note: > Plan 0006 M1-HOST-INVENTORY. Everything the control-plane container (deploy/control-plane-container/ Dockerfile, stages tools, controlplane and k8s), the bidder's firecracker runner image (ts/hono-compute-provider/hono-firecracker-standalone/Dockerfile) and the code's exec call sites supplied, each with exactly one fate on a bare Linux host. Call sites scanned: exec.Command, exec.CommandContext, exec.LookPath and syscall.Exec in non-test Go of this repo, and new Deno.Command in non-test TypeScript of this repo: socialweb-computer-k8s and every vendored repository under ts/. A computed first argument is listed under indirect with every executable it resolves to. The runner image, its Dockerfile, the container's nodeimage stage, cmd/socialweb-nodeboot, cmd/socialweb-nodeimage and cmd/socialweb-nodeinit are deleted (0006 M3-FOLD); a "from" naming one of them records where the executable used to come from. Fates that name a decision not yet in a plan item say so in why ("decided by Claude, user may veto"). fates: linked: compiled into the socialweb-computer core binary as a package or verb (go:embed for data files); nothing separate ships embedded-server: an embedded per-GOOS_GOARCH asset (M1-ASSETS) run as its own long-running unit or HostProcess; driven_by names the CRD, or the core's local state, that starts it embedded-child: an embedded asset run as a child of the core unit (deno and the TypeScript closure it runs) embedded-tool: an embedded asset run to completion by the core or a unit's start stage replaced-by-go: the job moves into Go in the core binary; the executable is never needed download-asset: fetched and sha256-verified, never installed from a package manager (served by the door, or a guest image pinned in versions.json and built by scripts/build-guest-image.sh) host-file: written by `socialweb-computer install` (root, once), never by hand host-prerequisite: the host must supply it and check-host probes it by name; the only fate that comes from the host build-host: needed only on a build or development host (guest image build, market network tooling), never on a gateway, bidder or requester runtime host removed-legacy: deleted by design or legacy that is not ported; no runtime host needs it entries: - name: socialweb-gateway kind: executable fate: linked owner: 0006 M1-CLI, M3-SERVE-GATEWAY-KCP why: the gateway becomes `socialweb-computer serve gateway` from: - "image k8s COPY" - name: socialweb-clusterprovider kind: executable fate: linked owner: 0006 M1-CLI, M3-SERVE-GATEWAY-KCP why: the cluster provider becomes a verb of the core binary from: - "image k8s COPY" - name: socialweb-cloud-controller-manager kind: executable fate: linked owner: 0006 M1-CLI, M3-CLUSTER-UNITS why: a core-binary verb run as a member unit of each cluster's slice from: - "image k8s COPY" - "HostProcess member unit argv via clusterstack CloudControllerManagerArgv" - name: socialweb-vault kind: executable fate: linked owner: 0006 M1-CLI, M2-OPENBAO-SERVER why: apply-root and prepare-root become core verbs from: - "image k8s COPY" - name: socialweb-tenantcredential kind: executable fate: linked owner: 0006 M1-CLI why: an internal re-exec verb of the core binary from: - "image k8s COPY" - name: socialweb-computer-kcp-check-host kind: executable fate: linked owner: 0006 M1-CLI, M2-HOST-CONTRACT why: becomes `socialweb-computer check-host`; its SELinux probe execs its own copy, which is the core binary from: - "image controlplane COPY" - "image nodeimage COPY" - "check-host checks.go copyPath" - name: container-entrypoint kind: executable fate: linked owner: 0006 M2-BOOTSTRAP-LAYER, M3-SERVE-GATEWAY-KCP, M5-RETIRE why: its sequence (root bao, kcp, apply-root, bootstrap applies, gateway, clusterprovider, socat, door) becomes the core's bootstrap layer and kcp-reconciled units; the shell script is deleted with the container path from: - "image k8s COPY of deploy/container-entrypoint.sh" - name: kcp kind: executable fate: embedded-server driven_by: the core, from local state (alternating blue/green slot units behind the core's own L4 front) owner: 0006 M2-KCP-SLOTS, M1-ASSETS why: the unpatched release v0.33.0 as a zstd asset, out of process (user decision 2026-10-12, kcp-spike.md route B) from: - "image controlplane COPY" - "check-host checks.go path" - name: kine kind: executable fate: embedded-server driven_by: Cluster (a member unit of each cluster's slice); the core for kcp's own store owner: 0006 M3-CLUSTER-UNITS, M2-KCP-STORE, M1-ASSETS why: each cluster's store is kine over its own postgres; kcp's store is kine over a dedicated postgres unit from: - "image controlplane COPY" - "check-host checks.go" - "HostProcess member unit argv via clusterstack KineArgv" - name: