner image COPY"
  - name: docker
    kind: executable
    fate: removed-legacy
    owner: 0007 M2-VM-RUNTIME, 0006 M5-RETIRE
    why: no container at runtime (user decision 2026-10-07); the firecracker runner container and container-mode backends are not ported
    from:
      - "ts/hono-compute-provider container-backend-docker"
  - name: wsl
    kind: executable
    fate: removed-legacy
    owner: 0011 M0-REVISIT
    why: the Windows path of the docker backend, removed with the 2026-10-12 vendoring; Windows bidders use HCS (plan 0011), not WSL docker
    from:
      - "ts/hono-compute-provider container-backend-docker"
  - name: container
    kind: executable
    fate: removed-legacy
    owner: 0012 M0-REVISIT
    why: Apple's container CLI is a container-mode backend, not the headless VM backend plan 0012 builds
    from:
      - "ts/hono-compute-provider container-backend-container (removed 2026-10-12)"
  - name: sudo
    kind: executable
    fate: removed-legacy
    owner: 0006 M1-INSTALL
    why: nothing escalates at runtime; the one root step is `socialweb-computer install`, run as root by the operator (qemu-standalone's sudo sh/mksquashfs/tar/mount chain and the docker daemon start go with their backends)
    from:
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
      - "container-backend-docker"
  - name: qemu-system-x86_64
    kind: executable
    fate: removed-legacy
    owner: 0006 M0-XOS-GATE
    why: the QEMU substrate was retired (9d85916); check-host's QEMU capability code and hono-qemu-standalone go
    from:
      - "check-host platform.go"
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
  - name: skopeo
    kind: executable
    fate: removed-legacy
    owner: 0006 M0-XOS-GATE
    why: hono-qemu-standalone only
    from:
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
  - name: truncate
    kind: executable
    fate: removed-legacy
    owner: 0006 M0-XOS-GATE
    why: hono-qemu-standalone only
    from:
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
  - name: find
    kind: executable
    fate: removed-legacy
    owner: 0006 M0-XOS-GATE
    why: hono-qemu-standalone only
    from:
      - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)"
  - name: ssh-keyscan
    kind: executable
    fate: removed-legacy
    owner: 0007 M4-HOST-KEYS
    why: the host-side scan is deleted; guests report their own host keys as vm.hostKeys
    from:
      - "ts/hono-compute-provider oidc-issuer-hono getPublicKeyFromSshd"
  - name: websocat
    kind: executable
    fate: removed-legacy
    owner: 0008 M1-STRIP-LEGACY-TRANSPORTS
    why: every non-iroh guest transport is stripped as legacy, websocat ProxyCommand paths included; removed from the TypeScript (atproto-market b78adc1 is the last commit with ensureWebsocat)
    from:
      - "ts/atproto-market requester-xrpc ensureWebsocat (removed)"
  - name: xdg-open
    kind: executable
    fate: removed-legacy
    owner: 0008 M4-RUN-REQUEST
    why: sign-in becomes an identity CRD whose status carries the URL to visit (user decision 2026-10-12, Q2); nothing spawns a browser
    from:
      - "ts/atproto-market hono-bidder"
      - "request-vm-ssh"
  - name: open
    kind: executable
    fate: removed-legacy
    owner: 0008 M4-RUN-REQUEST
    why: the darwin browser opener; as xdg-open
    from:
      - "ts/atproto-market hono-bidder"
      - "request-vm-ssh"
  - name: cmd
    kind: executable
    fate: removed-legacy
    owner: 0008 M4-RUN-REQUEST
    why: the windows browser opener; as xdg-open
    from:
      - "ts/atproto-market hono-bidder"
  - name: systemctl
    kind: executable
    fate: removed-legacy
    owner: 0006 M2-HOST-UNITS
    why: units are driven over D-Bus (go-systemd), never the systemctl CLI; compute-provider-local's systemctl shim is a container-mode provider that is not ported
    from:
      - "ts/hono-compute-provider compute-provider-local systemctl-shim"
  - name: bash
    kind: executable
    fate: removed-legacy
    owner: 0006 M2-HOST-UNITS
    why: compute-provider-local's systemctl shim runs unit ExecStart lines through bash; not ported
    from:
      - "ts/hono-compute-provider compute-provider-local systemctl-shim"
  - name: cloud-init
    kind: executable
    fate: removed-legacy
    owner: 0007 M1-GUEST-IMAGE