postgres kind: executable fate: embedded-server driven_by: Postgres CRD (each cluster's postgres); the core for kcp's own postgres unit owner: 0006 M2-POSTGRES, M2-KCP-STORE, M0-PG-SOURCE, M1-ASSETS why: a relocatable PostgreSQL 18 set; the build (prebuilt vs from source) is M0-PG-SOURCE's pending choice from: - "image controlplane dnf postgresql-server" - "internal/clusterprovider/postgres.go" - "check-host postgres.go" - name: bao kind: executable fate: embedded-server driven_by: OpenBaoServer CRD (root and bidder vaults); Cluster for the per-cluster bao member unit owner: 0006 M2-OPENBAO-SERVER, M3-CLUSTER-UNITS, M1-ASSETS why: OpenBao v2.6.2 as an asset from: - "image controlplane COPY" - "HostProcess member unit argv via clusterstack OpenBaoArgv" - name: k3s kind: executable fate: embedded-server driven_by: Cluster (a member unit of each cluster's slice, blue/green slots behind the per-cluster front) owner: 0006 M3-CLUSTER-UNITS, M3-CP-SLOTS, M1-ASSETS why: the tenant control plane from: - "image controlplane COPY" - "image nodeimage COPY" - "check-host checks.go" - "socialweb-nodeimage k3sdata.go" - "HostProcess member unit argv" - name: external-secrets kind: executable fate: embedded-server driven_by: Cluster (controller and webhook, two member units of each cluster's slice) owner: 0006 M3-CLUSTER-UNITS, M1-ASSETS why: the digest-pinned upstream binary, now an asset instead of an image copy from: - "image controlplane COPY" - "HostProcess member unit argv via clusterstack ExternalSecretsArgv" - name: dumbpipe kind: executable fate: embedded-server driven_by: ClusterLink (member units of each cluster's slice); the requester instance's tunnel HostProcess owner: 0006 M3-CLUSTER-UNITS, M1-ASSETS, 0008 M4-RUN-REQUEST why: the iroh transport, the only guest transport kept (user decision 2026-10-12); the requester's `which dumbpipe` lookup goes with the asset from: - "image k8s curl download" - "HostProcess member unit argv via clusterlink.Argv" - "ts/atproto-market requester-xrpc ensureDumbpipe" - name: firecracker kind: executable fate: embedded-server driven_by: ComputeVM (the VM unit, launched directly by the service manager) owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS why: no runner container; the VMM is the VM unit's own process from: - "runner image COPY" - "check-host checks.go" - "internal/vmruntime firecracker_linux.go VM unit argv (socialweb-vmexec execs it)" - name: pasta kind: executable fate: embedded-server driven_by: ComputeVM (the VM unit's network stage, in the VM's own user and network namespace) owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS, M1-INSTALL (AppArmor profile) why: from passt; the constant pasta gateway replaces the network-index allocator from: - "runner image dnf passt" - "check-host checks.go" - "internal/vmruntime firecracker_linux.go VM unit argv" - name: deno kind: executable fate: embedded-child owner: 0008 M1-DENO, M1-TS-CLOSURE, 0006 M1-ASSETS why: deno 2.9.3 run by the core as the DenoPod runtime (door, bidder, requester); internal/denorun builds every argv; cmd/socialweb-tsbundle fills and probes the closure with it at build time from: - "image k8s curl download" - "internal/denorun/denorun.go" - "internal/tsbundle/tsbuild/build.go" - name: initdb kind: executable fate: embedded-tool owner: 0006 M2-POSTGRES, M0-PG-SOURCE why: part of the relocatable postgres set, run once per data dir from: - "image controlplane dnf postgresql-server" - "internal/clusterprovider/postgres.go" - "check-host postgres.go" - name: pg_dump kind: executable fate: embedded-tool owner: 0006 M2-KCP-STORE, M3-CP-SLOTS, M0-PG-SOURCE why: the dump taken before each kcp or k3s upgrade; joins the postgres asset set from: - "plan 0006 M2-KCP-STORE" - name: socialweb-vmexec kind: executable fate: embedded-tool owner: 0007 M2-VM-RUNTIME why: the VM unit's one-shot stage inside pasta's namespace (tap, bridge, pinned neighbor over netlink) that execs firecracker; no socialweb-computer code stays in the VM's process tree from: - "cmd/socialweb-vmexec" - name: socialweb-computer kind: executable fate: linked owner: 0007 M2-VM-RUNTIME why: the firecracker provider's vmruntime microvm runs `socialweb-computer internal vm` (one-shot prep, unit start, inspect, stop); the kcp provider's guests are booted by the ComputeVM controller in the core of the bidder's own instance (0007 M2-CONTROLLER) from: - "ts/hono-compute-provider microvm-vmruntime" - name: swc-userns-stage kind: executable fate: embedded-tool owner: 0007 M0-VM-USERNS, M2-VM-RUNTIME why: first word of each VM unit's ExecStart; creates the per-VM subuid user namespace through newuidmap/newgidmap and execs pasta; static, built reproducibly by scripts/build-userns-stage.sh, pinned in versions.json from: - "deploy/swc-userns-stage/stage.c" - "internal/vmruntime (VM unit ExecStart)" - name: psql kind: executable fate: replaced-by-go owner: 0006 M2-POSTGRES why: bootstrap rows and readiness go through pgx from: - "image controlplane dnf postgresql" - "internal/clusterprovider/bootstraprows.go" - "internal/clusterprovider/postgres.go" - "check-host postgres.go" - name: kubectl kind: executable fate: replaced-by-go owner: 0006 M2-APPLY why: every apply goes through internal/kcpapply (dynamic client, server-side apply) from: - "image controlplane COPY" - "check-host checks.go" - "deploy/container-entrypoint.sh" - "deploy/install-provider.sh" - name: yq kind: executable fate: replaced-by-go owner: 0006 M2-APPLY, M2-TEMPLATE why: manifest rendering and patching move into kcpapply and the template layer from: - "image k8s dnf yq" - name: socat kind: executable fate: replaced-by-go owner: 0006 M3-SERVE-GATEWAY-KCP why: the TLS terminator becomes a crypto/tls proxy in the core from: - "image k8s dnf socat" - "deploy/container-entrypoint.sh" - name: openssl kind: executable fate: replaced-by-go owner: 0006 M3-SERVE-GATEWAY-KCP why: certificates are minted with crypto/x509 from: - "image k8s dnf openssl" - name: ip kind: executable fate: replaced-by-go owner: 0007 M2-VM-RUNTIME why: netlink in socialweb-vmexec; the identical per-guest address plan needs no host address scan from: - "image k8s dnf iproute" - "runner image dnf iproute" - "internal/nodevm/namespace.go" - name: which kind: executable fate: replaced-by-go owner: 0006 M1-ASSETS why: assets are resolved by their extracted path, never searched on PATH; the requester's which dumbpipe goes from: - "image k8s dnf which" - "ts/atproto-market requester-xrpc ensureDumbpipe" - name: unzip kind: executable fate: replaced-by-go owner: 0006 M1-ASSETS why: only unpacked the deno release in the image build; assets are zstd blobs the core extracts from: - "image k8s dnf unzip" - name: curl kind: executable fate: replaced-by-go owner: 0006 M1-ASSETS why: only fetched deno, dumbpipe and the ESO bundle at image build time; those are embedded assets now from: - "image esobundle and k8s RUN curl" - name: ssh-keygen kind: executable fate: replaced-by-go owner: 0007 M4-HOST-KEYS, 0008 M4-RUN-REQUEST why: ed25519 keypairs are minted in-process with golang.org/x/crypto/ssh and kept in the application's own OpenBao (every key lives there, user decision 2026-10-12); decided by Claude, user may veto from: - "ts/atproto-market requester-xrpc generateKeypair" - "ts/hono-compute-provider systemctl-shim" - name: ssh kind: executable fate: host-prerequisite owner: 0008 M4-RUN-REQUEST, M4-RUN-GATEWAY-SSH why: the person's own OpenSSH client for the interactive session on a requester host (ProxyCommand over dumbpipe); not needed on gateway or bidder hosts from: - "ts/atproto-market requester-xrpc" - "image k8s dnf openssh-clients" - name: newuidmap kind: executable fate: host-prerequisite owner: 0007 M2-VM-RUNTIME, 0006 M2-HOST-CONTRACT why: the distro's setuid helper (rootless podman's) maps each VM's subuid range; a setuid helper is never shipped as an asset; bidders only from: - "user decision 2026-10-12 per-VM subuid user namespaces" - name: newgidmap kind: executable fate: host-prerequisite owner: 0007 M2-VM-RUNTIME, 0006 M2-HOST-CONTRACT why: as newuidmap, for the subgid range; bidders only from: - "user decision 2026-10-12 per-VM subuid user namespaces" - name: useradd kind: executable fate: host-prerequisite owner: 0006 M1-INSTALL why: the distro's shadow tool creates the one system account (socialweb or swc-bidder); only install, run as root, ever execs it from: - "user decision 2026-10-12 accounts are created only by install" - name: userdel kind: executable fate: host-prerequisite owner: 0006 M1-INSTALL why: uninstall --purge deletes the account install created, and only that one from: - "user decision 2026-10-12 install with uninstall" - name: gpasswd kind: executable fate: host-prerequisite owner: 0006 M1-INSTALL why: adds the bidder account to kvm before linger, and uninstall removes the membership install added from: - "user decision 2026-10-12 kvm before linger" - name: apparmor_parser kind: executable fate: host-prerequisite owner: 0006 M1-INSTALL, M2-HOST-CONTRACT why: loads and unloads the socialweb-pasta profile only where AppArmor restricts unprivileged user namespaces (Ubuntu 24.04+) from: - "user decision 2026-10-11 AppArmor profile for the embedded pasta" - name: unshare kind: executable fate: host-prerequisite owner: 0007 M0-VM-USERNS, 0006 M2-HOST-CONTRACT why: util-linux unshare >= 2.38, required only if M0-VM-USERNS chooses it for the userns stage; check-host already probes it; cmd/socialweb-tsbundle