    why: cloud-init runs only inside guests, from the guest image; compute-provider-local ran it on the host and is not ported
    from:
      - "ts/hono-compute-provider compute-provider-local systemctl-shim"
  - name: tail
    kind: executable
    fate: removed-legacy
    owner: 0006 M2-HOST-UNITS
    why: compute-provider-local's log follower; not ported, unit output goes to capped files
    from:
      - "ts/hono-compute-provider compute-provider-local systemctl-shim"

  - name: postgresql-server
    kind: package
    fate: embedded-server
    driven_by: Postgres CRD; the core for kcp's own postgres unit
    owner: 0006 M2-POSTGRES, M0-PG-SOURCE
    why: replaced by the relocatable postgres asset set (postgres, initdb, pg_dump)
    from:
      - "image controlplane"
  - name: postgresql
    kind: package
    fate: replaced-by-go
    owner: 0006 M2-POSTGRES
    why: supplied psql only; pgx replaces it
    from:
      - "image controlplane"
  - name: yq
    kind: package
    fate: replaced-by-go
    owner: 0006 M2-APPLY
    why: see the yq executable
    from:
      - "image k8s"
  - name: iproute
    kind: package
    fate: replaced-by-go
    owner: 0007 M2-VM-RUNTIME
    why: supplied ip; netlink in socialweb-vmexec replaces it
    from:
      - "image k8s"
      - "runner image"
  - name: socat
    kind: package
    fate: replaced-by-go
    owner: 0006 M3-SERVE-GATEWAY-KCP
    why: see the socat executable
    from:
      - "image k8s"
  - name: openssl
    kind: package
    fate: replaced-by-go
    owner: 0006 M3-SERVE-GATEWAY-KCP
    why: see the openssl executable
    from:
      - "image k8s"
  - name: unzip
    kind: package
    fate: replaced-by-go
    owner: 0006 M1-ASSETS
    why: see the unzip executable
    from:
      - "image k8s"
  - name: which
    kind: package
    fate: replaced-by-go
    owner: 0006 M1-ASSETS
    why: see the which executable
    from:
      - "image k8s"
  - name: openssh-clients
    kind: package
    fate: replaced-by-go
    owner: 0007 M4-HOST-KEYS, 0008 M4-RUN-REQUEST
    why: supplied ssh-keygen (replaced in Go) and ssh (a requester host's own client, inventoried as a host prerequisite executable); gateway and bidder hosts need neither
    from:
      - "image k8s"
      - "runner image"
  - name: passt
    kind: package
    fate: embedded-server
    driven_by: ComputeVM (the VM unit's network stage)
    owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS
    why: supplied pasta, now a pinned asset
    from:
      - "runner image"
  - name: util-linux
    kind: package
    fate: removed-legacy
    owner: 0007 M0-VM-USERNS
    why: supplied runuser (runner entrypoint) and unshare; unshare is inventoried as a conditional host prerequisite executable, nothing else is used
    from:
      - "image controlplane"
      - "runner image"
  - name: procps-ng
    kind: package
    fate: removed-legacy
    owner: 0006 M5-RETIRE
    why: no exec site; container base utility
    from:
      - "image controlplane"
  - name: hostname
    kind: package
    fate: removed-legacy
    owner: 0006 M5-RETIRE
    why: no exec site; container base utility
    from:
      - "image controlplane"
  - name: coreutils
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: the image build's du and cp; the runtime container's copy goes with the container (no exec site in the core)
    from:
      - "image tools"
      - "image controlplane"
  - name: findutils
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: image build only; the runtime container's copy goes with the container
    from:
      - "image tools"
      - "image controlplane"
  - name: tar
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: image build only; the runtime container's copy goes with the container
    from:
      - "image tools"
      - "image controlplane"
  - name: gzip
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: image build only; the runtime container's copy goes with the container
    from:
      - "image tools"
      - "image controlplane"
  - name: squashfs-tools
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: supplied unsquashfs for the image build
    from:
      - "image tools"
  - name: cpio
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: see the cpio executable
    from:
      - "image tools"
  - name: xz
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: see the xz executable
    from:
      - "image tools"
  - name: zstd
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: see the zstd executable
    from:
      - "image tools"
  - name: e2fsprogs
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE, M2-VM-RUNTIME
    why: mkfs.ext4 for the rootfs on the build host (scripts/build-guest-image.sh runs mke2fs -d <tar> inside the pinned builder image); its runtime tools (debugfs, e2fsck, resize2fs) are deleted by design
    from:
      - "image tools"
      - "runner image"
  - name: busybox
    kind: package
    fate: build-host
    owner: 0007 M1-GUEST-IMAGE
    why: copied into the guest image by the build; the guest's busybox is part of the downloaded image
    from:
      - "image tools"

  - name: /etc/rancher/node/password
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL
    why: the k3s invariant (versions.json k3s); install writes it once, dev bind-mounts a per-instance copy in a userns
    from:
      - "image controlplane RUN"
  - name: /etc/subuid
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL, 0007 M2-VM-RUNTIME
    why: install bidder reserves one subuid range for the shared lingering account
    from:
      - "user decision 2026-10-12 per-VM subuid user namespaces"
  - name: /etc/subgid
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL, 0007 M2-VM-RUNTIME
    why: as /etc/subuid, for groups
    from:
      - "user decision 2026-10-12 per-VM subuid user namespaces"
  - name: /etc/apparmor.d/socialweb-computer-pasta
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL
    why: Ubuntu 24.04+ userns restriction; the profile grants userns to the pinned pasta asset path (user decision 2026-10-11)
    from:
      - "user decision 2026-10-11 AppArmor"
  - name: /var/lib/systemd/linger
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL
    why: install enables linger for the one shared account, so its user manager outlives logout
    from:
      - "user decision 2026-10-11 user manager of a lingering account"
  - name: /var/lib/socialweb
    kind: file
    fate: host-file
    owner: 0006 M1-INSTALL, M1-DEV-INSTANCE
    why: the state dir (install creates it; dev uses a per-instance dir under the user's state home)
    from:
      - "image k8s RUN install -d"
  - name: /opt/org-root
    kind: file
    fate: embedded-child
    owner: 0008 M1-TS-CLOSURE
    why: the socialweb-computer-k8s TypeScript closure (deno.json, deno.lock, ts/, socialweb-computer-k8s/ of this repo), embedded and run by the deno child
    from:
      - "image k8s COPY --from=k8stree"
  - name: /opt/deno-dir
    kind: file
    fate: embedded-child
    owner: 0008 M1-TS-CLOSURE, M1-DENO
    why: the deno module cache, populated from the embedded closure
    from:
      - "image k8s RUN deno cache"
  - name: /opt/socialweb/eso/external-secrets.yaml
    kind: file
    fate: linked
    owner: 0006 M1-ASSETS
    why: the ESO bundle pinned by bundleSha256, embedded in the core next to its pin; decided by Claude, user may veto
    from:
      - "image controlplane COPY --from=esobundle"
  - name: /opt/socialweb/deploy
    kind: file
    fate: linked
    owner: 0006 M2-MANIFESTS
    why: the deploy manifests become the core's embedded manifest sets
    from:
      - "image k8s COPY deploy/"
  - name: /dev/kvm
    kind: file
    fate: host-prerequisite
    owner: 0006 M2-HOST-CONTRACT, M1-INSTALL (kvm group)
    why: bidders only, reached through the kvm group, never handed to deno
    from:
      - "runner image entrypoint chmod"
  - name: /dev/net/tun
    kind: file
    fate: host-prerequisite
    owner: 0006 M2-HOST-CONTRACT
    why: bidders only, for pasta's tap
    from:
      - "runner image entrypoint chmod"
  - name: /sys/fs/cgroup
    kind: file
    fate: host-prerequisite
    owner: 0006 M2-HOST-CONTRACT
    why: a Linux kernel with cgroup v2 and cpu, memory and pids delegated to the user manager
    from:
      - "user decision 2026-10-11 gateway lifecycle manager"

indirect:
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: nodefirecracker.DefaultPasta"
    resolves: [pasta]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: path"