starts every closure entry under unshare -rn at build time from: - "check-host checks.go" - "internal/tsbundle/tsbuild/build.go" - "cmd/socialweb-tsbundle/main.go" - name: systemd kind: executable fate: host-prerequisite owner: 0006 M2-HOST-UNITS, M2-HOST-CONTRACT why: systemd 253+ (GetUnitByPIDFD) with the user manager of a lingering account, reached over D-Bus; production installs only, the dev backend is proc from: - "user decision 2026-10-11 minimum systemd" - name: netsh kind: executable fate: host-prerequisite owner: 0011 M0-REVISIT why: a Windows OS component read by internal/hostos portrange_windows.go; compiled only for GOOS=windows, outside this Linux plan from: - "internal/hostos/portrange_windows.go" - name: netstat kind: executable fate: host-prerequisite owner: 0011 M0-REVISIT why: a Windows OS component read by internal/portscan scan_windows.go; compiled only for GOOS=windows from: - "internal/portscan/scan_windows.go" - name: powershell kind: executable fate: host-prerequisite owner: 0011 M0-REVISIT why: a Windows OS component read by internal/hostos proc_windows.go; compiled only for GOOS=windows from: - "internal/hostos/proc_windows.go" - name: socialweb-meshd kind: executable fate: download-asset owner: 0006 M1-ASSETS why: two sha256-pinned builds (x86_64, aarch64) the door serves to market nodes from: - "versions.json asset socialweb-computer-k8s-downloads (scripts/build-web-app-downloads.sh)" - name: socialweb-guest-agent kind: executable fate: download-asset owner: 0034 W2-BIDDER-DOWNLOADS why: two sha256-pinned builds (x86_64, aarch64), with the opentunnel binaries, that a bidder's GuestControlPlane serves to its guests at /v1/downloads from: - "versions.json asset socialweb-guest-downloads (scripts/build-guest-downloads.sh)" - name: socialweb-nodeinit kind: executable fate: removed-legacy owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE why: the initramfs init of the deleted host-side image build; the pinned guest image boots root=/dev/vda with everything built in and carries no initramfs, so cmd/socialweb-nodeinit is deleted from: - "image nodeimage stage" - name: init kind: executable fate: download-asset owner: 0007 M1-GUEST-IMAGE why: /sbin/init inside the guest image, started by the guest kernel from root=/dev/vda from: - "cmd/socialweb-nodeinit/init.go syscall.Exec" - name: busybox kind: executable fate: removed-legacy owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE why: the insmod of the deleted initramfs init; the guest kernel has every driver built in from: - "cmd/socialweb-nodeinit/init.go" - name: socialweb-nodeimage kind: executable fate: build-host owner: 0006 M3-FOLD, 0007 M1-GUEST-IMAGE why: folded into the dev-build verbs `socialweb-computer nodeimage guest-rootfs|guest-manifest` (internal/nodeimagemain, absent from a release build), run only by scripts/build-guest-image.sh on a Linux build host; cmd/socialweb-nodeimage and the bidder's node-image-firecracker exec of it are deleted, bidders fetch the pinned image from: - "image nodeimage COPY" - "ts/hono-compute-provider node-image-firecracker binary" - "scripts/build-guest-image.sh go run ./cmd/socialweb-computer nodeimage" - name: go kind: executable fate: build-host owner: 0007 M1-GUEST-IMAGE why: scripts/build-guest-image.sh runs the nodeimage verbs with go run on the build host from: - "deploy/control-plane-container/Dockerfile nodeimage stage" - "scripts/build-guest-image.sh" - name: sleep kind: executable fate: build-host owner: 0006 M2-HOST-CONFORMANCE why: a stand-in unit of the hostsvc.Manager contract suite (internal/hostsvc/hostsvctest), run only by go test on a development host from: - "internal/hostsvc/hostsvctest/suite_linux.go bin" - name: sh kind: executable fate: build-host owner: 0006 M2-HOST-CONFORMANCE why: the stand-in shell of the contract suite's failing, restarting and setsid-descendant units, run only by go test on a development host from: - "internal/hostsvc/hostsvctest/suite_linux.go bin" - name: zstd kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: used only by the deleted host-side image build (cmd/socialweb-nodeimage); runtime assets are zstd blobs the core decodes in Go from: - "cmd/socialweb-nodeimage/build.go" - "image tools dnf zstd" - name: xz kind: executable fate: build-host owner: 0007 M1-GUEST-IMAGE why: scripts/build-guest-image.sh decompresses the pinned kernel source and base root tarball from: - "cmd/socialweb-nodeimage/build.go" - "image tools dnf xz" - "scripts/build-guest-image.sh" - name: cpio kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: packed the initramfs of the deleted host-side image build; the guest image has no initramfs from: - "cmd/socialweb-nodeimage/build.go" - "image tools dnf cpio" - name: du kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: sized the rootfs of the deleted host-side image build; nodeimage guest-rootfs reports the data size in Go from: - "cmd/socialweb-nodeimage/rootfs.go" - name: chroot kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: ran the preinstall of the deleted host-side image build; nodeimage guest-rootfs composes the rootfs tar in Go from: - "cmd/socialweb-nodeimage/rootfs.go name" - name: mount kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: used only by the deleted host-side image build from: - "cmd/socialweb-nodeimage/rootfs.go name" - name: umount kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: used only by the deleted host-side image build from: - "cmd/socialweb-nodeimage/rootfs.go name" - name: unsquashfs kind: executable fate: removed-legacy owner: 0006 M3-FOLD why: unpacked the squashfs base of the deleted host-side image build; the pinned base is a root tarball from: - "cmd/socialweb-nodeimage/rootfs.go name" - "image tools dnf squashfs-tools" - name: cp kind: executable fate: build-host owner: 0007 M1-GUEST-IMAGE why: scripts/build-guest-image.sh copies the kernel config and outputs on the build host from: - "cmd/socialweb-nodeimage/rootfs.go name" - "scripts/build-guest-image.sh" - name: mkfs.ext4 kind: executable fate: build-host owner: 0007 M1-GUEST-IMAGE, M2-VM-RUNTIME why: mke2fs builds the rootfs image inside the pinned builder container of scripts/build-guest-image.sh; no runtime use, the guest seed is a pure-Go NoCloud cidata drive (user decision 2026-10-12) from: - "cmd/socialweb-nodeimage/rootfs.go name" - "internal/nodevm/disk.go" - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - "scripts/build-guest-image.sh mke2fs" - name: git kind: executable fate: build-host owner: 0008 M1-MARKET-NETWORK-PARALLEL, M1-TS-CLOSURE why: internal/marketnetwork records the vendored deno-kcp commit of a market network; cmd/socialweb-tsbundle records each staged repo's commit and refuses a dirty one for a release; development and build hosts only from: - "internal/marketnetwork/record.go" - "internal/tsbundle/tsbuild/build.go" - name: debugfs kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME why: deleted by design; the guest seed is a separate pure-Go cidata drive (user decision 2026-10-12), internal/guestseed, attached by nodeboot since M1-GUEST-IMAGE from: - "cmd/socialweb-nodeboot/main.go" - name: e2fsck kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME why: deleted by design; the rootfs is copied as-is and the guest grows its own root (gone from nodeboot since M1-GUEST-IMAGE) from: - "cmd/socialweb-nodeboot/main.go" - name: resize2fs kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME why: deleted by design; the guest grows its own root (growpart and resizefs in the guest; gone from nodeboot since M1-GUEST-IMAGE) from: - "cmd/socialweb-nodeboot/main.go" - name: socialweb-nodeboot kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME why: cmd/socialweb-nodeboot is deleted; the VM unit runs socialweb-vmexec, pasta and firecracker directly from: - "runner image COPY" - "ts/hono-compute-provider microvm-firecracker" - name: entrypoint.sh kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME why: the runner container's entrypoint (chmod /dev/kvm, runuser nodeboot); no runner container on a bare host from: - "runner image COPY" - name: docker kind: executable fate: removed-legacy owner: 0007 M2-VM-RUNTIME, 0006 M5-RETIRE why: no container at runtime (user decision 2026-10-07); the firecracker runner container and container-mode backends are not ported from: - "ts/hono-compute-provider container-backend-docker" - name: wsl kind: executable fate: removed-legacy owner: 0011 M0-REVISIT why: the Windows path of the docker backend, removed with the 2026-10-12 vendoring; Windows bidders use HCS (plan 0011), not WSL docker from: - "ts/hono-compute-provider container-backend-docker" - name: container kind: executable fate: removed-legacy owner: 0012 M0-REVISIT why: Apple's container CLI is a container-mode backend, not the headless VM backend plan 0012 builds from: - "ts/hono-compute-provider container-backend-container (removed 2026-10-12)" - name: sudo kind: executable fate: removed-legacy owner: 0006 M1-INSTALL why: nothing escalates at runtime; the one root step is `socialweb-computer install`, run as root by the operator (qemu-standalone's sudo sh/mksquashfs/tar/mount chain and the docker daemon start go with their backends) from: - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - "container-backend-docker" - name: qemu-system-x86_64 kind: executable fate: removed-legacy owner: 0006 M0-XOS-GATE why: the QEMU substrate was retired (9d85916); check-host's