    resolves: [pasta, kubectl, kine, kcp]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: probe"
    resolves: [unshare]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: f.firecracker"
    resolves: [firecracker]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: f.k3s"
    resolves: [k3s]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: onPath"
    resolves: [k3s]
  - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: copyPath"
    resolves: [socialweb-computer-kcp-check-host]
  - site: "socialweb-computer-kcp/internal/checkhostmain/platform.go: path"
    resolves: [qemu-system-x86_64]
  - site: "socialweb-computer-kcp/internal/checkhostmain/postgres.go: path"
    resolves: [initdb, postgres, psql]
  - site: "socialweb-computer-kcp/internal/checkhostmain/postgres.go: binaries[0]"
    resolves: [initdb]
  - site: "socialweb-computer-kcp/internal/clusterprovider/bootstraprows.go: bin"
    resolves: [psql]
  - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: name"
    resolves: [initdb, postgres, psql]
  - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: initdb"
    resolves: [initdb]
  - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: postgres"
    resolves: [postgres]
  - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: psql"
    resolves: [psql]
  - site: "socialweb-computer-kcp/internal/kcplibs/impl/execrunner/supervisor.go: entry.binary"
    resolves: [deno]
  - site: "socialweb-computer-kcp/internal/kcplibs/impl/execrunner/supervisor.go: command[0]"
    resolves: [deno]
  - site: "socialweb-computer-kcp/internal/kcplibs/internal/livekcp/livekcp.go: Resolve(name)"
    resolves: [kcp, kubectl]
  - site: "socialweb-computer-kcp/internal/kcplibs/internal/livekcp/livekcp.go: name"
    resolves: [kcp, kubectl]
  - site: "socialweb-computer-kcp/ts/socialweb-computer-ssh/lib/socialweb-computer-ssh-requester/bridge.ts: argv[0]"
    resolves: [dumbpipe]
  - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/container-backend-docker/mod.ts: bin"
    resolves: [sudo]
  - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/container-backend-docker/mod.ts: dockerBin"
    resolves: [docker]
  - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/microvm-vmruntime/mod.ts: argv[0]"
    resolves: [socialweb-computer]
  - site: "socialweb-computer-kcp/cmd/socialweb-vmexec/main.go: p.VMM"
    resolves: [firecracker]
  - site: "socialweb-computer-kcp/ts/deno-worker-sandbox/lib/sandbox-deno/bundler.ts: exe"
    resolves: [deno]
  - site: "socialweb-computer-kcp/ts/policy-engine/lib/policies/deno-typescript/bundle/build-bundle.ts: Deno.execPath("
    resolves: [deno]
  - site: "socialweb-computer-kcp/ts/policy-engine/lib/policies/gha-lite/scripts/build-actions.ts: Deno.execPath("
    resolves: [deno]
  - site: "socialweb-computer-kcp/ts/policy-engine/lib/policy-engine-server-gha-lite/src/workflow.ts: this.denoPath"
    resolves: [deno]
  - site: "socialweb-computer-kcp/ts/policy-engine/lib/policy-engine-server-gha-lite/src/workflow.ts: args[0]"
    resolves: [bash, sh]
  - site: "socialweb-computer-kcp/cmd/socialweb-computer/dev.go: path"
    resolves: [kcp, kine]
  - site: "socialweb-computer-kcp/internal/hostsvc/hostsvctest/suite_linux.go: name"
    resolves: [sleep, sh]
  - site: "socialweb-computer-kcp/internal/bootstrap/bootstrap.go: argv[0]"
    resolves: [initdb, psql]
  - site: "socialweb-computer-kcp/internal/devstack/devstack.go: s.Bin"
    resolves: [socialweb-computer-kcp-check-host]
  - site: "socialweb-computer-kcp/internal/denorun/denorun.go: deno"
    resolves: [deno]
  - site: "socialweb-computer-kcp/internal/denorun/denorun.go: argv[0]"
    resolves: [deno]
  - site: "socialweb-computer-kcp/internal/tsbundle/tsbuild/build.go: o.Deno"
    resolves: [deno]
  - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: e.Path"
    resolves: [pasta]
  - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: self[0]"
    resolves: [socialweb-computer-kcp-check-host]
  - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: m.helper"
    resolves: [newuidmap, newgidmap]
  - site: "socialweb-computer-kcp/internal/install/system_linux.go: binary"
    resolves: [socialweb-computer-kcp-check-host]
  - site: "socialweb-computer-kcp/internal/install/system_linux.go: exe"
    resolves: [socialweb-computer-kcp-check-host]