QEMU capability code and hono-qemu-standalone go from: - "check-host platform.go" - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - name: skopeo kind: executable fate: removed-legacy owner: 0006 M0-XOS-GATE why: hono-qemu-standalone only from: - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - name: truncate kind: executable fate: removed-legacy owner: 0006 M0-XOS-GATE why: hono-qemu-standalone only from: - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - name: find kind: executable fate: removed-legacy owner: 0006 M0-XOS-GATE why: hono-qemu-standalone only from: - "ts/hono-compute-provider qemu-standalone (removed 2026-10-12)" - name: ssh-keyscan kind: executable fate: removed-legacy owner: 0007 M4-HOST-KEYS why: the host-side scan is deleted; guests report their own host keys as vm.hostKeys from: - "ts/hono-compute-provider oidc-issuer-hono getPublicKeyFromSshd" - name: websocat kind: executable fate: removed-legacy owner: 0008 M1-STRIP-LEGACY-TRANSPORTS why: every non-iroh guest transport is stripped as legacy, websocat ProxyCommand paths included; removed from the TypeScript (atproto-market b78adc1 is the last commit with ensureWebsocat) from: - "ts/atproto-market requester-xrpc ensureWebsocat (removed)" - name: xdg-open kind: executable fate: removed-legacy owner: 0008 M4-RUN-REQUEST why: sign-in becomes an identity CRD whose status carries the URL to visit (user decision 2026-10-12, Q2); nothing spawns a browser from: - "ts/atproto-market hono-bidder" - "request-vm-ssh" - name: open kind: executable fate: removed-legacy owner: 0008 M4-RUN-REQUEST why: the darwin browser opener; as xdg-open from: - "ts/atproto-market hono-bidder" - "request-vm-ssh" - name: cmd kind: executable fate: removed-legacy owner: 0008 M4-RUN-REQUEST why: the windows browser opener; as xdg-open from: - "ts/atproto-market hono-bidder" - name: systemctl kind: executable fate: removed-legacy owner: 0006 M2-HOST-UNITS why: units are driven over D-Bus (go-systemd), never the systemctl CLI; compute-provider-local's systemctl shim is a container-mode provider that is not ported from: - "ts/hono-compute-provider compute-provider-local systemctl-shim" - name: bash kind: executable fate: removed-legacy owner: 0006 M2-HOST-UNITS why: compute-provider-local's systemctl shim runs unit ExecStart lines through bash; not ported from: - "ts/hono-compute-provider compute-provider-local systemctl-shim" - name: cloud-init kind: executable fate: removed-legacy owner: 0007 M1-GUEST-IMAGE why: cloud-init runs only inside guests, from the guest image; compute-provider-local ran it on the host and is not ported from: - "ts/hono-compute-provider compute-provider-local systemctl-shim" - name: tail kind: executable fate: removed-legacy owner: 0006 M2-HOST-UNITS why: compute-provider-local's log follower; not ported, unit output goes to capped files from: - "ts/hono-compute-provider compute-provider-local systemctl-shim" - name: postgresql-server kind: package fate: embedded-server driven_by: Postgres CRD; the core for kcp's own postgres unit owner: 0006 M2-POSTGRES, M0-PG-SOURCE why: replaced by the relocatable postgres asset set (postgres, initdb, pg_dump) from: - "image controlplane" - name: postgresql kind: package fate: replaced-by-go owner: 0006 M2-POSTGRES why: supplied psql only; pgx replaces it from: - "image controlplane" - name: yq kind: package fate: replaced-by-go owner: 0006 M2-APPLY why: see the yq executable from: - "image k8s" - name: iproute kind: package fate: replaced-by-go owner: 0007 M2-VM-RUNTIME why: supplied ip; netlink in socialweb-vmexec replaces it from: - "image k8s" - "runner image" - name: socat kind: package fate: replaced-by-go owner: 0006 M3-SERVE-GATEWAY-KCP why: see the socat executable from: - "image k8s" - name: openssl kind: package fate: replaced-by-go owner: 0006 M3-SERVE-GATEWAY-KCP why: see the openssl executable from: - "image k8s" - name: unzip kind: package fate: replaced-by-go owner: 0006 M1-ASSETS why: see the unzip executable from: - "image k8s" - name: which kind: package fate: replaced-by-go owner: 0006 M1-ASSETS why: see the which executable from: - "image k8s" - name: openssh-clients kind: package fate: replaced-by-go owner: 0007 M4-HOST-KEYS, 0008 M4-RUN-REQUEST why: supplied ssh-keygen (replaced in Go) and ssh (a requester host's own client, inventoried as a host prerequisite executable); gateway and bidder hosts need neither from: - "image k8s" - "runner image" - name: passt kind: package fate: embedded-server driven_by: ComputeVM (the VM unit's network stage) owner: 0007 M2-VM-RUNTIME, 0006 M1-ASSETS why: supplied pasta, now a pinned asset from: - "runner image" - name: util-linux kind: package fate: removed-legacy owner: 0007 M0-VM-USERNS why: supplied runuser (runner entrypoint) and unshare; unshare is inventoried as a conditional host prerequisite executable, nothing else is used from: - "image controlplane" - "runner image" - name: procps-ng kind: package fate: removed-legacy owner: 0006 M5-RETIRE why: no exec site; container base utility from: - "image controlplane" - name: hostname kind: package fate: removed-legacy owner: 0006 M5-RETIRE why: no exec site; container base utility from: - "image controlplane" - name: coreutils kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: the image build's du and cp; the runtime container's copy goes with the container (no exec site in the core) from: - "image tools" - "image controlplane" - name: findutils kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: image build only; the runtime container's copy goes with the container from: - "image tools" - "image controlplane" - name: tar kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: image build only; the runtime container's copy goes with the container from: - "image tools" - "image controlplane" - name: gzip kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: image build only; the runtime container's copy goes with the container from: - "image tools" - "image controlplane" - name: squashfs-tools kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: supplied unsquashfs for the image build from: - "image tools" - name: cpio kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: see the cpio executable from: - "image tools" - name: xz kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: see the xz executable from: - "image tools" - name: zstd kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: see the zstd executable from: - "image tools" - name: e2fsprogs kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE, M2-VM-RUNTIME why: mkfs.ext4 for the rootfs on the build host (scripts/build-guest-image.sh runs mke2fs -d inside the pinned builder image); its runtime tools (debugfs, e2fsck, resize2fs) are deleted by design from: - "image tools" - "runner image" - name: busybox kind: package fate: build-host owner: 0007 M1-GUEST-IMAGE why: copied into the guest image by the build; the guest's busybox is part of the downloaded image from: - "image tools" - name: /etc/rancher/node/password kind: file fate: host-file owner: 0006 M1-INSTALL why: the k3s invariant (versions.json k3s); install writes it once, dev bind-mounts a per-instance copy in a userns from: - "image controlplane RUN" - name: /etc/subuid kind: file fate: host-file owner: 0006 M1-INSTALL, 0007 M2-VM-RUNTIME why: install bidder reserves one subuid range for the shared lingering account from: - "user decision 2026-10-12 per-VM subuid user namespaces" - name: /etc/subgid kind: file fate: host-file owner: 0006 M1-INSTALL, 0007 M2-VM-RUNTIME why: as /etc/subuid, for groups from: - "user decision 2026-10-12 per-VM subuid user namespaces" - name: /etc/apparmor.d/socialweb-computer-pasta kind: file fate: host-file owner: 0006 M1-INSTALL why: Ubuntu 24.04+ userns restriction; the profile grants userns to the pinned pasta asset path (user decision 2026-10-11) from: - "user decision 2026-10-11 AppArmor" - name: /var/lib/systemd/linger kind: file fate: host-file owner: 0006 M1-INSTALL why: install enables linger for the one shared account, so its user manager outlives logout from: - "user decision 2026-10-11 user manager of a lingering account" - name: /var/lib/socialweb kind: file fate: host-file owner: 0006 M1-INSTALL, M1-DEV-INSTANCE why: the state dir (install creates it; dev uses a per-instance dir under the user's state home) from: - "image k8s RUN install -d" - name: /opt/org-root kind: file fate: embedded-child owner: 0008 M1-TS-CLOSURE why: the socialweb-computer-k8s TypeScript closure (deno.json, deno.lock, ts/, socialweb-computer-k8s/ of this repo), embedded and run by the deno child from: - "image k8s COPY --from=k8stree" - name: /opt/deno-dir kind: file fate: embedded-child owner: 0008 M1-TS-CLOSURE, M1-DENO why: the deno module cache, populated from the embedded closure from: - "image k8s RUN deno cache" - name: /opt/socialweb/eso/external-secrets.yaml kind: file fate: linked owner: 0006 M1-ASSETS why: the ESO bundle pinned by bundleSha256, embedded in the core next to its pin; decided by Claude, user may veto from: - "image controlplane COPY --from=esobundle" - name: /opt/socialweb/deploy kind: file fate: linked owner: 0006 M2-MANIFESTS why: the deploy manifests become the core's embedded manifest sets from: - "image k8s COPY deploy/" - name: /dev/kvm kind: file fate: host-prerequisite owner: 0006 M2-HOST-CONTRACT, M1-INSTALL (kvm group) why: bidders only, reached through the kvm group, never handed to deno from: - "runner image entrypoint chmod" - name: /dev/net/tun kind: file fate: host-prerequisite owner: 0006 M2-HOST-CONTRACT why: bidders only, for pasta's tap from: - "runner image entrypoint chmod" - name: /sys/fs/cgroup kind: file fate: host-prerequisite owner: 0006 M2-HOST-CONTRACT why: a Linux kernel with cgroup v2 and cpu, memory and pids delegated to the user manager from: - "user decision 2026-10-11 gateway lifecycle manager" indirect: - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: nodefirecracker.DefaultPasta" resolves: [pasta] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: path" resolves: [pasta, kubectl, kine, kcp] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: probe" resolves: [unshare] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: f.firecracker" resolves: [firecracker] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: f.k3s" resolves: [k3s] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: onPath" resolves: [k3s] - site: "socialweb-computer-kcp/internal/checkhostmain/checks.go: copyPath" resolves: [socialweb-computer-kcp-check-host] - site: "socialweb-computer-kcp/internal/checkhostmain/platform.go: path" resolves: [qemu-system-x86_64] - site: "socialweb-computer-kcp/internal/checkhostmain/postgres.go: path" resolves: [initdb, postgres, psql] - site: "socialweb-computer-kcp/internal/checkhostmain/postgres.go: binaries[0]" resolves: [initdb] - site: "socialweb-computer-kcp/internal/clusterprovider/bootstraprows.go: bin" resolves: [psql] - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: name" resolves: [initdb, postgres, psql] - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: initdb" resolves: [initdb] - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: postgres" resolves: [postgres] - site: "socialweb-computer-kcp/internal/clusterprovider/postgres.go: psql" resolves: [psql] - site: "socialweb-computer-kcp/internal/kcplibs/impl/execrunner/supervisor.go: entry.binary" resolves: [deno] - site: "socialweb-computer-kcp/internal/kcplibs/impl/execrunner/supervisor.go: command[0]" resolves: [deno] - site: "socialweb-computer-kcp/internal/kcplibs/internal/livekcp/livekcp.go: Resolve(name)" resolves: [kcp, kubectl] - site: "socialweb-computer-kcp/internal/kcplibs/internal/livekcp/livekcp.go: name" resolves: [kcp, kubectl] - site: "socialweb-computer-kcp/ts/socialweb-computer-ssh/lib/socialweb-computer-ssh-requester/bridge.ts: argv[0]" resolves: [dumbpipe] - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/container-backend-docker/mod.ts: bin" resolves: [sudo] - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/container-backend-docker/mod.ts: dockerBin" resolves: [docker] - site: "socialweb-computer-kcp/ts/hono-compute-provider/lib/microvm-vmruntime/mod.ts: argv[0]" resolves: [socialweb-computer] - site: "socialweb-computer-kcp/cmd/socialweb-vmexec/main.go: p.VMM" resolves: [firecracker] - site: "socialweb-computer-kcp/ts/deno-worker-sandbox/lib/sandbox-deno/bundler.ts: exe" resolves: [deno] - site: "socialweb-computer-kcp/ts/policy-engine/lib/policies/deno-typescript/bundle/build-bundle.ts: Deno.execPath(" resolves: [deno] - site: "socialweb-computer-kcp/ts/policy-engine/lib/policies/gha-lite/scripts/build-actions.ts: Deno.execPath(" resolves: [deno] - site: "socialweb-computer-kcp/ts/policy-engine/lib/policy-engine-server-gha-lite/src/workflow.ts: this.denoPath" resolves: [deno] - site: "socialweb-computer-kcp/ts/policy-engine/lib/policy-engine-server-gha-lite/src/workflow.ts: args[0]" resolves: [bash, sh] - site: "socialweb-computer-kcp/cmd/socialweb-computer/dev.go: path" resolves: [kcp, kine] - site: "socialweb-computer-kcp/internal/hostsvc/hostsvctest/suite_linux.go: name" resolves: [sleep, sh] - site: "socialweb-computer-kcp/internal/bootstrap/bootstrap.go: argv[0]" resolves: [initdb, psql] - site: "socialweb-computer-kcp/internal/devstack/devstack.go: s.Bin" resolves: [socialweb-computer-kcp-check-host] - site: "socialweb-computer-kcp/internal/denorun/denorun.go: deno" resolves: [deno] - site: "socialweb-computer-kcp/internal/denorun/denorun.go: argv[0]" resolves: [deno] - site: "socialweb-computer-kcp/internal/tsbundle/tsbuild/build.go: o.Deno" resolves: [deno] - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: e.Path" resolves: [pasta] - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: self[0]" resolves: [socialweb-computer-kcp-check-host] - site: "socialweb-computer-kcp/internal/hostcontract/gather_linux.go: m.helper" resolves: [newuidmap, newgidmap] - site: "socialweb-computer-kcp/internal/install/system_linux.go: binary" resolves: [socialweb-computer-kcp-check-host] - site: "socialweb-computer-kcp/internal/install/system_linux.go: exe" resolves: [socialweb-computer-kcp-check-host]